Recommendation: As SBA develops the partnership agreement as required by the Small Business Innovation Protection Act of 2017, the Associate Administrator for SBA's Office of Entrepreneurial Development should document how SBA and USPTO will coordinate and leverage existing resources. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: As SBA develops the partnership agreement as required by the Small Business Innovation Protection Act of 2017, the Associate Administrator for SBA's Office of Entrepreneurial Development should develop ways to track SBDC implementation of intellectual property training with USPTO. (Recommendation 3)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: As SBA develops the partnership agreement as required by the Small Business Innovation Protection Act of 2017, the Associate Administrator for SBA's Office of Entrepreneurial Development should clarify the office's roles and responsibilities in helping SBDCs provide intellectual property training with USPTO. (Recommendation 4)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should commit to a time frame to complete the agency's effort to associate hardware with its FISMA systems. (Recommendation 13)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should document agency-specific variations from federal core configuration benchmarks for each operating system on its network. (Recommendation 14)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should configure its CDM tools to compare configuration settings against agency-specific benchmarks applicable to its environment. (Recommendation 15)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: SBA's Associate Administrator for Government Contracting and Business Development should develop a central repository for PCRs to store the supporting documentation for the data they report on their activities. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: SBA's Associate Administrator for Government Contracting and Business Development should ensure that SBA submits required reports to Congress on PCRs' assignments and activities. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Small Business Administration should develop and implement plans to identify and respond to risks in the Paycheck Protection Program to ensure program integrity, achieve program effectiveness, and address potential fraud, including in loans of $2 million or less. (Recommendation 3)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of SBA should develop and implement policies and procedures for assessing and tracking the impact of training provided to agency hiring managers and human resources staff on Schedule A hiring authority. This includes assessing the impact of its training on agency performance goals related to increased hiring of individuals with disabilities and targeted disabilities. (Recommendation 4)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of SBA should develop and implement policies and procedures for obtaining employee feedback about the agency's reasonable accommodations efforts and use such information to evaluate the ongoing effectiveness of the program. This may include identifying any effects on employee retention, identifying potential risks, and determining any improvements that may be warranted. (Recommendation 5)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should ensure Commercial Market Representatives clearly and consistently document compliance reviews and maintain these records. (Recommendation 10)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator of the Office of Entrepreneurial Development should reevaluate the SBDC funding application requirements, including reexamining the funding estimate SBDCs are required to use and considering other changes that could reduce administrative burdens on SBDCs. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should identify and document risks associated with its disaster response and plans to mitigate these risks in its disaster planning documentation. (Recommendation 1)

Agency: Small Business Administration: Office of Disaster Assistance
Status: Open
Priority recommendation

Comments: SBA agreed with the recommendation. SBA noted that relevant agency offices would collaborate to identify and document known risks associated with SBA's disaster response and implement a risk-informed approach to its direct response and recovery operations.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should identify the key elements of a disaster action plan and provide additional guidance to staff on how to incorporate these elements into future action plans. (Recommendation 2)

Agency: Small Business Administration: Office of Disaster Assistance
Status: Open
Priority recommendation

Comments: SBA agreed with the recommendation. SBA noted that the agency would develop the key elements of and templates for a disaster action plan, provide guidance to field operations centers, and update the agency's Disaster Preparedness and Recovery Plan.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should update its outreach plan to include information on region-specific risks or challenges, such as those encountered after the 2017 hurricanes. (Recommendation 3)

Agency: Small Business Administration: Office of Disaster Assistance
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should establish metrics to measure the success of its outreach efforts during the response to a disaster. (Recommendation 4)

Agency: Small Business Administration: Office of Disaster Assistance
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator for the Office of Capital Access should evaluate the implementation of the Express Bridge Loan Pilot Program to determine why so few loans have been made and if any design changes may be warranted before the end of the pilot. Such an evaluation could include assessing SBA's outreach efforts and seeking feedback from lenders. (Recommendation 5)

