The SBA’s Loan Management and Accounting System –

Incremental Improvement Projects 

Briefing Report
U.S. Small Business Administration

Office of Inspector General

Washington, D.C. 20416

Report Transmittal

Report No. 13-11 

Date: March 12, 2013

To: Paul T. Christy

 Chief Operating Officer

 

Subject: The Small Business Administration’s Loan Management and Accounting System 

Incremental Improvement Projects

This report presents the results of our review of the Small Business Administration’s effort to modernize its loan management system and migrate off the mainframe environment. Specifically, this 

report addresses issues identified in the planning, management, and oversight of SBA’s ongoing migration efforts. We have incorporated the formal comments from the Chief Operating Officer and 

the Executive Steering Council into this report.

Please provide your response to this report for each recommendation on the attached SBA Forms 

1824, Recommendation Action Sheet, by April 11, 2013.

Consistent with OMB Circular A-50, your response should include the corrective action(s) taken or 

planned for each recommendation and the target date(s) for completion. If you disagree with the 

recommendations, please fully explain the reasons for disagreement. Please include the legal basis 

for disagreement based on interpretation of law, regulations, or the authority of officials to take or 

not take action. You may also propose alternative actions to those recommended that you believe 

would better address the issues presented in this report.

In order to fulfill our responsibility under the Inspector General Act, we are providing copies of our 

report to the appropriate congressional committees responsible for oversight of the Small Business 

Administration. We will also post this report on the Office of Inspector General website for public 

dissemination.

We appreciate the courtesies and cooperation of the Office of Capital Access and the Office of the 

Chief Information Officer during this review. If you have any questions concerning this report, 

please call me at (202) 205-7390 or Jeffrey Brindle, Director, Information Technology and Financial 

Management Group, (202) 205-7490.

***

/s/

John K. Needham

Assistant Inspector General for Auditing 
2

Table of Contents

Briefing Report

Highlights............................................................................................................................................... 3

Background ............................................................................................................................................ 4

Approach................................................................................................................................................ 5

Overall Results....................................................................................................................................... 5

Finding 1: The SBA Needs an Incremental Improvement Project to Migrate New Software ......... 6

Finding 2: The Scope of the Root Cause Analysis Project was Changed ........................................... 6

Finding 3: The SBA’s Loan Management and Accounting System Incremental Improvement 

Projects ................................................................................................................................................... 7

Finding 4: Quality Assurance Program Did not Exist......................................................................... 8

Finding 5: Independent Verification and Validation Program Did Not Exist...................................9

Agency Comments and Office of Inspector General Response.........................................................10

Appendix I: Agency Comments ..........................................................................................................12
3

Highlights

Why the OIG Performed this Review

Since 2004, a significant management challenge 

facing the SBA is the modernization of the loan 

accounting process, where the Loan Accounting 

System is the central hub. The Loan Accounting 

System processed and managed a loan portfolio 

totaling over $99 billion in FY 2011. 

What the OIG Reviewed

The OIG reviewed the Loan Management 

Accounting System – Incremental Improvement 

Projects (LMAS-IIPs), which included the:

 Systems Development Life Cycle 

deliverables and documentation for LMAS 

incremental projects.

 Root Cause Analysis and User Interface 

Migration. 

 Implementation and operation of a Quality 

Assurance (QA) program and an 

Independent Verification and Validation 

(IV&V) program for the LMAS-IIPs. 

What the OIG Found

The OIG found that the SBA successfully 

migrated the data-entry of over 44% of its loan 

and lending transactions from mainframe dataentry to web-based data entry, the first step in 

fully migrating off SBA’s legacy mainframe and 

utilizing updated technology. 

During our review of the LMAS IIPs, the OIG also 

found that:

 The SBA did not have an incremental 

improvement project to migrate its newly 

created COBOL code into production.

 The Root Cause Analysis Project had been 

altered from its initially approved project.

 The User Interface Migration Project screens 

were not security tested and validated.

 The QA and IV&V programs did not exist.

The LMAS-IIP is A Major 

Management Challenge for the SBA

The LMAS-IIP is addressed in Challenge 8 of the 

OIG’s annual report The Most Serious 

Management Challenges Facing the SBA, “The 

SBA needs to modernize its Loan Accounting 

System and migrate it off the mainframe.” 

