=n KPMG LLP 

2001 M Street, NW 

Washington, DC 20036~3389

MANAGEMENT LETTER

November 14, 2011

CONFIDENTIAL

Inspector General, 

and Administrator of the U.S. Small Business Administration

We have audited the consolidated financial statements of the U.S. Small Business Administration 

(SBA), as of September 30, 2011 and 2010, and for the years then ended, and have issued our report 

thereon dated November 14, 2011. We conducted our audit in accordance with auditing standards 

generally accepted in the United States of America; the standards applicable to [mancial audits 

contained in Government Auditing Standards, issued by the Comptroller General of the United States; 

and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal 

Financial Statements, as amended. In planning and performing our fiscal year 2011 audit, we 

considered the SBA’s internal control over financial reporting (internal control) as a basis for 

designing our auditing procedures for the purpose of expressing our opinion on the financial 

statements, but not for the purpose of expressing an opinion on the effectiveness of the SBA’s internal 

control. Accordingly, we do not express an opinion on the effectiveness of the SBA’s internal control. 

During our audit, we noted certain matters involving intemal control and other operational matters that 

are presented for your consideration. These comments and recommendations, all of which have been 

discussed with the appropriate members of management, are intended to improve intemal control or 

result in other operating efficiencies, and are summarized in Exhibit 1. The status of prior year 

comments is presented in Exhibit n. 

In addition, we identified certain deficiencies in intemal control that we consider to be a significant 

deficiency, and communicated them in our Independent Auditors’ Report dated November 14, 2011. 

Our audit procedures are designed primarily to enable us to form an opinion on the financial 

statements, and therefore may not bring to light all weaknesses in policies or procedures that may exist. 

We aim, however, to use our knowledge of the SBA’s organization gained during our work to make 

comments and suggestions that we hope will be useful to you. 

We would be pleased to discuss these comments and recommendations with you at any time. 

Tins communication is intended solely for the information and use of the Office of Inspector General, 

OMB, the Govemment Accountability Office, the U.S, Congress, and SBA management, and is not 

intended to be and should not be used by anyone other than these specified parties. 

Very truly yours, KPtt’(Gs- Let>

KPMG LLP Is a Delaware limited jiabllity parlm~rshlp, 

the U.S. member firm of KPMG International Cooperative 

("KPMG In!ernaUonaf). a Swiss entity.
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY 2011

NONCOMPLIANCE WITH THE DEBT COLLECTION IMPROVEMENT ACT OF 1996

In our Independent Auditors’ Report dated November 14, 2011, we reported noncompliance with the Debt 

Collection lmprovement Act of 1996 (DClA) in sunnnarized fonn. For purposes of tracking the status of 

management’s actions in the SBA’s audit follow-up system, we provide the following detail.

Our testwork over compliance with the DC1A covered the U.S. Small Business Administration’s (SBA) 

loans that were charged-off between April 1,2010 and August 31, 2011. While performing our testwork, 

we identified the following instances of noncompliance with the DClA:

. The SBA did not refer at least 504 delinquent Disaster Assistance program loans to the U.S. 

Department of Treasury (Treasury) for cross-servicing and offset at time of charge-off. The SBA 

sent due-process notices to some, bnt not all, of the obligors advising them that their indebtedness 

would be sent to the Treasnry for collection.

. Also, the SBA did not refer more than 5,000 eligible CO-bOlTowers and guarantors (who signed the 

Loan Anthorization Agreement for Disaster Assistance, 504/CDC, and 7(a) loans) to the Treasnry 

for cross-servicing and offset.

Certllin charged-off loans, co-borrowers, and guarantors were not referred to the Treasnry for crossservicing and offset during the period of review due to systemic problems with the legacy mainftame 

system. Specifically, certain outdated system edits in the SBA’s referral protocol prevented certain loans 

in charged-off status from being transferred to the Treasnry for collection. Also, progrannners in the 

Office of the Chief Infonnation Officer (OCIO) modified the COBOL code (referral protocol), but did not 

test the program changes during the development phase prior to rolling the changes out to prodnction.