Agency: Small Business Administration: Office of Disaster Assistance
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Office of Financial Assistance should review and enhance guidance for the Microloan Program to ensure definitions of data collected, such as income, are clear and instructions are comprehensive for data needed, such as for borrower business outcomes and technical assistance. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Directors of the Office of Financial Assistance and Office of Program Performance, Analysis, and Evaluation should develop a performance target to assess the Microloan Program's progress in achieving its statutory purpose of assisting women, low-income, veteran, and minority entrepreneurs. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Directors of the Office of Financial Assistance and Office of Program Performance, Analysis, and Evaluation should ensure that appropriate advance planning occurs during the development of the new Microloan Program data reporting system by involving relevant offices within SBA in system design and considering data needed to assess program performance. (Recommendation 3)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should explore opportunities for additional interagency collaboration and information sharing with other federal agencies that engage in microlending activities, such as Treasury and USDA, and take steps to implement new collaborative efforts as warranted. (Recommendation 4)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Office of Financial Assistance should examine ways to incorporate public reporting of additional Microloan Program information into the design of the new data reporting system. (Recommendation 5)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should assign and document clear roles, responsibilities, and reporting lines for headquarters offices' implementation of SBA's plan for addressing the White House Initiative on HBCUs in a timely manner. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator of the Office of Entrepreneurial Development should take and document steps to ensure that the office's reporting mechanisms collect the information needed to establish a baseline for, and also inform future monitoring and assessment of, efforts to support HBCUs. (Recommendation 3)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrators of the Office of Entrepreneurial Development and Office of Field Operations should communicate planned efforts to support HBCUs, including expectations, goals, and related measures, to the district offices and Small Business Development Centers with HBCUs in their service areas. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Small Business Administration should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 16)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Small Business Administration should complete the agency's assessment of whether to participate in the 1994 Executive Order and the 2011 Memorandum of Understanding, and, if appropriate, develop an environmental justice strategic plan. (Recommendation 8)

Agency: Small Business Administration
Status: Open

Comments: In its comments on our report, the agency agreed with our recommendation. We will continue to review the agency's actions to update its progress in implementing the recommendation.

Recommendation: The Administrator of SBA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 57)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA concurred with this recommendation. As of January 2020, SBA stated that it intends to finalize its process for an agency-wide cybersecurity risk assessment by March 31, 2020. Once SBA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the Small Business Administration should take action to meet the data center optimization metric targets established under DCOI by OMB. (Recommendation 33)

Agency: Small Business Administration
Status: Open

Comments: In comments on our report, the Small Business Administration (SBA) agreed with our recommendation and began taking action to implement it. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the agency established new data center optimization targets. Subsequently, the agency reported meeting its target for server utilization. However, the agency had not yet met its targets for the advanced energy metering and virtualization metrics. We will continue to monitor SBA's progress in implementing this recommendation.

Recommendation: The Administrator of the Small Business Administration should ensure that the CIO of the Small Business Administration establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 32)

Agency: Small Business Administration
Status: Open

Comments: The Small Business Administration (SBA) concurred with our recommendation and reported that the agency would take action to address it. In November 2019, SBA officials reported that the agency had established a tool for monitoring the costs associated with the migration and deployment of cloud services. However, the documentation SBA provided did not indicate how cloud savings and cost avoidances would be isolated and reported. We will continue to monitor SBA's progress toward implementing this recommendation.

Recommendation: The SBA Administrator or her designee should (1) develop a process for periodically reviewing Federal Procurement Data System-Next Generation (FPDS-NG) data to determine the extent to which agencies are awarding WOSB program set-asides under ineligible North American Industry Classification System (NAICS) codes and (2) take steps to address any issues identified, such as providing targeted outreach or training to agencies making awards under ineligible codes. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: In May 2019, SBA analyzed FPDS-NG data to review the use of ineligible NAICS codes in the WOSB program. SBA officials also noted that they plan to conduct these reviews on an ongoing basis. As part of their May 2019 analysis, SBA identified federal agencies that had used ineligible NAICS codes. As of October 2019, SBA officials said that they were taking steps, including drafting presentation materials, to provide training on NAICS codes to agencies and planned to present quarterly at the Small Business Procurement Advisory Council FY 2020 meetings. SBA officials also noted that they had also provided training on NAICS codes as part of its FY 2019 performance reviews of procurement centers.

Recommendation: The Administrator of the Small Business Administration should implement procedures to track and verify that required employees complete initial ethics training and that completion of this training is documented. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: SBA officials provided documentation, including internal operating procedures for certifying and tracking initial ethics training, to support that they have taken initial steps to address our recommendation. In a letter dated September 13, 2019, SBA's Designated Agency Ethics Official stated that, since February 2019, SBA has used those procedures to document the provision of initial ethics training to political appointees. In that letter, SBA stated that it planned to provide additional documentation to GAO to support this action. When we receive this documentation, we will assess the implementation of SBA;s new procedures to confirm that, in operation, these procedures meet the intent of our recommendation.