Similar issues in this challenge are related to: 

 planning the migration off the mainframe, 

and 

 quality assurance and independent 

verification and validation.

The SBA’s Progress in Reducing Mainframe 

Transactions

 10.29 million transactions were processed on 

SBA’s mainframe during the last six months of 

FY 2011.

 5.79 million transactions were processed on 

SBA’s mainframe during the last six months of 

FY 2012. 

 This decrease represents a 44% 

reduction of mainframe utilization 

from FY 2011 to FY 2012.

 All User Interface transactions are scheduled 

to be migrated off the mainframe by 

September 2013.

10.29

5.79

5

6

7

8

9

10

11

2011 2012

Reduction of Mainframe 

Transactionsin Millions
4

Background

The Loan Management and 

Accounting System (LMAS) 

Since 2004, one of the single greatest management challenges facing the SBA is the modernization of the loan accounting process, where the 

Loan Accounting System serves as the central 

hub. The Loan Management Accounting System 

is:

 A collection of transaction data entry screens 

for SBA loan and lending transactions that 

are directly entered into the mainframe for 

processing.

 A daily cycle of loan and lending transactions― processed nightly― that update the 

database and includes information from other SBA systems.

The Loan Management Accounting System processed and managed a loan portfolio that totaled 

over $99 Billion in FY 2011. 

LMAS-IIP Description Status

Complete the R12 

upgrade

Upgrade SBA’s administrative accounting and management system to Oracle Financials.Completed

Migrate Denver Finance 

from Sybase to Oracle

Migrate SBA’s legacy databases at its Denver office to its current 

database infrastructure.

In process

Migration of user 

interfaces

To migrate all user interface components from the legacy mainframe platform to SBA’s current web-based infrastructure.Nearing 

Completion

COBOL Port Convert the Unisys proprietary COBOL code to a version of 

COBOL compatible with UNIX.

In process

Document Loan 

Accounting

Document the new processes in order to capture and transfer 

knowledge about the new LMAS environment.

In process

Root Cause Analysis Analyze remaining issues and develop plans to prioritize additional projects to address SBA’s most important business needs.Scope changed

Implement 

Improvements

Implement the improvements identified by the root cause analysis and the analysis of new processes.Not started

The LMAS Incremental Improvement 

Projects (IIPs)

The LMAS-IIPs were designed to be a series of 

focused and cost-effective projects to upgrade 

existing financial software and application modules in the SBA’s Loan Accounting System that 

included:

 

 Migrating these modules off of SBA’s outdated mainframe environment;

 The development and migration of user interface screens from SBA’s mainframe to 

newer technology (in its most recent iteration), and

 Conforming with OMB’s Memorandum 

10-26, Immediate Review of Financial Systems IT Projects, which requires agencies to 

split large development projects into smaller 

simpler segments with clear deliverables.
5

Objective

The objective of the OIG Review was to determine the progress of the Loan Management 

Accounting System Program (LMAS) – Incremental Improvement Projects (IIP) since the 

issuance of Audit Report 10-14, Adequacy of 

Quality Assurance Oversight of the Loan 

Management Accounting System Project on 

September 13, 2010.

Scope and Methodology

We performed our review in accordance with 

Quality Standards for Inspections and Evaluations issued by the Council of Inspectors Generals on Integrity and Efficiency. 

To conduct our evaluation, we examined:

 The SBA’s progress against open audit recommendations and challenge #8 of the 

FY 2012 Report on the Most Serious Management and Performance Challenges Facing the 

Small Business Administration, “The SBA 

needs to modernize its Loan Accounting 

System and migrate off the mainframe.” 

 The interim progress of the ongoing 

LMAS-IIPs.

To determine progress we compared agency 

actions against criteria set by OMB Memoranda, 

NIST Special Publications, and SBA Standard 

Operating Procedures. 

This evaluation covered the period from 

January 2011, when OMB granted approval of the 

LMAS-IIP, and November 2012 when we completed fieldwork.

In Fiscal Year 2012, the SBA successfully migrated 

the data-entry of 44% of its loan and lending 

transactions from its mainframe data-entry to 

web-based data-entry. 

This migration was a successful first step in fully 

migrating off SBA’s legacy mainframe and utilizing updated technology.

