Performance Audit Report 


Addressing Performance Problems of High-Risk 


Lenders Remains a Challenge for the Small Business 


Administration 


For Official Use Only 

I Date September 28 2012 Report Number 12-20R 
u.s. SMALL BUSINESS ADMINISTRATION 

OFFICE OF INSPECTOR GENERAL 

VVASHINGTON, D.C. 20416 

REPORT TRANSMITTAL 12-20R 

DATE: 	 SEPTEMBER 28, 2012 

To: 	 Brent Ciurlino, Director, Office of Credit Risk Management 

John A. Miller, Director, Office of Financial Program Operations 

Eric K. Won, Chief Information Officer 

SUBJECT: 	 Addressing Performance Problems of High-Risk Lenders Remains a Challenge for the Small 

Business Administration 

This report presents the results of our audit of actions taken by the Small Business Administration to 

mitigate material lender risks identified in on-site reviews before and after passage of the American 

Recovery and Reinvestment Act of 2009. Our audit objective was to determine whether the SBA took 

actions to mitigate material lender risks identified in on-site reviews before and after passage of the 

Recovery Act. We conducted this audit in accordance with Generally Accepted Government Auditing 

Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. 

We believe that the evidence obtained provides a reasonable basis for our findings and conclusions 

based on our audit objective. 

We request that you provide your management decision for each recommendation on the attached SBA 

form 1824, Recommendation Action Sheet, by October 29, 2012 (30 days after final report date). Your 

decision should identify the specific actions taken or planned for each recommendation and the target 

dates for completion. 

We appreciate the courtesies and cooperation of the Small Business Administration extended to the 

staff during this audit. Please direct any questions to me at (202) 205-6587 or Terry Settle, Director, 

Credit Programs Group at (703) 487-9940. 

*** 

/s/ 

John K. Needham 

Assistant Inspector General for Auditing 
EXECUTIVE SUMMARY 

Addressing Performance Problems of High-Risk Lenders Remains a Challenge for the 

Small Business Administration 

Report No. 12-20R 

What OIG Audited What OIG Found 

We audited SBA's actions to mitigate material 

lender risks identified in its on-site reviews before 

and during the Recovery Act. Specifically, we 

examined SBA's reviews of 16 "high-risk" lenders 

from a universe of 57 top peer group lenders with 

SBA-guaranteed loan portfolios of $100 million or 

more that received high-risk ratings for at least one 

quarter from July 2008 to September 2010. All of 

these lenders made 7(a) loans and had the ability to 

make Recovery Act loans. 

What OIG Recommends 

That the SBA: 

• 	 Tailor the scope of on-site reviews of lenders to 

identify and address the weaknesses underlying 

their ratings. 

• 	 Ensure that judgmental loan samples targeting 

lender-specific risks are drawn for each on-site 

review. 

• 	 Develop and implement a process for assessing 

lender weaknesses in terms of their risk to the 

Agency. 

• 	 Train contractors and analysts on the process for 

assessing lender weaknesses and reporting 

findings. 

• 	 Develop and implement a corrective action 

follow-up process to monitor and verify the 

implementation and effectiveness of corrective 

actions prior to close-out. 

• 	 Develop and implement a control to ensure loans 

cannot be purchased until guaranty issues are 

fully resolved and documented. 

Agency Comments and Actions Taken 

We briefed the Agency on the specific issues 

discussed in this report in October and November 

2011, and provided management with a draft copy of 

this report in July 2012. The SBA agreed with all of 

the recommendations and said it has taken steps to 

address many of our concerns in the lender oversight 

process. 

In its reviews of lender operations, for 8 of the 16 

sampled lenders, we found that the SBA did not 

always recognize the significance of lender 

weaknesses and determine the risks they posed to 

the Agency. Additionally, the SBA did not link the 

risks associated with the weaknesses to the lenders' 

corresponding risk ratings and assessments of 

operations. Further, the SBA did not require lenders 

to correct performance problems that could have 

exposed the Agency to unacceptable levels of 

financial risk. 

This occurred because the SBA did not tailor the 

scope of its on-site reviews to address the individual 

risks posed by each lender, as required by SBA policy. 

Additionally, the SBA did not adequately select the 

loan samples for on-site reviews to address areas of 

suspected risk. As a result, the SBA did not always 

take actions to address lender risks. This placed the 

SBA at a substantial risk of loss due to the potential 

for increased defaults in a combined portfolio of 

loans worth more than $4.5 billion. The eight lenders 

originated $1.3 billion in Recovery Act loans, $42 

million of which was in liquidation or charged off as 

of March 2012. 

Furthermore, when the SBA did report findings and 

request corrective actions, it closed out the 

corrective actions without verifying their 

implementation and effectiveness. This was done in 

accordance with Agency policy, which allowed 

corrective actions to be closed out once SBA reached 

agreement with the lender on what actions would be 

taken. Finally, the SBA did not resolve deficiencies it 

flagged during on-site reviews when conducting 

purchase reviews. The SBA's National Guaranty 

Purchase Center and loan servicing centers 

performed "purchase reviews" of defaulted loans, 

but inadequate controls in the purchase review 

process caused the Agency to purchase loans without 

resolving deficiencies previously noted in on-site 

reviews. 
Table of Contents 

INTRODUCTION 5 


Background 6 


Review of Internal Controls 9 


RESULTS 9 


FINDING: SBA DID NOT RECOGNIZE AND TAKE ACTION TO ADDRESS SIGNIFICANT LENDER 


WEAKNESSES 9 


Case Example 1: 11 


Case Example 2: 11 


Case Example 3: 12 


Case Example 4: 12 


Case Example 5: 12 


The SBA Did Not Tailor Scope of On-Site Reviews to Individual Lenders 12 


Loan Samples Not Adequate To Address Risk 13 


The SBA Did Not Require Assessment of Lender Weaknesses Relative to Financial Risk 13 


Conclusion 14 


FINDING: THE SBA NEEDS TO IMPROVE ITS ON-SITE AND PURCHASE REVIEW PROCESSES 15 


The SBA Closed Out Corrective Actions Without Verifying Their Implementation and Effectiveness 15 


The SBA Did Not Resolve Deficiencies Flagged During On-site Reviews When Conducting Purchase Reviews 16 


Conclusion 17 

Introduction 

This report presents the results of our audit of actions taken by the Small Business 

Administration (SBA or the Agency) to mitigate material lender risks identified in on-site reviews 

before and after passage of the American Recovery and Reinvestment Act of 2009 (Recovery 

Act). The Recovery Act provided the SBA with $730 million to expand its lending and investment 

programs, create new programs to stimulate lending to small businesses, and provide oversight. 

Of the $730 million, the SBA received $375 million to (1) eliminate or reduce fees charged to 

lenders and borrowers for 7(a) and 504 loans, and (2) increase its maximum loan guaranty to 90 

percent for eligible 7(a) loans. The Recovery Act and Office of Management and Budget (OMB) 

guidance encouraged Offices of Inspectors General to conduct oversight of potential risks posed 

by Recovery Act programs implemented by their respective agencies. Furthermore, previous 

SBA Office of Inspector General (OIG) and Government Accountability Office (GAO) reports 

criticized the SBA for not providing adequate oversight of its 7(a) portfolio, 1 which includes 

approximately 4,500 lenders and $58 billion in guaranteed loans. Accordingly, we conducted 

this audit due to concerns that the SBA would not take appropriate actions to mitigate risks 

presented by high-risk lenders who had the ability to make Recovery Act loans with a 90 percent 

SBA guaranty. 