Recommendation: The SBA Administrator should establish a process that ensures documentation of states' compliance with the total match requirement before grant closeout. (Recommendation 1)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA generally agreed with GAO's findings and concurred with our recommendations. In response to our draft report, agency officials said SBA will establish a process that ensures documentation of state recipients' compliance with the total match requirement before grant closeout. In September 2019, officials told us this process will include assigning SBA program office responsibilities for ensuring recipient compliance related to the cost match. In March 2020, SBA officials said they were still working on implementing changes to address our recommendation. GAO will continue to monitor the agency's implementation of this process.

Recommendation: The SBA Administrator should develop a process to determine states' compliance with the cash match requirement. (Recommendation 2)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA generally agreed with our findings and concurred with our recommendations. In response to our draft report, agency officials said they would develop a process to determine state's compliance with the cash match requirement. In September 2019, officials told us the process will apply to both grants specialists and program officers, and ensure the cost match is appropriately applied. In March 2020, SBA officials said they were still working on implementing changes to address our recommendation. GAO will continue to monitor the agency's implementation of this process.

Recommendation: The SBA Administrator or her designee should complete the design and implementation of a comprehensive evaluation of the Small Business Procurement Scorecard aligned with key attributes of effective program evaluations to assess the effectiveness of the revised scorecard in measuring agency performance and promoting small business procurement opportunities. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator or her designee should institute a process to review Small Business Procurement Scorecards for accuracy prior to publication and a mechanism for publicly identifying when issued scorecards have been revised. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of SBA should conduct and document reviews of staff compliance with procedures associated with HUBZone certification and recertification. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: In January 2020, SBA officials told us that the agency is re-aligning resources and developing standards to reflect new processing times for certifications and recertifications, which will include revised employee performance elements and quarterly performance reviews. When SBA has completed these changes, we will assess whether the agency is conducting and documenting reviews of staff compliance.

Recommendation: The Administrator of the Small Business Administration should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 25)

Agency: Small Business Administration
Status: Open

Comments: SBA agreed with most of our recommendations and, in September 2018, the agency said it is revising its departmental policies to address the responsibility gaps identified in the report. SBA's Data Center Optimization Initiative (DCOI) Strategic Plan's revised in 2019 addresses two of the 19 responsibility gaps identified in the report. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Small Business Administration should conduct a baseline assessment of the department's cybersecurity workforce that includes (1) the percentage of personnel with IT, cybersecurity, or other cyber-related job functions who hold certifications; (2) the level of preparedness of other cyber personnel without existing credentials to take certification exams; and (3) a strategy for mitigating any gaps identified with appropriate training and certification for existing personnel. (Recommendation 25)

Agency: Small Business Administration
Status: Open

Comments: Small Business Administration (SBA) officials concurred with our recommendation. SBA officials stated that they have made significant progress in the workforce assessment area, and have recently completed an assessment of the SBA's IT workforce and reported on existing skills gaps. SBA officials stated that they plan to execute against the IT workforce plan to include addressing requirements within the Federal Cybersecurity Workforce Assessment Act of 2015. As of August 2020, SBA had not provided evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: The Administrator of the Small Business Administration should submit a report of its baseline assessment of its existing cybersecurity workforce to the appropriate congressional committees of jurisdiction. (Recommendation 26)

Agency: Small Business Administration
Status: Open

Comments: Small Business Administration (SBA) officials concurred with our recommendation. SBA officials stated that they have made significant progress in the workforce assessment area, and have recently completed an assessment of the SBA's IT workforce and reported on existing skills gaps. SBA officials stated that they plan to execute against the IT workforce plan to include addressing requirements within the Federal Cybersecurity Workforce Assessment Act of 2015. As of August 2020, SBA had not provided evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: The Administrator of SBA should use its on-site and off-site reviews to routinely collect information on lenders' use of credit elsewhere criteria as part of its monitoring of lender practices related to the credit elsewhere requirement. (Recommendation 2)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Administrator of SBA should analyze information on lenders' use of credit elsewhere criteria obtained from its reviews to identify lenders that may be at greater risk of noncompliance and to inform its selection of lenders for further review for credit elsewhere compliance. (Recommendation 3)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: For the second and third recommendations, related to lender's use of the credit elsewhere criteria as part of its monitoring of lender practices, on June 11, 2019, SBA provided information on 7(a) lender reviews and summary reports. On September 27, 2019, we discussed these recommendations and SBA's responses with an SBA official. Specifically, we discussed the role of statistical sampling in addressing lender practices and SBA's selection of lenders for further review. On November 22, 2019, an SBA official stated that the agency plans to provide additional documentation in six months to further support actions taken. We will continue to monitor SBA's efforts to address this recommendation.