The OIG identified five findings that put the development of this project at risk for not meeting 

the needs and expectations of the SBA, the Office 

of Management and Budget (OMB), and Congress. These findings discussed, discussed further below, are as follows:

 The first issue was that the SBA does not 

have an incremental improvement project to 

migrate its newly created COBOL code into 

production. 

 The second issue concerned the Gap Analysis 

and Strategic Planning Project for the 

LMAS-IIP, which included a Root Cause 

Analysis, as approved by the SBA’s Business 

Technology Investment Council (BTIC) and 

OMB. 

 The third issue related to the LMAS-IIP User 

Interface Migration project screens, which 

were not tested and validated by the SBA’s 

Office of Chief Information Officer, Information Security.

 The fourth and fifth issues related to the 

LMAS-IIP Quality Assurance (QA) and Independent Verification and Validation (IV&V) 

programs, which did not exist during the 

LMAS-IIP. 

Approach Overall Results
6

The SBA does not have an IIP, as recommended 

by OMB, to migrate its newly created COBOL 

code into production.

 Currently, the SBA has an IIP (the COBOL 

Port) to convert its Loan Accounting System 

with proprietary COBOL code to a version 

of COBOL that is compatible with UNIX. 

This conversion of COBOL code, if implemented on a new processing platform, 

would allow the SBA to fully migrate off its 

legacy mainframe environment to a more 

up-to-date and non-proprietary COBOL 

environment.

 The absence of an improvement project occurred because existing project plans did 

not include production use of the newly 

ported COBOL code. 

According to OMB Memorandum 10-26, Immediate Review of Financial Systems IT Projects:

 Agencies should prioritize their needs and 

functionality to focus on the most critical 

business needs to avoid cost overruns and 

lengthy delays.

 The most critical functionality should be 

delivered first, and functions of lesser importance can be considered for subsequent 

delivery.

The SBA briefed OMB in March 2012 on the status of the LMAS project. The SBA recognized 

the importance of migrating the batch COBOL 

systems from the legacy platform to a more 

up-to-date and non-proprietary COBOL environment. 

We analyzed the seven IIPs and determined 

that: 

 There is currently no LMAS project to migrate the batch COBOL systems from the 

legacy platform to a more up-to-date and 

non-proprietary production environment.

 The current COBOL Port IIP identifies the 

code converted into a test environment but 

never specifically identifies implementing 

the new code into production, which is necessary for the LMAS to be functional.

As a result, the SBA may be developing code 

that might not be implemented in its computing 

environment.

Recommendation 1

We recommend that the SBA adopt a new IIP 

under LMAS to facilitate the transfer of data and 

move its new COBOL code to a full production 

environment.

***

The LMAS-IIP Root Cause Analysis Project, as 

approved by the SBA’s BTIC and OMB, had been 

altered from its initially approved project —

analyzing the completed IIPs and making recommendations on new potential IIPs—to two 

projects on (1) funds control and (2) the development of a data dictionary. 

The OMB’s Memorandum 10-26 requires that 

after the most critical functional needs are in 

place, further prioritization of secondary needs 

should be performed. Therefore, revised projects plans should prioritize the most critical 

remaining financial functions.

Findings 1 & 2

Finding 1: The SBA Needs to Create 

an additional Incremental 

Improvement Project to Migrate its 

new COBOL Code into Production

Finding 2: The Scope of the Root 

Cause Analysis Project was Changed 

to Only Review Funds Control and 

Develop a Data Dictionary
7

The change of the scope of the Root Cause Analysis occurred without BTIC approval. The original purpose of the Root Cause Analysis was to 

identify areas where completed IIPs had remaining issues or desired enhancements. 

 Any gaps that were not addressed by the 

completed IIPs would be identified and addressed in future projects. 

 The original Root Cause Analysis was done 

to ensure that the LMAS-IIPs would meet 

full potential, and successfully migrate off 

SBA’s mainframe computer system. 

The reduced scope of the Root Cause Analysis 

created a situation in which the LMAS-IIPs no 

longer had the capability to analyze identified 

issues and develop plans to prioritize additional 

projects to address SBA’s most important business needs.