We noted that during the fourth quarter of Fiscal Year (FY) 2011, staff in the OCIO took actions to 

address the weaknesses addressed as causes above. These actions include: performing some analyses of 

loans in charged-off status; identifying and removing a system edit from the referral protocol; and 

correcting errors in the COBOL code that prevented certain charged-off loans, co-borrowers, and 

guarantors from being referred to the Treasury.

Because these loans were not timely referred to the Treasnry for servicing, the SBA is not compliant with 

the DClA. Also, the lack of a founal change management process poses the risk of uncontrolled and 

unauthorized system changes being made which will compromise the integrity of the data maintained and 

transmitted to the Treasnry. According to staff in the OC10, these loans total, at a minimum, $226 

million in outstanding unpaid principal balance. In addition, the likelihood of the Treasury’s full recovery 

or collection on this debt decreases as the debt ages. Finally, the SBA’s reporting of debts on the Report 

of Receivables Due for the Public (direct and insured loans) and the Report on Guarantied Loan 

(guarantied loans) may be understated or misleading.

1
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY 2011

We recommend the ChiefInformation Officer:

1. Issue reminders to staff that all program changes follow the SBA’s change management process to 

include policies and/or procedures for documentation retention such as testing evidence and change 

approvals prior to development and implementation of the change to production.

2. Continue to conduct in-depth analyses of the existing referral protocol to identify and correct program 

coding that is preventing charged-off loans ftom being automatically transferred to the Treasury.

3. Review and update the SBA’s referral protocol to ensure that qualifying loans with executed due 

process notices are automatically transferred to the Treasury.

4. Continue to perform an analysis of loans charged-off in prior years to identify and correct the issues 

noted above.

5. Continue to coordinate with staff in the Treasury’s Debt Management Services to develop useful 

reports that can be used to reconcile charged-off loans and associated borrowers, co-borrowers, and 

guarantors to ensme the timely collection ofindebtedness on the SBA’s delinquent loan inventory.

We also recommend the Office of Portfolio Management Director work with the Office of Financial 

Program Operations (OFPO) Director to:

6. Implement robust, quarterly monitoring reviews to identify all charged-off loans where the automatic 

referral did not occur.

7. Review the list of co-borrowers and guarantors who were not referred prior to the referral protocol 

corrections and refer individuals to the Treasury, as appropriate.

Management’s Response:

The SBA’s management concurs with the findings and recommendations.

INADEQUATE REVIEW OF THE REQUIRED SUPPLEMENTARY STEWARDSHIP 

INFORMATION

The Financial Statement Workbook is an Excel workbook that is prograrnmed to receive a data extract 

ftom the General Ledger and compile it into the four principal financial statements, footnotes, and other 

related disclosures. During our testwork over the SBA’s Required Supplementary Stewardship 

Information as of June 30, 2011 presented as part of the financial statements Other Accompanying 

Information (OAl), we noted that the FY 2011 Stewardship Investments in Human Capital balances 

related to Small Business Development Centers, SCORE, Women’s Business Centers, and All Other 

Training and Assistance Programs did not agree to the Financial Statement Workbook.

2
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY2011

The Office of the Chief Financial Officer’s (OCFO) Financial Reporting Division updated the Financial 

Statement Workbook; however, this update was not communicated to the quality assurance or financial 

assurance teams subsequent to their approval and sign-off. As a result the SBA’s Stewardship Investments 

in Human Capital balances are overstated by $465,654, which could result in a misstatement of the overall 

presentation of the financial statements.

We recommend the Chief Financial Officer (CFO):

8. Reinforce the need for each team in the OCFO to sign-off on the requisite checklists once the final 

review of financial data is complete, as well as the need to timely coordinate and communicate 

subsequent changes that affect the Financial Statement Workbook and the Word version of the ON to 

the other teams.

9. Develop and docnment policies and procedures for the Word versions of the OAI presented in the 

financial statements to ensure these sections are accurate and in agreement with the final version of 

the Financial Statement Workbook.

Management’s Response:

The SBA’s management concurs with the finding and recommendations.