Recommendation: The Director of the Office of Investment and Innovation within SBA should work with participating agencies to implement the Commercialization Benchmark or, if that is not feasible, revise the benchmark so that it can be implemented (Recommendation 2).

Agency: Small Business Administration
Status: Open

Comments: SBA agreed with the recommendation. As of January 2020, SBA officials said they plan to continue working with participating agencies to determine a feasible way to implement the Commercialization Benchmark. According to SBA officials, SBA is leading an interagency Commercialization Working Group with participating agency officials and has implemented a commercialization reporting tool on the SBIR.gov site. Agency officials participating in the interagency working group have identified challenges with a single model for the benchmark and are working to resolve the issues.

Recommendation: To improve SBA's administration and oversight of the HUBZone program and reduce the risk that firms that no longer meet program eligibility criteria receive HUBZone contracts, the Administrator of SBA should establish a mechanism to better ensure that firms are notified of changes to HUBZone designations that may affect their participation in the program, such as ensuring that all certified firms and newly certified firms are signed up for the broadcast e-mail system or including more specific information in certification letters about how location in a redesignated area can affect their participation in the program

Agency: Small Business Administration
Status: Open

Comments: In response to this recommendation, SBA improved its notifications to newly certified firms but not to other certified firms. For example, SBA's certification letter to firms with principal offices in a redesignated area specifically states that the firm is in a redesignated area, explains the implications of the designation, and notes when the redesignated status will expire. However, we found in March 2016 that SBA had not yet implemented changes to better ensure that all currently certified firms would be notified of changes that could affect their program eligibility. It is important that all certified firms potentially affected by such changes receive information about the changes or are made aware in a timely fashion of any effects on their program eligibility. As of February 2017, SBA had begun to improve its notifications to all firms. According to SBA officials, the agency has started sending program notices to all the firms in its portfolio. They told us that for its most recent notice in February 2017, the agency copied all the e-mail addresses in its HUBZone database and placed them in the e-mail distribution system. In March 2018, SBA officials informed us that they obtain monthly lists of certified firms generated by an Oracle system process and that analysts compare the new list to the prior list and add any new firms to the list. In July 2019, SBA officials told us that they informed HUBZone firms of their responsibility to stay up to date on HUBZone geographical designations and program eligibility, through updated language in its HUBZone certification letters and two notices issued to HUBZone firms. While it is helpful that SBA now includes language in its certification letters notifying firms located in a redesignated area of the implications of that designation, SBA's current process does not inform firms when their status may change.

Recommendation: To improve SBA's administration and oversight of the HUBZone program and reduce the risk that firms that no longer meet program eligibility criteria receive HUBZone contracts, the Administrator of SBA should conduct an assessment of the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information, allowing firms to initiate the recertification process, and ensuring that sufficient staff will be dedicated to the effort so that a significant backlog in recertifications does not recur.

Agency: Small Business Administration
Status: Open

Comments: In response to this recommendation, SBA officials told us that they began automating the process to notify firms that were due for recertification. According to the officials, since September 2015, notification e-mails have been sent daily (compared with the former cycle of two times a year). Each firm due for recertification within the next 30 days would receive the notice. SBA sends a second e-mail to firms that have not responded within 45 days of the first notification. According to SBA officials, as of February 2017, this change has not yet eliminated the backlog. SBA officials informed GAO in May 2017 that they have developed risk-based guidance for conducting recertification reviews and requesting supporting documentation. According to SBA, any certified HUBZone small business concern that has received $1 million or more in HUBZone contract dollars since its initial certification (or its most recent recertification) must submit the following: (a) a list of all current employees, identifying the name of the employee, the employee's address, the number of hours worked per month, and the location where the employee performs his/her work; and (b) payroll documentation. While SBA officials stated that they had completed a risk assessment of their HUBZone recertification process, SBA had not provided GAO with documentation on when SBA performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold as of August 2018. In July 2019, SBA provided a rationale for its risk-based approach to recertification, but the analysis for establishing the $1 million threshold remained unclear. SBA officials told us that the agency plans to conduct a risk assessment in accordance with GAO guidance for all government contracting and business development programs, including the HUBZone program. GAO continues to believe that such a risk assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program.

Recommendation: To improve management and oversight of the WOSB program, and to help ensure the effective oversight of third-party certifiers, the Administrator of SBA should establish and implement comprehensive procedures to monitor and assess performance of certifiers in accord with the requirements of the third-party certifier agreement and program regulations.