Recommendation 2

We recommend that the SBA ensure that the 

Root Cause Analysis IIP be revised so that it 

conforms to the scope originally approved by 

the BTIC. The Root Cause Analysis should: 

(1) identify the most critical business needs of 

the SBA; 

(2) analyze remaining issues when each LMASIIP is completed; and 

(3) develop plans to prioritize additional projects to address SBA’s most important business needs.

***

The SBA had implemented new LMAS user interface screens as early as October 15, 2011. However, 

the SBA did not perform a security impact analysis on these new user interface screens before 

they were put into production. Therefore, the 

SBA unintentionally invalidated the Electronic 

Transaction (E-Tran) System Authority-toOperate since they did not test the LMAS screens 

before they were put into production.

The OCIO—IT Security was unaware that the 

new LMAS user interface screens had entered into 

production in the E-Tran System when we first 

met with them in August 2012. As a result of our 

meeting, IT Security notified us that they would 

immediately address this with the LMAS Project 

Director and have a Security Impact Analysis performed on the LMAS-IIP user interface screens. 

Under the Federal Information Security Management Act, LMAS user interface screens are required to be validated and tested as a part of a 

major modification to the E-Tran system Authority-To-Operate before the new User Interface 

Screens are put into production. Further, the 

NIST Special Publication, Guide for Applying the 

Risk Management Framework to Federal Information Systems (SP 800-37), requires that:

 A security impact analysis should be conducted by the organization when changes are proposed to determine the extent changes to the 

information system affect the security of the 

system. 

 The information system owner should consult 

with appropriate organizational officials prior 

to implementing any security-related changes 

to the information system or its operating 

environment.

 Finding 3

Finding 3: New LMAS User Interface 

Screens were not Validated and Tested 

by OCIO—IT Security Before They 

Were Put into Production
8

Recommendation 3

We recommend that the Office of Chief Information Officer—IT Security perform a Security 

Impact Analysis on the E-Tran user interface 

screens to determine the security implications of 

the new user interface screens.

Recommendation 4

We recommend that the Office of Chief Information Officer— IT Security, in conjunction with 

the SBA Office of Capital Access, initiate the process of reauthorization of E-Tran for operation 

due to the changes to the operating environment.

***

The LMAS-IIP Quality Assurance (QA) program 

did not exist during the time of our review. This 

resulted in a lack of adequate systems development project oversight. Without an effective QA 

capability, an independent advisor reporting on 

compliance with BTIC and LMAS Executive Steering Committee mandates did not exist. 

We requested all QA assessments of the 

LMAS-IIP Program from the QA Manager. 

No QA assessments were provided during the 

timeframe of our review. The QA manager explained that:

Along with his other duties, he did not have adequate resources to perform QA reviews of LMASIIP deliverables, and that the SBA was in the process of obtaining contractor support to perform 

the QA team functions. A functioning QA program would have identified and reported to the 

LMAS Executive Steering Committee the major 

scope changes to the Root Cause Analysis IIP as 

identified in Finding 2 in this report.

The SBA’s Standard Operating Procedure 90 41 

0, Procedures for Managing and Assessing the 

Quality of SBA Information Technology Projects 

states that the purpose of the IT QA program is 

to:

1) provide clear guidance in the delivery of 

quality IT deliverables,

2) ensure quality in the acquisition, design, 

development, testing, implementation and 

operation of IT programs, and

3) conduct QA assessments on Agency IT acquisitions, investments, programs, projects 

and operations.

Additionally, according to OMB Memorandum 

10-26, Immediate Review of Financial System IT 

Projects, ongoing, transparent system oversight 

is required of all agencies. Specifically, agencies 

should identify, up-front, a series of milestones, 

warning flags, and stop-points, which, if deemed 

necessary, can cause a project to be suspended 

and returned to planning. This is of particular 

concern since our prior audit on LMAS1 reported 

that:

 Although a QA manager was added to the 

project, he was unable to dedicate a sufficient amount of time to the project due to 

his other workload demands, and 

 The SBA’s management stated they would 

add a full-time QA Manager responsible for 

the IT QA program, and additional resources, such as contracted support specific 

to the LMAS IT QA function.

Finding 4

Finding 4: The LMAS-IIP Quality 

Assurance Program Did Not Exist At 

the Time of Our Review

1

 OIG Audit Report 10-14, Adequacy of Quality Assurance Oversight of the Loan Management Accounting 

System Project, issued September 13, 2010.
9

Recommendation 5

We recommend that the Office of Chief Information Officer implement a Quality Assurance 

program that reports compliance at the project 

level to the ESC and the BTIC, at regular intervals.