The Agency's Office of Credit Risk Management (OCRM) is responsible for the oversight of SBA 

lenders and the SBA loan portfolio. Through on-site reviews and offsite monitoring, OCRM 

identifies lenders whose operations expose the SBA to unacceptable levels of risk. The OCRM 

publishes on-site review reports in which it requests that lenders take specific actions to correct 

identified weaknesses before they become serious problems. Furthermore, the National 

Guaranty Purchase Center and loan servicing centers (the centers), which fall under SBA's Office 

of Financial Program Operations, perform IIpurchase reviews" of defaulted loans. The centers 

perform these reviews to determine if the lenders complied with SBA's loan program 

requirements and deserve full payment of the SBA guaranty. 

The objective of our audit was to determine whether the SBA took actions to mitigate material 

lender risks identified in on-site reviews before and after passage of the Recovery Act. To 

answer our objective, we examined the most recent on-site review reports completed between 

September 2005 and October 2010 for 16 lenders selected from a universe of 57 lenders, with a 

total of 33 reports. 2 In the event the lenders were subject to corrective actions, we reviewed 

the corresponding Corrective Actions Response Assessments and Corrective Actions Response 

Letters. For further information related to our sampling, see Appendix 1: Scope and 

Methodology. 

We also judgmentally selected and examined Purchase Review Reports (SBA Form 327) or 

Purchase Demand Kits for nine purchased loans to determine if the SBA resolved material 

deficiencies identified during on-site reviews when conducting purchase reviews. We selected 

these loans from a universe of 88 purchased loans for which the SBA flagged deficiencies in its 

1 OIG Report, 8-12, Oversight ofSBA Supervised Lenders, Issued May 9,2008 and GAO-I0-53, Actions Needed to Improve the Usefulness of the 

Agency's Lender Risk Rating System, Issued November 2009. The OIG found that despite high-risk ratings and recurring performance issues, 

the SBA renewed and expanded lenders' delegated authority. The GAO recommended that the Agency use risk ratings to better target 

lenders and scope reviews. 

2 We requested the two most recent reports for the 16 lenders. The Agency provided 33 reports: 2 reports for 13 lenders; 3 reports for 2 

lenders and 1 report for 1 lender. 

5 

Centralized Loan Chron System because of 28 on-site reviews. We selected the nine loans that 

presented the most risk based on deficiency type. Common types of deficiencies included 

unverified equity injection, missing evidence that borrowers met the Credit Elsewhere test, and 

missing Internal Revenue Service transcripts. Finally, we interviewed SBA personnel in 

Washington, DC and Herndon, Virginia. See Appendix I for a list of the sampled lenders and 

their related on-site review and corrective action information, as well as a list of the nine 

purchased loans. 

We conducted this audit between March 2010 and November 2011 in accordance with 

Generally Accepted Government Auditing Standards. Those standards require that we plan and 

perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based on our audit 

objective. Staff turnover and limited resources created delays in completing fieldwork and 

issuing this audit report. 

Background 

Section 7(a) of the Small Business Act authorizes the SBA to provide financial assistance to small 

businesses in the form of government-guaranteed loans. Participating lenders make 7(a) loans 

under an agreement to originate, service, and liquidate loans in accordance with SBA's rules and 

regulations and prudent lending standards. Lenders make some 7(a) loans using delegated 

authority, which undergo very limited review by the SBA prior to loan disbursement. Others are 

subject to more extensive underwriting and eligibility review before approval by the SBA. 

When a loan goes into default, the SBA will review the lender's actions on the loan to determine 

whether it is appropriate for the SBA to pay the lender the guaranty (which the SBA refers to as 

guaranty IIpurchase"). If the lender fails to comply materially with any SBA loan program 

requirement or does not make, close, service or liquidate the loan in a prudent manner, the SBA 

is released from liability on the guaranty, wholly or in part. The SBA then documents purchase 

decisions in its Guaranty Purchase Tracking System (GPTS). 

Public Law 104-208 mandates that the SBA perform annual assessments of all preferred lenders, 

which are delegated the authority to make loans without the Agency's prior approval. 

In addition, the OMB directs agencies to conduct annual on-site reviews of all governmentguaranteed lenders with substantial loan volume or poor financial performance.3 The SBA 

established the Office of Credit Risk Management (formerly the Office of Lender Oversight) in 

1999 to ensure that participating lenders prudently originate and manage their SBA-guaranteed 

loans and comply with all SBA program requirements. 

Under SBA's Risk Rating System,4 all SBA lenders receive a composite risk rating number from 

1-5, that is based on multiple elements.5 A rating of five, for example, indicates an SBA 

assessment that reflects the greatest potential for risk to the government. The OCRM considers 

all lenders risk-rated at a four or five to be high-risk based on risk factors that include: 

• Purchase rate, 

3 0MB Circular A-129, Policies for Federal Credit Programs and Non-Tax Receivables. 


4 Federal Register Volume 75, Number 39, March 1, 2010. 


5 Federal Register Volume 75, Number 39, March 1, 2010. 


6 

• Liquidation rate, and 

• Small Business Predictive Score. 6 

The OCRM conducts on-site reviews of all 7(a) lenders with SBA-guaranteed loan portfolios of 

$10 million or more on a 12 to 24-month cycle. The office also conducts additional reviews of 

these lenders, as needed, if specific performance concerns are identified. One of the primary 

objectives of an on-site review is to identify weaknesses in a lender's portfolio before serious 

problems develop that expose SBA to losses that exceed those inherent in a reasonable and 

prudent SBA loan portfolio. Contract personnel conduct the on-site reviews, while OCRM 

analysts plan, schedule, and oversee the reviews, and finalize the on-site review reports. At the 

conclusion of an on-site review, OCRM assesses a lender's operations as: 

• Acceptable, 

• Acceptable with Corrective Actions Required, or 

• Less Than Acceptable with Corrective Actions Required. 

If a finding is identified as a result of an on-site review, corrective actions are required. 

According to SBNs policy/ a finding is lIany issue or characteristic identified for which SBA will 

require the lender to implement, modify, alter, change or cease conducting a defined action." 

Corrective actions are requirements placed upon a lender to implement, modify, alter, change, 

or cease a component of its SBA lending activity. Figure 1 illustrates the on-site review process. 

6 Small Business Predictive Score provides an indication of the relative credit quality of the loans in a 7a lender's SBA portfolio. 

7 SOP 51 00, On-Site Lender Reviews/Examinations. 

7 

Figure 1: Lender On-site Review Process8 

OCRM selects 

lender for on-site 

review. 

Under OCRM's 

guidance, 

private 

contractor 

performs on-site 

review, prepares 

report and 

submits report. 

/, 

/ , / , / , / , / , / , / OCRM OCRM's final , 

report notifies / / determines " .. q{ lender of Findings if there are ';_ 

, find ings. / and need for 

, / corrective actions. , / 

, / 

, /

, / 

, /

, /

, /

, / 

V 

OCRM notifies 

lender of review 

results in the final 

report. 

lender proposes 

corrective actions to 

OCRM. 

OCRM reviews the 

lender's proposed 

corrective actions. 

Corrective Action 

Response letter Sent 

by OCRM notifies 

lender whether 

proposed corrective 

action is satisfactory. 

If satisfactory, OCRM 

closes corrective 

action. 

8 Source: Generated by OIG based on SOP 51 00, On-site Lender reviews/Examinations, and interviews with Agency officials. 

8 

Review of Internal Controls 

The SBA's Standard Operating Procedure (SOP) 0002, Internal Control Systems, provides 

guidance on the implementation and maintenance of effective systems of internal control as 

required by OMB guidance. According to OMB Circular A-123, effective systems of internal 

control improve the accountability and effectiveness of federal programs and operations by 

establishing, assessing, correcting, and reporting on internal controls. 