IMPROVEMENT IS NEEDED IN THE OPEN OBLIGATIONS REVIEW PROCESS

Undelivered orders (UDO) represent the value of goods and services ordered that have not been received. 

If orders have been filled or are no longer needed, the SBA should deobligate any outstanding obligation 

balances so that funds can be used for other purposes. During our testwork of the SBA’s UDO review 

process, we noted the following:

. As of September 30, 2011 we identified 49 of 6,841 UDO balances, recorded in Oracle totaling 

$623,077, that were no longer valid because the SBA program office certified that the balances 

were not needed and should have been deobligated, or because the goods or services had been 

received.

. The OCFO does not have a CUllent Standard Operating Procedure (SOP) that delegates specific 

responsibilities for closing UDOs and deobligating fnnds in Oracle. For example, we noted 

inadequate documentation, in the form of a CUllent SOP, of commnnication between the Denver 

Finance Center (which has responsibility to ensure deobligation of UDOs in Oracle) and the 

Office of Planning and Budget (OPB) (which has the overall responsibility of reviewing the final 

UDO balance).

3
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY2011

The OCFO’s formal policies and procedures for final closure ofUDOs do not adequately specifY program 

office responsibilities to ensure that expired UDO balances, reported by the SBA program offices, are 

timely closed out or deobligated in Oracle. These deficiencies increase the risk of misstated UDO 

balances reported in the SBA’s Statement of Budgetary Resources.

We recommend the CFO enhance existing internal control over the quarterly UDO review process to 

include the fol1owing:

10. Develop a current SOP to include specific evaluation and timely close-out procedures for UDOs. 

This SOP should include the specific titles ofthe personnel who are delegated these responsibilities.

II. Ensure that obligated funds are promptly deobligated when those funds are no longer needed.

12. Perform an analysis to examine potential open UDOs at fiscal year end to identifY UDO balances that 

should be closed out and deobligated (e.g., develop an aging of contracts that is reviewed by OPB at 

year end to detennine if contracts are still valid based on the terms of contracts and program office 

certifications).

Management’s Response:

The SBA’s management concurs with the first condition and the recommendations. The SBA’s 

management does not concur with the second condition as exemplified in their response below:

"On February 8, 2011, the SBA issued a Procedural Notice to all SBA employees outlining procedures 

and specific responsibilities for closing UDOs and de-obligating funds in Oracle. A copy of this 

Procedural Notice was supplied to KPMG during the walkthrough. As demonstrated from this Procedural 

Notice, the periodic UDO assessment is integrated in the agency’s operation and is continuously 

monitored by management. Both the Denver Finance Center and Office of Planning and Budget have 

been working together effectively to improve the UDO process each year. Evidence of this improved 

communication was provided to KPMG as a follow up to the initial walkihrough but has not been 

acknowledged in this NFR. A point of contact has been established in both offices; therefore, 

communication and information continues to flow. The points of contacts correspond via e-mall and/or 

telephone prior to the UDO scheduled review, during the review and following the review for the status of 

each UDO close notification. The Office of the Chief Financial Officer, which includes the Denver 

Finance Center and the Office of Planning and Budget, takes the role and responsibility for the periodic 

review, analysis and close out of UDO ’s very seriously. The UDO review process is included as part of 

the regular assigned duties of delegated staff in the Office of Planning and Budget. "

4
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY2011

KPMG’s Response:

KPMG has read the SBA’s response and has made an editorial change; other than that change, we 

consider our finding to be appropriate as presented. We note that the Procedural Notice mentioned above 

does document procednres associated with the closure of UDO’s; however, we continne to recommend 

that a current SOP be developed to enhance controls over the closure ofUDO’s.

CONTROLS NEEDED FOR VENDOR FILE MAINTENANCE

A vendor master file is essential for an accounts payable operation. Typically, a vendor master file 

contains contact, tax, and contract information for each vendor. As part of our FY 2011 audit testwork, 

we noted that controls surrounding vendor files needs improvement. For instance, we noted that 

management does not have adequate procedures to periodically review their vendor files and determine 

which vendors should be inactive. Specifically, we noted the following:

. SBA designates vendors as "active" or "inactive" through use of the vendor status field in Oracle. 

