United States General Accounting Office

GAO Testimony

Before the Subcommittee on Government Programs and

Oversight, Committee on Small Business, House of

Representatives

For Release on Delivery

Expected at

2 p.m.

Thursday,

July 16, 1998

SMALL BUSINESS

ADMINISTRATION

Planning for Loan

Monitoring System Has

Many Positive Features But

Still Carries Implementation

Challenges

Statement of Joel C. Willemssen

Director, Civil Agencies Information Systems

Accounting and Information Management Division

GAO/T-AIMD-98-233

Mr. Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss the Small Business

Administration’s (SBA) activities to complete planning for its loan

monitoring system, as required by the Small Business Reauthorization Act

of 1997. As we recently reported, SBA has prepared a project plan for

completing the eight actions mandated in the act.1

My testimony today discusses our recent report and focuses on SBA’s

project plan for completing the mandated actions. While SBA has not yet

completed any of the mandated actions in the 6 months since the act was

passed, it has written a project plan that describes an approach for

addressing those actions that has many positive aspects. As SBA moves

forward to execute the plan, however, it will face several technical and

management challenges and risks.

Background SBA’s need to monitor activities of lenders that help deliver its programs

has increased significantly in recent years. One reason is that the reported

volume of loans processed by lenders almost doubled between 1992 and

1997, from about $24 billion to about $46 billion. A second reason is that

SBA shifted to lenders the responsibility for key loan origination, servicing,

and liquidation functions during this same time period. In 1993, SBA district

offices reviewed the creditworthiness of about 84 percent of lenders’

requests for loan guarantees, with the remainder being processed under a

preferred lender program. At that time, SBA also serviced and liquidated all

loans that went into default. By 1997, preferred lenders processed about

52 percent of the loans and, starting in 1998, lenders became responsible

for servicing and liquidating all loans they make under the 7(a) program,

which constitutes about 80 percent of SBA’s loan portfolio.2

To improve its ability to monitor lenders’ loan servicing and liquidation

actions, SBA asked for $18 million in its fiscal year 1998 budget request.

According to SBA, these funds were to be used for (1) recruiting expertise

in lender oversight, (2) establishing financial performance goals for

private-sector partners, (3) creating a database for lender and portfolio

management, and (4) developing an information system for timely and

accurate reporting to agency management.

1

Small Business Administration: Mandated Planning for Loan Monitoring System Is Not Complete

(GAO/AIMD-98-214R, June 30, 1998).

2

The program authorized under Section 7(a) of the Small Business Act is the agency’s primary vehicle

for providing small businesses with access to credit.

Page 1 GAO/T-AIMD-98-233
After reviewing SBA’s basis for this request, we reported in June 1997 that

the agency had not undertaken the essential planning needed to develop

the proposed loan monitoring system.3

 The Congress subsequently

enacted provisions in the Small Business Reauthorization Act of 1997 that

required the SBA Administrator to

“perform and complete the planning needed to serve as the basis for funding the

development and implementation of the computerized loan monitoring system, including—

(1) fully defining the system requirement using on-line, automated capabilities to the extent

feasible;

(2) identifying all data inputs and outputs necessary for timely report generation;

(3) benchmark loan monitoring business processes and systems against comparable

industry processes and, if appropriate, simplify or redefine work processes based on these

benchmarks;

(4) determine data quality standards and control systems for ensuring information

accuracy;

(5) identify an acquisition strategy and work increments to completion;

(6) analyze the benefits and costs of alternatives and use to demonstrate the advantage of

the final project;

(7) ensure that the proposed information system is consistent with the agency’s

information architecture; and

(8) estimate the cost to system completion, identifying the essential cost element.”

The act also required SBA, within 6 months of enactment, to submit a

report to the Congress and to us on its progress in carrying out these

mandated actions. As required, SBA submitted its report on June 2, 1998.

We were required by the act to evaluate and report on SBA’s compliance

with the act within 28 days of receipt of SBA’s report. On June 30, 1998, we

reported that SBA had formed a team for the loan monitoring system in

December 1997, but it had not yet completed any of the eight mandated

actions. We noted that SBA’s report included a project plan, laying out its

3

Small Business Administration: Better Planning and Controls Needed for Information Systems

(GAO/AIMD-97-94, June 27, 1997).

Page 2 GAO/T-AIMD-98-233
approach for addressing these actions. Work on the first of the required

planning actions was begun in May 1998 and, according to the project

plan, SBA will complete work on the last of the eight mandated actions in

August 1999.

In conducting our review, we analyzed SBA’s systems development and

related information resources management policies and procedures,

reviewed SBA’s activities to prepare for undertaking the required planning

actions, and reviewed and analyzed SBA’s June 2, 1998, report to the

Congress on its progress in carrying out the eight required actions that was

issued pursuant to the Small Business Reauthorization Act of 1997. Our

work was performed from December 1997 through June 1998, in

accordance with generally accepted government auditing standards.