We identified internal control weaknesses with the Agency's on-site and purchase review 

processes. The SBA, in its review of lender operations, did not always recognize the significance 

of lender weaknesses, determine the risks they posed to the Agency, or link the risks associated 

with the weaknesses to lenders' corresponding risk ratings and assessments of operations. 

Further, the SBA did not require lenders to correct performance problems that could have 

exposed the Agency to unacceptable levels of financial risk. Weaknesses in the SBA's on-site 

review process also placed the Agency at a substantial risk of loss, especially from high-risk 

lenders. Specifically, the SBA (1) closed out corrective actions without verifying their 

implementation and effectiveness, and (2) did not resolve material deficiencies identified in 

on-site reviews when it made decisions to purchase defaulted loans. 

Implementing the recommendations in this report will address the identified internal control 

weaknesses, and improve the Agency's on-site and purchase review processes. We will provide 

a copy of the final report to the senior official responsible for internal controls in the Office of 

the Chief Financial Officer. 

RESULTS 

Finding: SBA Did Not Recognize and Take Action to Address Significant 

LenderVVeaknesses 

The SBA, in its reviews of lender operations, did not always recognize the significance of lender 

weaknesses, determine the risks they posed to the Agency, or link the risks associated with the 

weaknesses to the lenders' corresponding risk ratings and assessments of operations. Further, 

the SBA did not require lenders to correct performance problems that could have exposed the 

Agency to unacceptable levels of financial risk. This occurred because the SBA did not tailor the 

scope of its on-site reviews to address the individual risks posed by each lender, as required. 

Additionally, the loan samples selected for on-site reviews were not adequate to address areas 

of suspected risk. Further, the SBA did not have a process for assessing lender weaknesses in 

terms of their risk to the Agency to ensure that all problems- that could have exposed the SBA 

to more than a limited financial risk- were reported as findings and required corrective actions. 

As a result, the SBA did not always take actions to address lender risks and limit its exposure to 

losses from a combined portfolio worth more than $4.5 billion. 

9 

The OMB's Circular A-129 requires that agencies evaluate and enforce lender performance 

through on-site reviews. According to SBA's policy,9 two of the primary objectives of on-site 

reviews are to: 

• 	 Enhance SBA's ability to gauge the overall quality of the SBA lender's 7(a) or 504 

portfolio, and 

• 	 Identify weaknesses in an SBA lender's operations before serious problems develop 

that expose SBA to losses that exceed those inherent in a reasonable and prudent 

SBA loan portfolio. 

Agency guidance uses the term IIrisk" to describe the potential effect that a weakness could 

have on the SBA. At the conclusion of an on-site review, OCRM classifies a lender's operations 

as: 

• 	 Acceptable, 

• 	 Acceptable with Corrective Actions Required, or 

• 	 Less Than Acceptable with Corrective Actions Required. 

According to SBA's policy, lenders assessed as Acceptable represent limited financial risk to the 

Agency and have weaknesses that are modest and easily addressed. These lenders perform 

comparable to, or better than, their peer group and have minimal or no problems in their 

lending operations. On the contrary, lenders assessed as Acceptable with Corrective Actions 

Required or Less Than Acceptable with Corrective Actions Required have deficiencies that expose 

the SBA to an unacceptable level of financial risk. For example, a lender who is Acceptable with 

Corrective Actions Required may exhibit portfolio performance that is below its peer group's 

performance. A lender who is Less Than Acceptable with Corrective Actions Required may be 

operating under agreements with regulators because of weak lending practices. These lenders 

will be subject to findings and corrective actions to address their weaknesses. 

The OMB's Circular A-129 also requires agencies to summarize review findings in written reports 

with recommended corrective actions. Furthermore, according to SBA policy, one of the 

objectives of on-site reviews is to ensure lenders take prompt and effective Corrective Actions, 

as appropriate. 

Our analysis identified that for 8 of the 16 lenders in our sample, the SBA did not recognize the 

significance of their weaknesses, determine the risks they posed to the Agency, or link the risks 

associated with the weaknesses to the lenders' corresponding risk ratings and assessments of 

operations. Further, the SBA did not require these lenders to correct performance problems 

that could have exposed the Agency to unacceptable levels of financial risk. This placed SBA at a 

substantial risk of loss due to the potential for increased defaults in a combined portfolio of 

loans worth more than $4.5 billion. These eight lenders originated $1.3 billion in Recovery Act 

loans, $42 million of which was in liquidation or charged off as of March 2012. If the SBA had 

reported findings for all performance problems that could have exposed the SBA to an 

unacceptable level of risk, it could have taken actions to ensure the problems were resolved in a 

timely manner. We believe such actions may have prevented some of the loan defaults 

experienced by these lenders. 

9 SOP 51 DO, On-Site Lender Reviews/Examinations. 

10 

The following case examples demonstrate instances in which the SBA identified weaknesses, but 

did not: 

• 	 Recognize their significance, 

• 	 Determine the risks they posed to the Agency, 

• 	 Link the risks associated with the weaknesses to the lenders' corresponding risk 

ratings and assessments of operations, and 

• 	 Require lenders to take corrective actions. 

Case Example 1: 

In a January 2009 review of one lender who had received high-risk ratings for four consecutive 

quarters, the Agency cited poor portfolio performance as a weakness. Specifically, the report 

stated, liThe lender's SBA portfolio underperforms the SBA 7(a) portfolio and peer group 

averages in all performance metrics except for the liquidation rate ... The Review discloses that 

the lender needs to improve all its performance metrics." The Agency also reported that 

underwriting issues affected its credit quality and weakened its portfolio performance. 

The SBA, however, did not recognize the significance of these weaknesses and report them as 

IIfindings." At the conclusion of this review, the lender's operations were assessed as 

"Acceptable with Corrective Actions Required," with only one required corrective action related 

to guaranty fees. The bank continued to operate as a preferred lender. 

Then, in December 2009, less than a year after SBA's review, the Office of the Comptroller of the 

Currency (OCC) took enforcement action against this lender for issues related to unsafe and 

unsound banking practices. 

In May 2010, the SBA conducted another review of the lender. This time, the SBA identified 

problems in the areas of portfolio performance, underwriting, loan policies, and internal 

controls and reported them as findings. At the conclusion of this review, the SBA assessed the 

lender's operations as IILess Than Acceptable with Corrective Actions Required." As described 

above, at least two of the problems that the SBA identified in its May 2010 review existed at the 

time of its 2009 review. If the SBA had recognized the significance of the weaknesses in 2009, it 

could have recommended actions to correct the risks and limit its exposure to losses at that 

time. 

As of March 2012, the SBA had purchased guaranties totaling $976,081 from this lender for 

loans made from February 2009 through May 2010. The lender ultimately relinquished its 

preferred lender status in March 2011. 

Case Example 2: 

In a 2006 review of one lender not rated high risk, the SBA reported that the lender's portfolio 

demonstrated more risk than average and cited weak credit quality as the underlying cause. 

Yet the Agency did not identify the weaknesses as a finding. At the conclusion of the review, the 

lender was assessed as IIAcceptable with Corrective Actions Required," with one corrective 

action related to credit administration, but not specifically to portfolio performance credit 

quality issues. The bank's performance subsequently worsened and the lender has maintained a 

high-risk rating of 'A" since September 2008. 

11 

Case Example 3: 

In a 2008 report, the SBA stated that another lender underperformed its peer group and SBA 

averages in all but one of six categories.lO The review stated that the lender's purchase rate was 

more than twice as high as the peer group average, and that the lender had initiated new policy 

changes including tighter underwriting standards to improve credit. At the conclusion of the 

review, the lender was assessed as IIAcceptable with Corrective Actions Required," however, the 

corrective actions were unrelated to the portfolio performance problems. Further, the 

assessment did not include a discussion of portfolio performance or the risk posed to the 

Agency. The lender has received high-risk ratings since September 2007. 