Of 55,006 vendors maintained in the vendor master data, only 20,222 (37%) were designated as 

"active" status, while the remaining 34,784 (63%) were designated as "inactive" status. 

Furthermore, there were 15,441 active vendors did not have any activity (payments) over an 8 

month period (from October I" 2010 to May 31" 2011).

. Additionally, 309 vendors, 237 of those vendors being "active", had an incomplete address 

maintained iJj the vendor master data file.

These conditions exist because the OCFO has not established comprehensive procedures, written or 

otherwise, addressing key control areas of vendor file maintenance and monitoring. Without well 

established procedures and controls over the vendor master file data, errors or inappropriate use of master 

file data may go undetected, and excessive and inaccurate vendor master file records could lead to 

duplicate payments, unpaid invoices, and fraud.

We recommend the CFO:

13. Develop and implement a vendor maintenance SOP for routine vendor maintenance that includes the 

review, inactivation, archiving and/or purging of vendor master records at predetermined intervals. 

This SOP should include regular reports on activity, conullunication with vendors, procedures for 

vendor additions and deletions, and routine cleansing of old or duplicate entries.

Management’s Response:

The SBA’s management concurs with the findings and recommendations.

5
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY 2011

UNTIMELY FOLLOW-UP ON LENDER OVERSIGHT CORRECTIVE ACTIONS

During our review ofthe SBA’s Office of Lender Oversight activities for its 7(a) loan program, we found 

the Office of Credit Risk Management (OCRM) did not adequately follow-up with nine lenders assessed 

as "Less than Acceptable with Corrective Actions Required" as a result of the OCRM’s risk-based, onsite reviews:

. OCRM officials did not timely follow-up with two lenders who were nonresponsive to findings 

reported in February 2011. . OCRM officials did not maintain documentation to support its deteTI1lnation that seven lenders’ 

corrective action plans were responsive to its recommendations or whether OCRM is monitoring 

these lenders’ progress to remediate findings identified during the reviews.

During FY 2011, the OCRM encountered staffing issues (to include attrition) which attributed to a 

backlog of on-site review reports and untimely follow-up with lenders regarding findings in the on-site 

review reports. hl Jnne 2011, the newly appointed Acting Director of OCRM planned to hire additional 

staff and utilize those resources to alleviate the backlog of on-site review reports. The OCRM Acting 

Director also noted that the OCRM will resume its communications with lenders as the backlog is 

diminished. Because the operations, knowledge of prudent lending practices, and/or application of the 

SBA’s requirements and judgment for these nine lenders is questionable, these lenders may lack the 

continuing ability to make and manage their portfolio which poses a financial risk to the SBA for nearly 

$600 million in loans it gnaranties.

We recommend the Associate Administrator for Capital Access:

14. Perform a review of the backlog to identify all open recommendations and weaknesses that were 

identified during the OCRM on-site, risk-based reviews.

15. Reallocate and utilize staff to prioritize the review of open recommendations and weaknesses to 

ensure that lenders (to include the nine noted above have submitted viable corrective action plans) 

have submitted viable corrective action plans. If not, consider other remedial actions to bring all 

lenders in compliance with the SBA’s requirements.

Management’s Response:

The SBA’s management concurs with the findings and recommendations. The SBA notes that 

snbseqnent to June, 2011 OCRM hired additional staff and was successfnl in eliminating a backlog of 54 

on-site lisk-based reviews by September 27, 2011. OCRM resumed its communications with lenders 

regarding corrective actions required of the reviewed lenders at that point.

6
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY2011

INADEQUATE CONTROLS OVER THE 1502 ERROR PROCESS

During the FY 2010 audit we determined that a deficiency existed in Colson’s 1502 reporting process for 

the SBA’s 7(a) loan program. We reported there was no reconciliation between Colson and the SBA’s 

error populations which caused a backlog of errors that were not timely remediated. In FY 2010, the 

SBA’s management determined that those errors did not have a material impact on the financial 

statements. Specifically, Colson ideutified 27,924 errors in its Lender Exception Report dated April, 

2010, while the SBA identified 48,040 errors for that same period. The lack of reconciliation between the 

error populations was a result of discrepancies in edit checks programmed in the systems that Colson and 

the SBA use to process 7(a) loan data. We discussed this deficiency with the SBA’s management while 

conducting our FY 2011 audit procedures. Management asserted to us that Colson identified 27,684 

errors in its Lender Exception Report dated April 2011, while the SBA identified 43,552 errors for that 

same period. The SBA’s management agreed that corrective action to remediate this deficiency was not 

taken.