***

The SBA did not have an operational Independent Verification and Validation program, a key 

oversight component, during the LMAS-IIP. As 

a result, there is less assurance that LMAS-IIP 

deliverables meet their user and security requirements before being implemented into production.

The SBA’s Standard Operating Procedure 

90 41 0—Procedures for Managing and Assessing 

the Quality of SBA Information Technology Projects—provides guidance on SBA’s IT Independent Verification and Validation 

(IV & V) program:

 Independent Verification and Validation is 

the process of contracting with an independent source to verify and validate that 

the IT deliverables meet the requirements as 

outlined in the contract or statement of 

work [or project requirements]. 

We requested all IV&V reports of the LMAS-IIP 

Program from the program manager, but no 

reports were provided during our review. 

The QA manager, who also manages the IV&V 

program, explained that:

 Adequate resources to perform IV&V reviews 

of LMAS-IIP deliverables were not obtained, 

and that the SBA was in the process of obtaining contractor support to perform IV&V functions. 

During IV&V testing, a functioning IV&V Program 

should have found that the SBA’s IT Security 

Office had not been a member of the LMAS-IIP 

and had not performed a Security Impact Analysis 

on LMAS user interface screens.

The lack of an IT Independent Verification and 

Validation program is of concern since our prior 

audit on LMAS (See Footnote 1), since:

 Eliminating IV&V testing for the LMAS project, the SBA is at risk of deploying a mission 

critical system with undetected errors and 

with limited assurances that program and 

functional requirements are fully satisfied.

 The SBA responded to the prior audit by stating that LMAS would conform to the QA 

Standard Operating Procedures when those 

procedures became effective. 

Recommendation 6

We recommend that the Office of Chief Information Officer implement an Independent Verification and Validation program for the LMAS-IIP 

that tests and validates that each IIP meets its program and functional requirements.

Finding 5

Finding 5: The LMAS-IIP Independent 

Verification and Validation Program 

Did Not Exist
10

Recommendation 1

We recommend that the SBA adopt a new Incremental Improvement Project under LMAS to facilitate the transfer of data and move its new 

COBOL code to a full production environment. 

Agency Comments: The ESC concurs. This 

effort will be aligned with the agency’s overall 

data center consolidation strategy.

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

***

Recommendation 2

We recommend that the SBA ensure that the 

Root Cause Analysis Project conforms to the 

scope originally approved by the BTIC. The Root 

Cause Analysis should: 

(1) identify the most critical business needs of 

the SBA; 

(2) analyze remaining issues when each LMASIIP is completed; and 

(3) develop plans to prioritize additional projects 

to address SBA’s most important business 

needs.

Agency Comments: The ESC concurs that the 

Root Cause Analysis project should address 

SBA’s most important business needs....SBA’s 

remaining issues are analyzed and prioritized 

within each SBA organization’s operations and 

maintenance activities.

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

***

Recommendation 3

We recommend that the Office of Chief Information Officer IT Security perform a Security 

Impact Analysis on the E-Tran user interface 

screens to determine the security implications of 

the new user interface screens.

Agency Comments: The ESC concurs with the 

recommendation for IT Security to perform a 

Security Impact Analysis on E-TRAN. 

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

***

Recommendation 4

We recommend that the Office of Chief Information Officer IT Security, in conjunction with 

the SBA Office of Capital Access, initiate the process of reauthorization of E-Tran for operation 

due to the changes to the operating environment.

Agency Comments: The ESC concurs with the 

recommendation for IT Security to perform 

reauthorization of E-TRAN. 

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

***

Agency Comments: Recommendations 1-4

We provided a draft of this report to the SBA 

Chief Operating Officer (COO) dated 

January 23, 2013. On February 25, 2013, the COO 

submitted formal comments for the LMAS 

Executive Steering Committee (ESC) which are 

included in their entirety in the appendix to this 

report. The ESC concurred with our findings and 

recommendations. A summary of management’s 

comments, followed by our responses are below.
11

Recommendation 5

We recommend that the Office of Chief Information Officer implement a Quality Assurance 

program that reports compliance at the project 

level to the ESC and the BTIC, at regular intervals. 