Case Example 4: 

In a 2007 review, the Agency noted one lender's rapid growth. Specifically, the lender had 

nearly doubled its loan approval volume from 32 loans valued at $24 million in 2006 to 54 loans 

valued at $46 million in 2007. The report also stated that the lender already originated $25 

million of loans in early 2008. Furthermore, the SBA found that the lender approved every SBA 

loan it made in 2007 using its delegated authority, and the lender's entire SBA Division staff had 

left the bank in August 2007. The SBA also noted that four newly hired employees were 

responsible for servicing the lender's entire SBA loan portfolio and were operating without a 

written SBA business plan. Finally, it noted that the lender needed to hire and train staff. At the 

conclusion of the review, the lender was assessed IIAcceptable with Corrective Actions 

Required." The corrective actions related to personal resources eligibility and guaranty fee 

requirements. The bank continued to operate as a preferred lender until the SBA issued 

another review report. In this report, the SBA determined that the lender could not prudently 

underwrite, close, and service loans as a preferred lender. The SBA suspended the bank's 

preferred lender status in June 2008. 

Case Example 5: 

Lastly, in a 2010 report, the Agency reviewed a lender who was operating under a IIcease and 

desist" order issued by the acc in September 2009. The IIcease and desist" order was issued in 

part because of its weak credit administration practices. Although the SBA noted that the 

lender experienced problems with determining repayment ability and making site visits on 

delinquent and deferred accounts, it did not require corrective actions. In addition, the review 

contained no overall conclusion about the lender's procedures even though the stated scope of 

the targeted review included an assessment of the lender's loan policies and procedures as it 

related to SBA lending. The review also did not include an assessment of whether the lender 

exhibited prudent risk management. 

The SBA Did Not Tailor Scope ofOn-Site Reviews to Individual Lenders 

The Agency did not tailor the scope of its on-site reviews to address the specific risks posed by 

individual lenders. Specifically, our analysis found that 26 of 29 risk-based review reports/1 

including 7 of the 8 with previously identified problems, contained the same scope, which 

covered the following areas: 

10 The six categories were currency rate, delinquency rate, liquidation rate, problem loan rate, last 12-month purchase rate, and past due rate 

11 We excluded four reports covering Small Business Lending Companies because these reports were scoped differently. 

12 

• loan production, 

• servicing, 

• portfolio performance, 

• loan origination, 

• performing and non-performing accounts, 

• liquidation, and 

• compliance with SBA requirements. 

In 2009, the GAG performed an audit of how the SBA uses the lender risk-rating system in its 

lender oversight activities. This resulted in a recommendation for the SBA to use lender risk 

ratings to tailor the scope of file reviews performed during on-site reviews to areas that pose 

the greatest risk. While SBA policy states that the scope of on-site reviews should focus on 

those components and risk characteristics most critical to the overall assessment of each 

individual lender's operations, we found no evidence this occurred. 

Loan Samples Not Adequate To Address Risk 

In addition, the loan samples selected for on-site reviews were not adequate to address areas of 

suspected risk. According to SBA policy, the examination of individual loan files is a critical part 

of an on-site review. The policy also states that the SBA will select files based on a random 

sample of the lender's SBA loan portfolio and a judgmental sample of loan files selected based 

on unique characteristics of the individual lender. Further, the policy states that 

the judgmental sample should be comprised of loans from those areas that 

require additional investigation. For example, if a lender is embarking upon a 

new marketing initiative, introducing credit scoring, using loan agents, or 

reporting high levels of deferred, delinquent, liquidated and purchased loans, 

loans that could provide information on these practices will be judgmentally selected to 

further evaluate the respective practice(s).12 

Nevertheless, we found that the Agency drew judgmental samples in only 14, or less than half, 

of the 29 on-site review reports we examined. 13 This included four of the eight review reports 

with previously identified problems. 

The SBA Did Not Require Assessment of Lender Weaknesses Relative to Financial Risk 

The SBA did not have a process for assessing lender weaknesses, in terms of their risk to the 

Agency, to ensure that all problems that could have exposed SBA to more than a limited 

financial risk were reported as findings. The SBA policy defines a finding as liany issue or 

characteristic identified for which SBA will require the lender to implement, modify, alter, 

change, or cease conducting a defined action.1i This policy, as implemented by GCRM, did not 

result in the SBA reporting significant problems as findings. According to GCRM analysts, heavy 

12 SOP 51 00, On-Site Lender Reviews/Examinations. 

13 	 We excluded four reports covering Small Business Lending Companies because these reports did not clearly describe the sampling 

methodologies employed. 

13 

workloads, a lack of training, time constraints, and changing priorities within the office affected 

the quality of on-site reviews. 

Four OCRM analysts who oversee on-site reviews told us that they did not properly plan for 

reviews because they did not have time. In addition, the analysts said that contractor personnel 

conducting the actual reviews could do more to identify the root cause of poor performance and 

provide insight into a lender's operations. 

The Agency is aware of weaknesses and inconsistencies in the on-site review process. It has 

revised the process for assessing risks, establishing findings, and evaluating corrective actions 

during the on-site review process. For example, the SBA now cites poor portfolio performance, 

and rapid portfolio growth combined with the lack of a formal business plan as risks that 

warrant corrective actions. In addition, the Agency has started to reengineer and plans to 

continue reengineering its on-site review process in fiscal year 2012, to include: 

• 	 Expanded lender assessment categories to better indicate risk, 

• 	 Better linking of report findings with overall lender assessments, 

• 	 Using portfolio performance data to tailor on-site reviews for an improved focus 

and scope, 

• 	 Additional screening measures to target lenders that pose the greatest risk to 

the Agency, and 

• 	 Training contractors on the revised risk-based review process. 

Conclusion 

High-risk lenders with portfolios in excess of $100 million expose the Agency to significant risks 

of loss. Identifying the operational weaknesses underlying a lender's high-risk rating is essential 

to effectively assess and monitor the lender's performance and mitigate the risks presented to 

the SBA. Furthermore, linking identified weaknesses to the lender's risk rating and assessment 

of operations will provide the SBA with a clear perspective on the relationship between the 

weaknesses and the risks they pose to the Agency. Additionally, properly scoping on-site 

reviews and selecting loan samples are important steps in identifying lender weaknesses that 

expose the SBA to losses. Finally, fully identifying and correcting the performance problems of 

these lenders is essential to mitigating or reducing the risk of financial loss. 

We recommend that the Director of the Office of Credit Risk Management: 

1. 	Tailor the scope of on-site reviews of lenders to identify and address the weaknesses 

underlying their risk ratings. 

2. 	 Ensure that a judgmental sample of loans targeting lender-specific risk characteristics 

is reviewed for each on-site review, in accordance with SOP 51 00. 

3. 	 Develop and implement a process for assessing lender weaknesses in terms of their 

risk to the agency. This process should ensure that the SBA reports all problems that 

expose it to more than a limited financial risk as findings and require corrective 

actions. 

14 

4. Train the contractors and analysts on the process developed pursuant to 

Recommendation 3 for assessing lender weaknesses and reporting findings. 

Weaknesses in the SBA's on-site and purchase review processes placed the Agency at a 

substantial risk of loss, especially from high-risk lenders. Specifically, the SBA (1) closed out 

corrective actions without verifying their implementation and effectiveness, and (2) did not 

resolve material deficiencies identified in on-site reviews when it made decisions to purchase 

defaulted loans. This occurred because the Agency did not have effective on-site and purchase 

review processes. 

