# Presentation: 335292

## Internal Controls at SBA

- Jennifer Main
- Chief Financial Officer, SBA
- March 10, 2006
- jennifer.main@sba.gov

## Agenda

- Brief background on SBA
- Internal control weaknesses that led to disclaimed audit opinion
- Resolution strategy and results
- A-123 implementation approach

## Overview of SBA

- SBA is one of the smallest of the 24 CFO Act agencies
- 2,100 regular employees and about 4,000 temporary disaster employees currently
- SBA’s direct loan and loan guarantee portfolios of about $66 billion make up vast majority of balance sheet
- In 2002, our auditor withdrew prior unqualified opinion and issued a disclaimer
- In 2005 we regained our unqualified opinion but still have one material weakness (financial reporting)

## Re-establishing Internal Control

- Internal control weaknesses led to FY02 disclaimed audit opinion
- Challenges across the spectrum:
- Control Environment
- Risk Assessment
- Control Activities
- Information & Communications
- Monitoring

## Examples of Weaknesses

- 3 conflicting valuation methods for asset sales – 2 developed by same team
- None were right
- Off by $2 billion
- Cash shortfall in loan guarantee financing account – $50 million overdraw
- No regular tracking or review of cash or obligations position in credit accounts
- No internal support across offices – “those are *their* numbers, not ours...”

## How Did It Happen?

- Poor communication across offices – budget, subsidy modeling, and accounting
- Communication weak within offices & between staff & senior OCFO management
- Culture focused on providing management with numbers to support its agenda
- Dissenting views not welcomed
- No focus on internal controls within OCFO

## Strategy for Resolution

**Change the culture**
- Reset expectations – focus on core financial management
- “It is what it is” became our mantra
- Facilitate communication and hold people accountable

## Communication & Accountability 

- Create accountability through communication
- Established two OCFO teams
- Loan team
- Admin team
- Meet bi-weekly
- Key staff from all offices are members of the teams
- Annual work plans – staff recommendations of critical issues plus audit findings

## Results from Team Approach

- Sub-teams resolved agreed upon issues (audit remediation and others)
- Created new reports – funds availability, credit program cash flows
- Risk assessment process part of yearly planning
- Updated documentation of critical processes
- Continual feedback and assessment through regular team meetings
- Met 11/15 deadline in FY04
- Earned unqualified opinion in FY05

## Credit Programs

- Special initiative to establish internal controls for credit subsidy models
- Checklist for compliance with requirements
- Change control & compliance process with 3 levels of sign-offs, internal review & external review
- Documentation of models & assumptions
- Detailed reconciliations with accounting data
- Updated procedures for whole area
- Elimination of material weakness in FY05

## Keys to SBA’s A-123 Approach

- Leverage existing efforts; don’t reinvent
- Using auditor cycle memos as starting point
- Examples – existing improper payment testing, external reviews of credit cost models
- Be pragmatic – aggressive but realistic about first year
- Pick a few key things in each area and concentrate on them
- Use initiative to expand Agency managers’ view of themselves as “financial managers”
- Two-pronged approach:
- Traditional account risk analysis
- Program office driven risk assessments

## Organizational Issues

- OCFO hired a contractor to support the effort
- Established a Senior Assessment Team (SAT) in 8/05
- Insufficient resources to do internally
- Little redundancy in operations staff after years of downsizing
- Hard to staff independent office within OCFO – insufficient knowledge to do credible job
- Contractor to support testing at least first year
- Currently hiring 1 person to help lead effort

## Determining Scope of Project

- Including all basic financial reports first year
- 2 additional –  daily loan guarantee volume report & loan guarantee status report
- Materiality – baseline of 0.75% threshold
- SAT will consider whether lower threshold is appropriate – e.g. daily loan volume report where tolerance is zero
- Risk assessments generate lists of areas to review – prioritizing this year vs. next year

## Determining Scope of Project

- Focus is on known problem areas including IG and auditor identified issues – e.g. SBA lender reporting initiative
- Criteria for prioritizing include:
- how much money is involved
- inherent riskiness or complexity of the transactions
- evidence of existing problems
- program office level of concern and focus

## Example of Scope

_**Origination**_
- Eligibility
- Guaranty fee receipt – timely correct amount?
**Approvals – valid undelivered orders?  (testing)**
- Approval data – good quality and sufficient?
_**Servicing**_
- Annual fees – receipt timely and correct?
**Loan guaranty status data submitted through 1502 reporting process – is the information accurate (additional review and testing)**
- Prepayment penalties – timely and correct?
- Post-approval loan amount and term changes – do they flow through all systems accurately?

_**Secondary Market**_
- Need updated SOP (9/30/06 target)
**Fiscal & Transfer Agent (FTA) contract – all issues in FY03 IG report in resolved?  (review)**
- Is data from FTA for subsidy modeling complete and accurate?
- Timing of SBA’s purchases out of the pools – is the process working effectively?
_**Purchase/Liquidations**_
**Improper payments in purchase area (review)**
- Is SBA getting the appropriate share of liquidation proceeds?  Are expenses charged by lenders appropriate?
**Charge offs – are they being completed in a timely manner?  (review and test)**
**Valuation of receivables – are they accurate?  (review, maybe test)**

## Making it Relevant to Managers

- Two pronged approach includes having accounting team conduct Account Risk Analyses while program managers identify critical processes through risk assessments
- Combining quantitative and qualitative approaches ensures good coverage of all potential risks
- Having managers participate in risk assessment increases their sense of ownership and responsibility
- Provides a good opportunity for training about risk management and internal controls which is necessary for ultimately changing the culture

## Testing Plan & Assurance Statement

- We plan to test all key controls this year to establish a baseline
- In future years, testing can be modified to address higher risk areas as determined by the baseline assessment
- As appropriate based on our findings, we will be reporting the results in the PAR and including our plans for correcting weaknesses identified

## Progress to Date:  Challenges

- Lack of time by knowledgeable staff is biggest challenge – OCFO team and program office staff
- Fear of the unknown – we’ve never looked under that rock before!
- Hurricane Katrina impact – unanticipated activities
- Keeping up the momentum is the hardest part

## Progress to Date:  Opportunities

- Generally more positive reception than anticipated from program managers around the Agency
- Entity-wide assessment particularly colorful and thought provoking
- SAT members interested in using this to leverage activity on difficult problems
- Helped to offer program offices consulting resources to help with risk assessments, documentation, etc.