According to the SBA staff, the discrepancy with the error count is the result of two different sets of edit 

checks or "business rules" that are programmed in Colson and the SBA’s systems. The SBA has 

attempted to work with Colson on aligning these business rules but due to conflicting priorities at Colson 

and the SBA, this issue has not been resolved. Because Colson’s edit checks for processing 1502 loan 

data are not aligned with the SBA’s system edits, all 1502 errors considered relevant by the SBA are not 

reported by Colson or subsequently corrected. Consequently, the notes receivable balance, guaranty 

liability, and their related disclosures in the SBA’s financial statements may be misstated.

We recommend the:

16. OF A Director work with Colson to implement consistent system edit checks.

17. OFA Director and the, Office of Infonnation Systems Support Director establish a cross-functional 

team to develop and implement a con’ective action plan that outlines clear milestones with a time 

table of results that can be directly quantified by a reduction in the 1502 error rate.

18. OCFO’s Office of Financial Analysis and Modeling Director perform a detailed analysis of the 

potential impact ofthe backlog of errors that were not remediated timely.

Management’s Response:

The SBA’s management concurs with the findings and recommendations.

7




Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY 2011

INADEQUATE REVIEW OF STAR TIME AND ATTENDANCE REPORTS

During our testwork over a sample of 90 System for Time and Attendance Reporting (STAR) Time and 

Attendance (T&A) Reports, we noted the following deficiencies:

. Five STAR T&A Reports were signed and dated after the payroll disbursement occurred.

. Thirteen STAR T&A Reports lacked the employee’s timekeeper and/or supervisor signature and 

date evidencing proper review and certification.

These deficiencies are indicative of a lack of supervisor and timekeeper reviews of STAR T&A Reports, 

as well as the accountability of hours incurred and charged by their employees. When a STAR T&A 

Report lacks the required signatures by an employee’s timekeeper and/or supervisor, there is no evidence 

that an employee’s hours worked are accurate, which could result in a misstatement in the payroll expense 

reported in the SBA’s financial statements.

We recommend the Chief Human Capital Officer:

30. Continue to reinforce policies and procedures regarding the certification of STAR T&A Reports with 

supervisors and timekeepers (i.e., issuance of a memorandum, training).

31. Perform periodic quality assurance reviews to ensure supervisors and timekeepers are properly 

certifying and dating all STAR T&A Reports.

Management’s Response:

The SBA’s management concurs with the findings and recommendations.

IMPROVEMENT NEEDED IN THE EMPLOYEE SEPARATION PROCESS

During our review of intemal control over the employee separation process, we reviewed the Official 

Personnel File for 30 employees, who had left the SBA, for evidence of a completed SBA Form 78, 

Separation Checklist (Checklist), SF 50, Notification of Personnel Action, and related payroll 

transactions.

While the SBA continues to show improve nent over its human resource processes, our review showed 

that out of the 30 Checklists we reviewed, 26 Checklists were not completed in accordance with the 

instructions. The employees’ supervisor and/or approving official did not realize the Checklists were 

incomplete during their final review and certification of the Checklist. For example, 

signatures/clearances were not obtained to confillli the retum oflaptop computers, travel cards, telephone 

calling cards, identificationlfascards, office keys, and virtual private network tokens. 

Signatures/clearances were also not obtained to ensure that LAN accounts and e-mail account access were

12
Exhibit I

U.S. SMALL BUSINESS ADMINISTRATION 

Management Letter Comments 

FY 2011

deactivated prior to employees leaving the SBA. We did not identify deficiencies related to the SF-50 or 

related payroll transactions.