The SBA Closed Out Corrective Actions Without Verifying Their Implementation and 

Effectiveness 

The SBA closed out corrective actions without verifying their implementation and effectiveness. 

As a result, lenders continued to make loans under deficient conditions. According to SBA 

officials, OCRM closed out corrective actions once it reached agreement with a lender on their 

intended actions to address the identified problems. 

The OMB Circular A-129 states that risk ratings can be used to monitor the effectiveness of 

corrective actions. In addition, the Office of the Comptroller of the Currency (OCC), one of the 

key federal regulators charged with oversight of the banking industry, emphasizes that 

verification of corrective actions is a critical part of the lender oversight process. The OCC's 

Large Bank Supervision Handbook states: 

Supervision is more than just on-site activities that result in an examination 

report. It includes discovery of a bank's condition, ensuring correction of 

significant deficiencies, and monitoring the bank's activities and progress. 

The handbook further states, liThe OCC's supervision of deficient areas focuses on verifying 

execution of the action plan and validating its success." While we recognize that the SBA is not 

a federal regulator of bank lenders, we believe these industry standards provide effective 

practices that are applicable to, and could be incorporated into, SBA's oversight procedures. 

Consistent with OCC's guidance, SBA's policy states that on-site reviews should ensure that 

lenders take prompt and effective corrective action. 14 

In the first round of on-site reviews conducted on the 16 lenders selected for audit, we 

identified 36 findings each with a single corrective action reported. We reviewed a weekly 

tracking sheet that contained close-out information for 14 of the 36 corrective actions. IS 

For each of the 14 findings, the SBA closed out the corrective actions on the same day, or prior 

to the day, it sent Corrective Action Response Letters to the lenders documenting its agreement 

14 SOP 51 00. 

15 We requested the close-out information for all findings contained in the 33 reports but were only provided one spreadsheet covering 

corrective action information for the first group of lender reports we received. We deemed this sufficient for our audit. 

15 

with the proposed actions. For example, in July 2007, the Agency examined a high-risk lender 

included in our sample, and found portfolio problems that required corrective actions. 

The corrective actions required the lender to take steps to diagnose and improve its purchase, 

problem loan, and liquidation rates. The lender responded to the SBA on November 8, 2007 

with a detailed plan for improving these rates, including steps to: 

• 	 Identify the operational processes that allowed customers the ability to borrow 

beyond their credit limits, and 

• 	 Develop enhanced reporting on their SBA Express portfolio to understand 

strategy and policy changes affecting delinquency and loss rates. 

In November 2007, the Agency formally notified the lender that its proposed plans were 

satisfactory and closed out the corrective actions. Nevertheless, when the SBA 

re-examined this lender in 2010, the lender was still rated high-risk and the SBA found that its 

portfolio problems continued to exist. These problems included purchase and liquidation rates 

that exceeded 7(a) and peer group averages. This indicates that the corrective actions were 

either not taken or were not effective over this three-year period. This lender continues to be 

rated high-risk. 

The former Director of GCRM agreed that the Agency did not ensure the effective resolution of 

corrective actions. If the SBA had complied with its own policy, it would have ensured that 

lenders took prompt and effective corrective actions and prevented lenders from continuing to 

make loans under deficient conditions. 

The SBA Did Not Resolve Deficiencies Flagged During On-site Reviews When Conducting 

Purchase Reviews 

The Agency did not resolve deficiencies flagged during on-site reviews when it made decisions 

to purchase defaulted loans. As a result, it purchased loans without documenting how the 

identified issues were resolved. This occurred because the centers did not have adequate 

controls to ensure that deficiencies were effectively resolved before purchase. 

According to SBA policy, purchase review documentation should clearly state how a problem 

was overcome after the loan was flagged or why the problem is no longer an issue. 

The Agency purchased 88 loans that were previously flagged for deficiencies in the Centralized 

Loan Chron System (Chron) because of 28 on-site reviews. 16 

We judgmentally selected 9 of the 88 loans for which the Agency collectively paid more than 

$2.5 million. We reviewed the Purchase Review Reports (SBA Forms 327) or Purchase Demand 

Kits used to record the purchase decisions. The nine loans we reviewed had deficiencies that we 

deemed significant. In accordance with SBA policy,17 these documents should have contained 

evidence that the Agency resolved the flagged deficiencies before honoring its guaranties. 

There was no evidence, however, that loan specialists at the centers resolved the flagged 

deficiencies for any of the nine purchases by documenting how the problems were overcome. 

16 	 Due to database limitations requiring queries on a loan-by-Ioan basis, we excluded the loans included in four reports covering Small Business 

Lending Companies, which are non-bank lenders regulated solely by SBA, as well as one review that did not include a list of loans with 

material deficiencies. 

17 SOP 50 51 2(B), Loan Liquidation and Acquired Property. 

16 

The Director of the NGPC stated that loan specialists should check the Chron for loan 

deficiencies that could affect their reviews. The Director believed this did not always happen 

given the high volume of loans processed at the NGPC. The Director was aware of an instance 

where the Agency purchased a loan that it should not have because it did not address 

deficiencies flagged in the Chron. As part of our follow-up on a previous OIG audit,18 we found 

that the SBA improperly purchased one loan that the OIG flagged. The audit found that the 

lender did not properly compute repayment ability. Nevertheless, without considering our 

finding, the SBA subsequently purchased the loan for $988,810.19 The NGPC loan specialist that 

reviewed this loan stated he did not recall seeing the OIG alert annotated in the Chron, and that 

he does not necessarily look at the Chron entries if everything else in the file falls into place. 

The centers lacked adequate controls to ensure flagged deficiencies were properly resolved 

before loans were purchased. Specifically, the SBA Form 327 did not require documentation of 

the resolution of issues previously flagged in the Chron. Furthermore, in response to a previous 

audit recommendation20 made in December 2009, the SBA agreed to develop a method for 

flagging loans in its Guaranty Purchase Tracking System. However, the SBA has not updated the 

system to include a control to prevent loans from being purchased before guaranty issues are 

resolved. 

Conclusion 

Ensuring that lenders actually implement corrective actions is critical to improving lender 

performance and mitigating losses to the SBA. Further, if a lender's deficiencies are noted on a 

guaranteed loan, the SBA should not purchase the guaranty until it has determined that these 

deficiencies have been resolved. The auditors concluded that when a purchase review results in 

the SBA agreeing to honor a loan guaranty, despite the fact that material deficiencies have been 

noted that have not been resolved, it sends a message to lenders that unacceptable 

performance has no serious consequences. 

We recommend that the Director of the Office of Credit Risk Management: 

5. 	 Develop and implement a corrective action follow-up process to require analysts to 

(1) monitor lender progress in implementing corrective actions, and (2) obtain and 

verify evidence from lenders to ensure corrective actions have been effectively 

implemented prior to close-out. 

We recommend that the Director of the Office of Financial Program Operations (OFPO), in 

coordination with the Office of the Chief Information Officer: 

6. 	 Develop and implement a control in the Guaranty Purchase Tracking System (GPTS) 

to ensure loans cannot be purchased until guaranty issues are fully resolved and 

documented. However, if modification of the GPTS is not immediately possible, 

modify the Form 327 used during the purchase review process to require 

18 OIG ROM 10-19, Material Deficiencies Identified in Early-Defaulted and Early-Problem Recovery Act Loans, issued September 24,2010. 

19 Loan Number [Ex. 4] 

20 	Recommendation 3 of OIG ROM 10-05, Notice ofFinding and Recommendation on Recovery Act Loans Disbursed Without the Required 

Immigration Certifications, issued December 10, 2009. 

17 

documentation and resolution of all guaranty issues previously flagged in the 

Centralized Loan Chron System prior to purchase. 