Agency Comments: The ESC concurs with the 

recommendation for OCIO to implement a QA 

program that reports at the project level to the 

ESC and BTIC. 

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

***

Recommendation 6

We recommend that the Office of Chief Information Officer implement an Independent Verification and Validation program for the LMAS-IIP 

that tests and validates that each IIP meets its 

program and functional requirements. 

Agency Comments: The ESC concurs with the 

recommendation for OCIO to implement an 

Independent Verification and Validation program for the LMAS-IIP that tests and validates 

that each IIP meets its program and functional 

requirements.

OIG Response: We consider management’s 

comments to be responsive to the recommendation.

Agency Comments: Recommendations 5 & 6
12

WASHINGTON, D.C. 20416

U.S. Small Business Administration

DATE: February 25, 2013

TO: John K. Needham

Assistant Inspector General for Auditing

FROM: Paul Christy

Chief Operating Officer

SUBJECT: SBA Response to Briefing Report for the SBA's LMAS/IIP's

CC: Marie Johns, Deputy Administrator

Stephen Kucharski, Office of Capital Access

This memo transmits SBA’s response and comments to the findings and recommendations 

included in your draft Briefing Report for The SBA Loan Management and Accounting System 

(Project No. 12-012).

The LMAS project team met with the Executive Steering Council (ESC) and briefed the 

ESC and its chair, Deputy Administrator Marie Johns. The ESC approved the management responses and the expanded document which is attached to this memo.

The ESC looks forward to working with you and your team to continually assess and monitor the successful completion of this critical project.

Attachment
13

`

U.S. Small Business Administration

Response to Office of Inspector General (OIG)

Project No, 12-012

February 25, 2013

`

U.S. Small Business Administration

Response to Office of Inspector General (OIG)

Project No, 12-012

February 25, 2013
14

Contents 

1. Executive Summary ....................................................................................... 2

2. Background ................................................................................................... 3

3. Response to OIG Recommendations............................................................. 4

3.1. Recommendation 1 Response .................................................................... 4

3.2. Recommendation 2 Response .................................................................... 4

3.3. Recommendation 3 Response .................................................................... 4

3.4. Recommendation 4 Response .................................................................... 4

3.5. Recommendation 5 Response .................................................................... 5

3.6. Recommendation 6 Response .................................................................... 5

1
15

1.Executive Summary

This document is intended to respond to the Office of Inspector General’s (OIG) report for project 

number 12-012 dated January 23, 2013. The report presents OIG’s findings on a review of the SBA’s 

Loan Management and Accounting System (LMAS) Incremental Improvement Projects (IIPs). 

The OIG findings include:

 SBA does not have an IIP to migrate its newly created COBOL code into production;

 Root Cause Analysis project has been altered from its initially approved project;

 Screens migrated from the User Interface Migration project were not security tested and 

validated;

 Quality Assurance (QA) and Independent Verification and Validation (IV&V) program did not 

exist during the review of the LMAS-IIPs.

To address the above findings, OIG has made the following recommendations:

 Recommendation 1: We recommend that the SBA adopt a new Incremental Improvement 

Project under LMAS to facilitate the transfer of data and move its new COBOL code to a full 

production environment.

 Recommendation 2: We recommend that the SBA ensure that the Root Cause Analysis 

Project conforms to the scope originally approved by the BTIC. The Root Cause Analysis 

should: (1) identify the most critical business needs of the SBA; (2) analyze remaining issues 

when each LMAS IIP is completed; and (3) develop plans to prioritize additional projects to 

address SBA’s most important business needs.

 Recommendation 3: We recommend that the Office of the Chief Information Officer IT 

Security perform a Security Impact Analysis on the E-Tran user interface screens to 

determine the security implications of the new user interface screens.

 Recommendation 4: We recommend that the Office of the Chief Information Officer IT 

Security, in conjunction with the SBA Office of Capital Access, initiate the process of 

reauthorization of E-Tran for operation due to the changes to the operating environment.

 Recommendation 5: We recommend that the Office of the Chief Information Officer 

implement a Quality Assurance program that reports compliance at the project level to the 

ESC and the BTIC, at regular intervals.