Agency: Small Business Administration
Status: Open

Comments: In response to this recommendation, SBA has taken some actions. For example, SBA created a standard operating procedure stating that third-party certifiers are subject to a compliance review by SBA at any time, and SBA has completed a review of the four authorized third-party certifiers. We continue to monitor SBA actions to address this recommendation.

Recommendation: To improve management and oversight of the WOSB program, and to provide reasonable assurance that only eligible businesses obtain WOSB set-aside contracts, the Administrator of SBA should enhance examination of businesses that register to participate in the WOSB program, including actions such as: (1) promptly completing the development of procedures to conduct annual eligibility examinations and implementing such procedures; (2) analyzing examination results and individual businesses found to be ineligible to better understand the cause of the high rate of ineligibility in annual reviews, and determine what actions are needed to address the causes; and (3) implementing ongoing reviews of a sample of all businesses that have represented their eligibility to participate in the program.

Agency: Small Business Administration
Status: Open

Comments: In response to this recommendation, SBA has created a standard operating procedure that includes some procedures for annual eligibility examinations. We continue to monitor SBA actions to address this recommendation.

Recommendation: To more effectively implement SBA's expansion of OIT field staff as required by the SBJA, the Administrator of the SBA should update SBA's plan for additional OIT staff to include funding sources and time frames, as well as possible efficiencies from clearly defining roles and responsibilities and leveraging other entities' export assistance resources.

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA concurred with our recommendations. In response to the Small Business Jobs Act of 2010 (SBJA) requirement that a total of 30 export finance specialists be hired nationwide by September 2012, SBA noted resource constraints and filled only 19 positions at that time. In 2016, SBA reported progress toward the SBJA requirement despite agency staffing limitations and staffed a total of 21 or 70% of the 30 required export finance specialist (EFS) positions. SBA officials also reported that they had hired staff to replace retirements or other staff departures, but determined that because of finite funding resources it would not be feasible to hire additional OIT staff. They instead took steps to mitigate the shortfall by engaging other field office staff to more proactively market its international trade programs to small businesses. In particular, in 2017, as part a result of the new Administrations' Agency Reform plan, SBA undertook a Field Alignment Project. Specific to OIT, this project was intended to better leverage certain District office field staff such that they would increase outreach efforts to promote exports as required by the SBJA and in response to GAO's recommendations. This was done by assigning district staff new specific output goals intended to increase export promotion activities. In January 2020, OIT reported hiring four additional export finance specialists, bringing the total hired to 25. OIT also reported establishing a strategy for future hires to be assigned to existing Export Assistance Centers, and requesting fiscal year 2021 funding to hire individuals to fill the remaining five positions. While these steps partially mitigate the shortfall and are in the spirit of the SBJA requirement and GAO's recommendations, as of January 2020 SBA has not yet achieved the 30 export finance specialists required by the SBJA.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should fully establish an approach for measuring enterprise architecture outcomes, including a documented method (i.e., steps to be followed) and metrics that are measurable, meaningful, repeatable, consistent, actionable, and aligned with the agency's enterprise architecture's strategic goals and intended purpose.

Agency: Small Business Administration
Status: Open

Comments: As of June 2020, the Small Business Administration had not implemented this recommendation. In August 2019, SBA developed an enterprise architecture program performance guide and value measurement plan. According to the plan, the agency plans to measure cost savings/avoidance and reduction of duplication. However, the agency has not demonstrated that it has documented the steps to be followed to measure the outcomes. Specifically, it did not demonstrate that it had established a method to measure the cost savings/avoidance or the number of duplicate investments reduced.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should periodically measure and report enterprise architecture outcomes and benefits to top agency officials (i.e., executives with authority to commit resources or make changes to the program) and to OMB.

Agency: Small Business Administration
Status: Open

Comments: As of June 2020, the Small Business Administration (SBA) had not implemented this recommendation. SBA's Office of the CIO stated that it achieved IT cost savings and avoidance as a result of IT infrastructure service and support reduction and data center optimization in fiscal years 2014 through the third quarter of fiscal year 2019. In a March 2020 memo to GAO, the Chief Information Officer explained that the agency's enterprise architecture team reviewed IT acquisition requests, which led to reducing duplicative IT investments and resulted in the cost savings and avoidance. However, the agency did not demonstrate that it had reliably measured the cost savings and avoidance. Specifically, it did not provide documentation demonstrating how it calculated most of the savings it reported.