18 

Agency Comments and Office of Inspector General Response 

Agency General Comments 

On July 25, 2012, we provided a draft of this report to the Director of the Office of Credit Risk 

Management, the Director of the Office of Financial Program Operations, and the Chief 

Information Officer for comment. On August 29, 2012, the Director of OCRM submitted formal 

comments, which are included in their entirety in Appendix II. A summary of management's 

comments and our response follows. 

The Office of Credit Risk Management (OCRM) agreed with all of the recommendations in the 

report and stated it has taken steps to address many of our concerns. Specifically, since August 

2011 the OCRM began (1) using additional metrics to better target lenders for its risk-based 

reviews, (2) using new guidance to develop findings, and (3) training staff on the new approach. 

The OCRM plans to continue these actions as part of its on-going effort to improve the relevancy 

of Risk-Based Reviews in the lender oversight process. 

DIG Response 

We acknowledge the on-going efforts made by the Agency to improve the on-site review 

process. We briefed the Agency on the specific issues discussed in this report in October and 

November 2011, including problems with corrective actions and the corrective actions follow-up 

process. At that time, management acknowledged the issues and said it had assembled a team 

to redevelop its process. As such, although significant progress has been made, we stress that 

the Agency is in the early stages of an on-going effort to redevelop its lender oversight program. 

It will take time to establish new program benchmarks and procedures, integrate the new 

processes, and assess the extent to which the new processes have improved lender oversight. 

Recommendation 1 

Tailor the scope of on-site reviews oflenders to identify and address the weaknesses underlying 

their risk ratings. 

Management Comments 

The Office of Credit Risk Management (OCRM) agreed with this recommendation and stated its 

on-site review guidance has been expanded to include portfolio performance weaknesses such 

as early problem loan rates, early defaults, poor surrogate origination scores, and high growth 

rates. Management believes that significant progress has already been achieved and will 

continue to evaluate and apply additional performance metrics to target risk in its present 

redevelopment of all oversight processes. 

DIG Response 

Management's comments were responsive to the recommendation. 

19 

Recommendation 2 

Ensure that a judgmental sample ofloans targeting lender-specific risk characteristics is 

reviewed for each on-site review, in accordance with SOP 51 00. 

Management Comments 

Management agreed with this recommendation and noted the 2006 SOP requirement for the 

selection of a judgmental sample of loan files. Management stated that the SOP requirement 

coupled with the August 2011 Risk Based Review (RBR) redevelopment, resulted in SBA 

beginning to conduct targeted reviews that relied more heavily on a judgmental sample of loans 

related to the identified lender risk characteristics. Management stated that the judgmental 

sample will be comprised of loans from those areas identified in the Review Plan that require 

additional investigation. Finally, management stated that the oeRM will continue to evaluate 

the balance of random and judgmental samples to ensure the most appropriate targeting of 

high risk characteristics. 

DIG Response 

Management's comments were responsive to the recommendation. 

Recommendation 3 

Develop and implement a process for assessing lender weaknesses in terms of their risk to the 

agency. This process should ensure that the SBA reports all problems that expose it to more than 

a limited financial risk as findings and require corrective actions. 

Management Comments 

Management agreed with this recommendation and stated it is currently redeveloping its lender 

review process by adding new protocols that evaluate risk in specific operational areas, leading 

to a more comprehensive composite risk rating. The new RBR process for 7(a) Lenders will 

include a new composite risk measurement, which will assess lender performance based upon 

trend and variance analysis of metric driven benchmarks, including loan growth, credit quality of 

portfolio, non-current balances, early defaults, purchases, repairs, and recoveries. It will also 

assess the lender's asset/liability management, compliance with program requirements, risk 

mitigation, and other internal or external factors that may increase risk to SBA such as the use of 

loan agents and lender service providers, mergers or acquisitions, etc. 

DIG Response 

We consider management's comments partially responsive to the recommendation. We 

commend the agency for developing a new composite risk measurement and believe it will 

significantly improve SBA's assessment of lender weaknesses. However, we continue to stress 

the need to ensure problems that expose the Agency to more than a limited financial risk are 

identified as findings and require corrective actions. Our audit identified multiple instances 

where problems existed but were not reported as findings with corrective actions required in 

the RBR reports. We believe it is critical that analysts be given guidance and tools to assess and 

report risks. 

20 

Recommendation 4 

Train the contractors and analysts on the process developed pursuant to Recommendation 3 for 

assessing lender weaknesses and reporting findings. 

Management Comments 

Management agreed with this recommendation and stated it has continually trained its 

contractors and staff and is committed to continued training throughout the redevelopment of 

its lender oversight review process. In September 2011, OCRM provided a 2.5 day contractor 

training program covering full versus targeted reviews, redeveloped RBR protocols, review and 

lead sheet revisions, 1502 reporting requirements, and guidance regarding findings and 

corrective actions. Management has also scheduled training on its new 7(a) Lender Composite 

Risk Measurement protocol for September 2012. Management plans to implement this 

updated lender review protocol in October 2012 and solicit on-going feedback from the 

analysts, lenders, and contractors to address concerns and make adjustments to the RBR 

process. Continual follow-on training will be scheduled as the redeveloped processes are 

implemented. The OCRM also plans to have SBA analysts accompany contractors during some 

on-site lender reviews. This will not only provide additional training and guidance to the 

contractor, but also quality assurance for OCRM. 

DIG Response 

Management's comments were responsive to the recommendation. 

Recommendation 5 

The Director of the Office of Credit Risk Management develop and implement a corrective action 

follow-up process to require analysts to (1) monitor lender progress in implementing corrective 

actions, and (2) obtain and verify evidence from lenders to ensure corrective actions have been 

effectively implemented prior to close-out. 

Management Comments 

The OCRM agreed with this recommendation and plans to develop a process to monitor and 

verify the implementation and effectiveness of corrective actions prior to close out in 

conjunction with its RBR redevelopment and Supervision and Enforcement efforts. The OCRM is 

also working to determine the best evidence to demonstrate lender corrective actions are 

implemented effectively. 

DIG Response 

Management's comments were responsive to the recommendation. 

Recommendation 6 

The Director of the Office of Financial Program Operations, in coordination with the Office of the 

Chief Information Officer develop and implement a control in the Guaranty Purchase Tracking 

System (GPTS) to ensure loans cannot be purchased until guaranty issues are fully resolved and 

documented. However, if modification of the GPTS is not immediately possible, modify the Form 

21 

327 used during the purchase review process to require documentation and resolution of all 

guaranty issues previously flagged in the Centralized Loan Chron System prior to purchase. 

Management Comments 

The Office of Financial Program Operations (OFPO) agreed with this recommendation and now 

requires a notation on 327 actions to verify, IIHave the CHRON notes been reviewed and any 

issues addressed?" Significant issues are documented on the SBA 327 action form, and 

considered at guaranty purchase. 

DIG Response 

Management's response was partially responsive to the recommendation. The notation added 

to the SBA 327 action form is a significant improvement over prior controls. However, the 

resolution of the flagged issue may not be documented on the 327 if it is not considered 

significant by the guaranty purchase reviewer. Therefore, we continue to support our 

recommendation that the resolution of all flagged issues should be documented on the 327. 

Documentation of the resolution is an important step in a transparent review process, and an 

important part of quality control. As discussed in the audit report, SOP 50 51 3 requires the 

research and resolution of any issue flagged in the Chron prior to purchase. 