. Adequate quality assurance reviews were not performed by responsible personnel in the Office of 

Human Capital Management and management officials in the SBA’s program offices to ensure 

that Checklists were completed during the separation process. Without proper completion of the 

Checklist, the SBA lacks controls ensuring that property assigned to employees is returned to the 

SBA.

. Also, by not securing all required clearances prior to an employee leaving the SBA, an 

employee’s access to the SBA’s automated systems may not be timely terminated which poses a 

risk of vulnerabilities to the SBA’s Information Technology general control environment.

We recommend the Chief Human Capital Officer:

32. Continue to work with and provide training for the SBA’s management personnel to reinforce the 

importance of properly and fully completing the Checklist.

33. Establish policies and procedures that require specific roles for the OHCM personnel to perform 

quality assurance reviews to ensure that all required fields on the Checklist are completed prior to 

their sign-off.

Management’s Response:

The SBA’s management concurs with the findings and recommendations.

13
Exhibit II

U.S. Small Business Administration

Status of Prior Year Comments

FY2011

Fiscal Year 2010 Comments Fiscal Year 2011 Status

Management Letter

Lack of Effective Reviews over Open Obligations Revised and repeated in Exhibit 1, page 3, under the

fol1owing heading: . Improvement is Needed in the Open

Obligations Review Process

Insufficie.nt Documentation and Untimely Revised and repeated in Exhibit 1, page 3, under the

Deobligation of Undelivered Orders fol1owing heading: . Improvement is Needed in the Open

Obligations Review Process

Lack of Documentation for Employee Cost Resolved

Al1ocation Surveys

Inadequate Controls over the 1502 Error Process Revised and repeated in Exhibit 1, page 6, under the

following heading:

. Inadequate Controls over the 1502 Error

Process

Noncompliance with the Debt Col1ection Revised and repeated in Exhibit 1, page 1, under the

Improvement Act of 1996 (DCIA) fol1owing heading:

. Noncompliance with the DCIA of 1996

Inconsistent Review of Charged-off Loans in Resolved

Workout Status

Noncompliance with SOP 50 52 Loan Liquidation Resolved

and Acquired Property - Untimely Guaranty

Charge-offs

Lack of Approving Official Review at Time of Revised and repeated in Exhibit 1, page 7, under the

Guaranty Loan Charge-off fol1owing heading:

. Inadequate Reviews of Charge-oift and

Guaranty Loan Purchases

Noncompliance with SOP 50 51 2A, Loan Revised and repeated in Exhibit 1, page 8, under the

Liquidation and Acquired Property - Missing fol1owing heading:

Documentation within Loan Files . Missing Loan Documentation

1
Exhibit II

U.S. Small Business Administration

Status of Prior Year Comments

FY 2011

Improper Payment - Incorrect Amount ofInterest Revised and repeated in Exhibit 1, page 10 under the

Paid at Time of Guaranty Purchase following heading:

. Improper Payment - Incorrect Amount Paid at

Time of the Loan Guaranty Purchase

Improper Payment - Incorrect Billing to Lenders at Revised and repeated in Exhibit 1, page 10, under the

Charge-off following heading:

. Improper Payment - Incorrect Amount Paid at

Time of the Loan Guaranty Purchase

Lack of Segregation of Duties in the Sacramento Resolved

Loan Processing F oxPro System

Improvement Needed in the 7(a) Lender Oversight Revised and repeated in Exhibit I, page 5, under the

Process following heading:

. Untimely Follow-up on Lender Oversight

Corrective Actions

Improvement Needed in the Duplication of Benefits Resolved

Process

Improvement Needed over Time and Attendance Revised and repeated in Exhibit 1, page 11, under the

(T &A) Payroll Controls following heading:

. Inadequate Review of STAR Time and

Attendance Reports

hnprovement Needed to Ensure Standard Operating Resolved

Procedures are Current

hnprovement Needed in the Employee Separation Revised and repeated in Exhibit 1, page 12, under the

Process following heading:

. Improvement Needed in the Employee

Separation Process

Lack of Control over the Retention of Delegation of Resolved

Authority and Line of Succession Memoranda

2