 Recommendation 6: We recommend that the Office of the Chief Information Officer 

implement an Independent Verification and Validation program for the LMAS IIP that tests 

and validates that each IIP meets its program and functional requirements.

The LMAS IIP Executive Steering Committee (ESC) chaired by the Deputy Administrator, Marie Johns, 

reviewed the recommendations on February 8th. The ESC’s response to each recommendation is 

outlined in section 3.

2
16

2. Background

The table below identifies the offices that own each project. All the projects are governed by the LMAS-IIP Executive Steering Council (ESC) and are subject to review by the OIG. 

In August 2012, OIG began an audit of LMAS IIP. The initial results were briefed on 

December 17, 2012.

Table I: LMAS-IIP Project Owners 

IIP Project Owner

R12 Office of the Chief Financial Officer (OCFO)

Incremental Migration of User Interfaces Office of Capital Access (OCA)

Port to New Version of COBOL OCA

Migrate from Sybase to Oracle OCFO

Perform Root Cause Analyses OCFO

Implement Improvements OCFO

Document New Environment (Loan Accounting) OCA

Unisys Bridge/Maintenance Office of the Chief Information Officer (OCIO)

LMAS-IIP Direct Materials and Services (Formerly 

called Hosting)

OCA/OCFO

LMAS-IIP Infrastructure OCIO

3
17

3. Response to OIG Recommendations

3.1. Recommendation 1 Response

Recommendation: We recommend that the SBA adopt a new Incremental Improvement Project 

under LMAS to facilitate the transfer of data and move its new COBOL code to a full production 

environment.

The ESC concurs. This effort will be aligned with the agency’s overall data center consolidation 

strategy.

3.2. Recommendation 2 Response

Recommendation: We recommend that the SBA ensure that the Root Cause Analysis Project 

conforms to the scope originally approved by the BTIC. The Root Cause Analysis should: (1) identify 

the most critical business needs of the SBA; (2) analyze remaining issues when each LMAS IIP is 

completed; and (3) develop plans to prioritize additional projects to address SBA’s most important 

business needs.

The ESC concurs that the Root Cause Analysis project should address SBA’s most important business 

needs. As the scope of the IIPs matured with the submission of the FSAB request, the Root Cause 

Analyses project was defined to address the agency’s critical business needs. For the past two years, 

the ESC has received updates on the Root Causes Analyses projects and concurred with the scope of 

the project. SBA’s remaining issues are analyzed and prioritized within each SBA organization’s 

operations and maintenance activities.

3.3. Recommendation 3 Response

Recommendation: We recommend that the Office of the Chief Information Officer IT Security 

perform a Security Impact Analysis on the E-Tran user interface screens to determine the security 

implications of the new user interface screens.

The ESC concurs with the recommendation for IT Security to perform a Security Impact Analysis on ETRAN. SBA policies for enhancing an existing accredited system by obtaining approval from the 

Change Control Board (CCB) and Enterprise Change Control Board (ECCB) were followed. However, 

the ESC is agreeable to IT Security reviewing the security implications of the new user interface 

screens.

3.4. Recommendation 4 Response

Recommendation: We recommend that the Office of the Chief Information Officer IT Security, in 

conjunction with the SBA Office of Capital Access, initiate the process of reauthorization of E-Tran 

for operation due to the changes to the operating environment.

The ESC concurs with the recommendation for IT Security to perform reauthorization of E-TRAN. The 

SBA policies for enhancing an existing accredited system by obtaining approval from the CCB and 

ECCB were followed. Given the increased functionality of E-TRAN, the ESC is agreeable to performing 

the security reauthorizations as requested by OIG.

4
18

3.5. Recommendation 5 Response

Recommendation: We recommend that the Office of the Chief Information Officer implement a 

Quality Assurance program that reports compliance at the project level to the ESC and the BTIC, 

at regular intervals.

The ESC concurs with the recommendation for OCIO to implement a QA program that reports at the 

project level to the ESC and BTIC. 

3.6. Recommendation 6 Response

Recommendation: We recommend that the Office of the Chief Information Officer implement an 

Independent Verification and Validation program for the LMAS IIP that tests and validates that 

each IIP meets its program and functional requirements.

The ESC concurs with the recommendation for OCIO to implement an Independent Verification and 

Validation program for the LMAS IIP that tests and validates that each IIP meets its program and 

functional requirements.