22 

Appendix I: Scope and Methodology 

To answer our audit objective, we judgmentally selected 16 high-risk lenders in SBA's top peer group of 

lenders with SBA-guaranteed loan portfolios greater than or equal to $100 million. These lenders were 

selected from 57 lenders that received high-risk ratings for at least one quarter from July 2008 to 

September 2010. The selected lenders were IIhigh-risk" because they received a IILess Than Acceptable" 

risk rating of a 4 or 5 for five consecutive quarters beginning in the first quarter of 2009, which coincided 

with the start of the Recovery Act. All sampled lenders made 7(a) loans and had the ability to make 

Recovery Act loans. We examined 33 on-site review reports completed between September 2005 and 

October 2010 for the 16 lenders. In the event the lenders were subject to corrective actions, we 

reviewed the corresponding Corrective Actions Response Assessments (CARA) and Corrective Actions 

Response Letters (CARL). Table 1 lists the 16 lenders we reviewed, the dates of their corresponding 

on-site review reports, and relevant CARA and CARL information. 

Table 1 Sampled lenders 

t--­

1 

t--­

2 

t--­

3 

t--­

4 

t--­ 5 

t--­

6 

t--­

7 

t--­

8 

t--­

9 

t--­

10 

t--­

11 

t--­

12 

t--­

13 

t--­

14 

t--­ 15 

t--­ 16 

Lender Name 

Ex. 4 

Date 

1

st On-site 

Review 

CARA/CARL 

(Y/N/Not 

App/Avail) 

Date 

2

nd On-site 

Review 

CARA/CARL 

(Y/N/Not 

App/Avail) 

Date 

3'd On-site 

Review 

12/10/2007 Y 4/14/2008 Not App. 7/14/2008 

7/23/2007 Y 7/13/2009 Y 

7/23/2007 Y 8/9/2010 Pending 

12/3/2007 Y 1/5/2009 Y 5/17/2010 

1/23/2006 Y 8/25/2008 Not App. 

4/28/2008 Y Not App. 

1/23/2006 Not App. 12/8/2008 Y 

8/10/2009 Y 9/27/2010 Pending 

7/23/2007 Y 3/2/2009 Y 

11/5/2007 Not App. 1/25/2010 Not App. 

10/1/2007 Not App. 8/3/2009 Y 

11/30/2007 Not Avail. 6/8/2009 Not Avail. 

12/10/2007 Y 8/23/2010 Pending 

7/23/2007 Y 4/6/2009 Y 

12/12/2005 Y 10/20/2008 Y 

9/12/2005 Not App. 10/29/2007 Not App. 

Source: Information compiled by the SBA Office ofthe Inspector General from on-site review reports provided by the Agency 

We also judgmentally selected and examined Purchase Review Reports (SBA Form 327) or Purchase 

Demand Kits for nine purchased loans to determine if SBA resolved material deficiencies identified 

during on-site reviews when conducting purchase reviews. We selected these loans from a universe of 

88 purchased loans for which the SBA flagged deficiencies in its Centralized Loan Chron System because 

of 28 on-site reviews. We selected the nine loans that presented the most risk based on deficiency type. 

The most common types of deficiencies included unverified equity injection, missing evidence that 

borrowers met the Credit Elsewhere test, and missing Internal Revenue Service transcripts. Table 2 lists 

the nine loans. 

23 

Appendix I: Scope and Methodology 

Table 2 Sampled Purchase Loans 

loan Date 

Number lender Name On-site Review 

-

1 

2 

7/23/2007 

12/8/2008 -

3 7/23/2007 -

4 Ex. 4 Ex. 4 7/23/2007 -

5 12/12/2005 -

6 3/2/2009 -

7 4/28/2008 -

8 7/14/2008 -

9 7/14/2008 

Source: Information compiled by the SBA Office ofthe Inspector General from on-site review reports provided 

by the Agency. 

Use of Computer-Processed Data 

We relied on computer-processed data from the Agency's Mainframe/PIMS extract for this report. 

The SBA used this extract to provide loan data to Dun and Bradstreet monthly for the calculation of 

lender risk ratings. We used the data to (1) compile a list of lenders who originated loans before and 

after passage of the Recovery Act, and (2) compile statistics on the status of loans originated by these 

lenders. The OIG tested the quality and reliability of the Mainframe/PIMS extract for OIG ROM 10-02, 

Review a/the Recovery Act's Impact on SBA Lending, issued Nov 25,2009; and OIG ROM 12-11R, HighDollar Early-Defaulted Loans Require an Increased Degree of Scrutiny and Improved Quality Control at 

the National Guaranty Purchase Center, issued March 23, 2012. The data was determined to be reliable 

for these audits. Furthermore, as part of this audit, we confirmed that the SBA's process for creating the 

Mainframe/PIMS extract has not changed. As such, we determined that information from the 

Mainframe/PIMS extract was also reliable for this audit. 

We also used data from the Agency's Loan/Lender Monitoring System (LLMS). The Agency populates 

LLMS with its performance data and data from Dun and Bradstreet, which it uses to create its risk rating 

system. We used LLMS to identify the risk ratings and 7(a) lender peer groups. In November 2009, GAO 

performed an audit of the Agency's risk rating system and concluded the ratings were able to distinguish 

between high- and low-risk lenders for a majority of lenders in its sample. GAO's review period fell 

within the period of our audit and therefore, we concluded that the information from LLMS was also 

sufficient for the purposes of this audit. 

Prior Coverage 

During the past 5 years, the GAO issued one report pertaining to SBA's oversight of guaranteed lenders. 

In addition, the SBA OIG issued three reports. The public can access these reports on the Internet at 

http://www.gao.gov and http://www.sba.gov/office-of-inspector-general. 

GAO Reports 

24 

Appendix I: Scope and Methodology 

Shear, w. (2009). Small Business Administration: Actions Needed to Improve the Usefulness of the 

Agency's Lender Risk Rating System. GAO-1O-53, November 6,2009. Retrieved from: 

http://www.gao.gov/new.items/d1053.pdf. 

SBA OIG Reports 

SBA OIG (2007). SBA's Use of the Loan and Lender Monitoring System, Report 7-21, May 2, 2007. 

Retrieved from : http://www.sba.gov/content/archived-busi ness-Ioans-Iender-oversight reports. 

SBA OIG (2007). SBA's Oversight of Business Loan Center, LLC, Report 7-28. July 11, 2007. Retrieved 

from: http://www.sba.gov/ content/archived-busi ness-Ioans-Iender-oversight-reports. 

SBA OIG (2008). Oversight of SBA Supervised Lenders, Report 8-12. May 9,2008. Retrieved from: 

http://www.sba.gov/content/archived-business-Ioans-Iender-oversight-reports. 

25 

Appendix II: Management Comments 

DATE: August 29,2012 

TO: John Needham 

Assistant Inspector General for Auditing 

FROM: Brent M. Ciurlino 

Director, Office of Credit Risk Management 

SUBJECT: Response to Draft Performance Report on Addressing Performance Problems of 

High-Risk Lenders Remains a Challenge for the Small Business Administration 

Thank you for the opportunity to review the draft Performance Report. The report outlines the 

OIG's concerns regarding the actions taken by the Small Business Administration to mitigate 

risks taken by high-risk lenders before and during the American Recovery and Reinvestment Act 

of2009. The OIG draft report covers actions taken by Office of Credit Risk Management 

(OCRM) from September of2005 through September of2010. The report stated that SBA did 

not always recognize the significance of lender weaknesses and determine the risks they posed to 

the Agency. The report also stated that SBA did not link the risks associated with the 

weaknesses to the lenders' risk ratings (LRR) and assessments of operations. Further, the SBA 

did not require lenders to correct performance problems that could have resulted in unacceptable 

levels of financial risk to the Agency; and when SBA did report findings and request corrective 

actions, it closed out the corrective actions without verifying their implementation and 

effectiveness. Lastly, the report claimed that SBA did not resolve deficiencies flagged during the 

on-site reviews when conducting purchase reviews. 

OCRM is fully committed to mitigating risks taken by high-risk lenders participating in SBA's 

7(a) loan guaranty program. OCRM has already taken steps to address many ofthe concerns 

noted in the OIG draft report. In August 2011, OCRM began to redevelop its risk-based reviews 

(RBRs) by enhancing the selection criteria to target the highest-risk lenders based on expanded 

risk metrics, refocusing the Risk Based Reviews to target specific risk areas and expanding 

contractor lead sheets and checklists. OCRM provided training to its staff and contractors on this 

new approach. These performance metrics included early default rates, high portfolio growth 

rates, large lenders with previous on-site review assessments of "Less than Acceptable with 

Corrective Actions Required", and lenders/CDCs with LRRs of"4" or "5", which were defined 

as "Less than Acceptable" risk rating. OCRM also added new finding guidance - adding 

performance, risk rating, and additional metrics to review processes (early default, poor quality 

originations, high growth and surrogate origination score). These efforts will continue as part of 

OCRM's ongoing efforts to improve the relevancy ofRBRs in the lender oversight process. 

Management's response to the recommendations contained in the report follows: 

1. Tailor the scope ofon-site review oflenders to identify and address the weaknesses 

underlying their risk ratings. 

OCRM agrees with the OIG recommendation regarding the need for the on-site lender reviews to 

identify and address the weaknesses underlying lender risk ratings. OCRM's on-site review 

guidance has been expanded to include portfolio performance weaknesses such as early problem 

26 

Appendix II: Management Comments 

loan rates, early defaults, poor surrogate origination scores, and high growth rates. OCRM 

believes that significant progress has already been achieved and continues to evaluate and apply 

additional performance metrics to target risk in its present redevelopment of all oversight 

processes. 

2. Ensure that a judgmental sample ofloans targeting lender-specific risk characteristics 

is reviewedfor each on-site review, in accordance with SOP 51 00. 

OCRM agrees with the OIG recommendation regarding the need to ensure a judgmental sample 

of loans is reviewed to target lender-specific risk characteristics risk ratings. Per SOP 51 00, OnSite Lender ReviewslExaminations, effective September 28, 2006, files to be selected for on-site 

risk-based reviews are determined as follows: 

Files to be selected are based on a random sample ofthe Lender's SEA loan portfolio 

and a judgmental sample ofloan files selected based on unique characteristics ofthe 

individual Lender. The random sample is composed ofa statistically determined sample 

size based upon the Lender's portfolio ofoutstanding SEA loans. 

Coupled with the August 2011 RBR redevelopment, SBA began utilizing targeted reviews that 

relied more heavily on a judgmental sample of loans related to the identified lender risk 

characteristics. The random portion ofthe loan sample is composed of a statistically determined 

sample size based upon the lender's portfolio of outstanding SBA loans. The judgmental sample 

is comprised of loans from those areas identified in the Review Plan that require additional 

investigation. For example, if a lender is embarking upon a new marketing initiative, introducing 

credit scoring, using loan agents, or reporting high levels of deferred, delinquent, liquidated 

and/or purchased loans, then loans that could provide information on these practices would be 

judgmentally selected to further evaluate the lender risk. OCRM will continue to evaluate the 

balance ofrandom and judgmental samples to ensure most appropriate targeting of high risk 

characteristics. 

3. Develop and implement a process for assessing lender weaknesses in terms oftheir risk 

to the agency. This process should ensure that the SBA reports all problems that expose it to 

more than a limited financial risk as findings and require corrective actions. 

OCRM agrees with the OIG recommendation regarding the need to develop and implement a 

process for assessing lender weaknesses. OCRM is currently redeveloping its lender review 

process by adding new protocols that evaluate risk in specific operational areas, leading to a 

more comprehensive composite risk rating. The new RBR process for 7(a) Lenders will include 

a composite risk measurement termed PARRiS, which is an acronym for Performance, 

AssetlLiability Management, Regulatory Requirements, Risk Management, and Specialty Items. 

Lender performance will be assessed based upon trend and variance analysis of metric driven 

benchmarks, which include loan growth, credit quality of portfolio, non-current balances, early 

defaults, purchases, repairs, and recoveries. Lender asset/liability management is the ability of 

the lender to actively manage loans through the origination, servicing, and resolution process. 

Regulatory requirement assessments are made on lender's compliance with SOP and CFR loan 

program requirements. The risk management component will evaluate a lender's use of an 

27 

Appendix II: Management Comments 

effective governance model to identify, understand, and mitigate risk exposure to the SBA. 

Specialty items include any internal or external factor that may increase risk to SBA and include 

things such as the use of loan agents and lender service providers, risk impacts of loan 

participations or securitizations, and merger or acquisition of other SBA loan portfolios. 

4. Train the contractors and analysts on the process developed pursuant to 

Recommendation 3 for assessing lender weaknesses and reporting findings. 

OCRM agrees with the OIG recommendation regarding the need to train contractors and analysts 

on the new lender oversight process for assessing lender weaknesses. OCRM has continually 

trained its contractors and staff on an annual basis and is committed to continued training 

throughout the redevelopment of process of its lender oversight reviews. In September of 20 11, 

OCRM provided a 2.5 day contractor training program covering full versus targeted reviews, 

redeveloped RBR protocols, review and lead sheet revisions, 1502 reporting requirements, and 

guidance regarding findings and corrective actions. 

OCRM has presently scheduled training on its new 7(a) Lender PARRiS protocol for September, 

2012. OCRM has also invited selected contractors to attend the training. Plans are to implement 

this updated lender review protocol in October of2012 and OCRM management will solicit ongoing feedback from the analysts, lenders and contractors to address concerns and make 

adjustments to the RBR process during this launch period. Continual follow-on training will be 

scheduled as the redeveloped processes are implemented. OCRM also plans to engage SBA 

analysts on-site during some lender reviews. This will provide not only additional training and 

guidance to the contractor, but also quality assurance. 

5. The Director ofthe Office ofCredit Risk Management develop and implement a 

corrective action follow-up process to require analysts to (1) monitor lender progress in 

implementing corrective actions, and (2) obtain and verify evidence from lenders to ensure 

corrective actions have been effectively implemented prior to close-out. 

OCRM agrees with the OIG recommendation to develop and implement a corrective action 

follow-up process. OCRM plans to develop and implement a corrective action follow-up 

process to monitor and verify the implementation and effectiveness of corrective actions prior to 

close out in conjunction with its RBR redevelopment and Supervision and Enforcement efforts. 

Concurrent with the new risk-based review protocols, OCRM is working to determine the best 

evidence to demonstrate lender corrective actions are implemented effectively. 

6. The Director ofthe Office ofFinancial Program Operations, in coordination with the 

Office ofthe ChiefInformation Officer develop and implement a control in the Guaranty 

Purchase Tracking System (GPTS) to ensure loans cannot be purchased until guaranty issues 

are fully resolved and documented. However, ifmodification ofthe GPTS is not immediately 

possible, modify the Form 327 used during the purchase review process to require 

documentation and resolution ofall guaranty issues previously flagged in the Centralized 

Loan ehron System prior to purchase. 

28 
Appendix II: Management Comments 

The Office ofFinancial Program Operations (OFPO) agrees with this response and has already 

instituted a solution. Due to the existing effort to migrate off ofthe mainframe, resources are not 

available at this time to support a modification to GPTS. Therefore, OFPO has already instituted 

a solution which includes a notation on 327 actions to verify, "Have the CHRON notes been 

reviewed and any issues addressed?" Significant issues are then documented on the 327 action 

form and considered at guaranty purchase. 

29