SBA’s Project Plan for

Completing the

Mandated Actions

SBA’s project plan provides information in many key areas to explain how

it intends to complete the mandated actions. The plan delineates the

project’s goals and objectives, resource requirements, quality standards

and control systems, assumptions, methodologies, work breakdown

structure with a timetable for completion of tasks, and estimated costs.

SBA established four goals for the loan monitoring system project:

• Have high-quality, timely data necessary to perform roles such as the

management of risk, collection of fees from recipients, and reporting to

internal and external entities.

• Enforce uniform practices for loan making and reporting that will result in

equal access by all eligible small businesses.

• Have business processes that support a streamlined workforce, use

appropriate work flows, use best practices of both the government and

private sectors, and include the ability to cope with both upward and

downward changes in demand and resource availability.

• Have a computer infrastructure that supports efficient and user friendly

information exchanges within SBA and among SBA and external entities,

and that can enhance SBA’s program delivery and its ability to carry out its

oversight functions.

According to the project plan, SBA’s strategy for achieving these goals is to

build on “best industry practices,” reengineer inefficient business

processes, and implement contemporary technologies. In support of these

goals, SBA also established objectives for the loan monitoring system; they

include the following functionality:

Page 3 GAO/T-AIMD-98-233
• on-line update by lenders of disbursements, payments, unilateral servicing

actions, and requests for SBA approvals, as necessary;

• waiting-to-be-processed queues for action by service center personnel;

• electronic (digital) signatures to identify and verify who takes and

approves actions;

• electronic notification of actions via external e-mail or lender notification

queues;

• on-line exception reporting to notify SBA of potential problems, such as

“neglected” loans, poor credit analysis, and slow lender servicing or

reporting;

• data analysis tools for management information, such as lender and loan

trend identification, and end-user query and reporting;

• a centralized electronic file to replace on-site paper loan folders;

• integrated interactive voice response allowing borrowers and lenders to

receive status data;

• on-line electronic collateral file with a centralized storage site for paper

collateral documentation;

• centralized, automated generation of uniform commercial code filing

documents;

• expanded use of auto-dial for collections; and

• sophisticated industry models to analyze and manage credit risk and

portfolio performance.

SBA included estimates of the personnel resources that it would need to

execute the project plan. It estimated that 18 staff would be needed for the

first phase of the project, which addresses the completion of the mandated

actions, and that an additional three staff would be needed for the

development phase. The project plan also describes the types of skills

needed—such as programming, systems architecture, and database

administration—to manage and execute the project.

To address the quality standards and controls to be used for the loan

monitoring system project, the plan includes work elements to establish

systems development standards and procedures and process change

control procedures. The plan also describes the quality control process

that SBA plans to use to identify compliance with standards, and defines

how the compliance findings will be reported.

The plan recognizes that the project includes a number of assumptions

that may affect its success. It identifies seven key assumptions that SBA

made but will need to validate during the project. For example, SBA

Page 4 GAO/T-AIMD-98-233
assumed that the agency’s information technology architecture4

 will be

completed before it is needed to support this project, and that agreements

with benchmarking partners will be timely and structured to meet SBA’s

needs.

The project plan also cites the methodologies that SBA plans to use or is

considering for key areas of the project. These include methodologies for

project planning and management, benchmarking, reengineering, systems

development, software acquisition, risk management, and development of

an information technology architecture. In some areas, such as software

acquisition, SBA is comparing its current methodologies with industry best

practices to select the methodologies that will be used for the project. In

other areas, such as benchmarking, SBA did not have a methodology; it has

now either selected a new methodology or is in the process of selecting

one for these areas.

Included in the project plan is a work breakdown structure that lists the

work elements from the start of the project through completion. These

elements include the individual steps necessary to complete the mandated

actions and the steps planned for the subsequent system design,

development or acquisition, and implementation. The work elements for

completing the mandated actions are sequenced, beginning with

benchmarking and ending with the identification of an acquisition strategy

to support a make-or-buy decision. The project plan recognizes that the

project will not have enough information to fully evaluate the make or buy

issue until it has completed benchmarking, business process

reengineering, requirements gathering and analysis, and benefits and costs

analyses.

According to the project plan, SBA estimates that the loan monitoring

system will cost about $20 million to complete. In addition to the

automated system, this estimate includes the costs of staffing; developing

training; developing lender performance standards; establishing subsidy

rate analysis processes; and making infrastructure improvements, such as

buying communications hardware and software. The project plan specifies

that SBA will refine the cost estimates after the systems requirements have

been defined and the alternatives analyzed.

4

SBA is conducting a separate project to develop an information technology architecture and expects

to complete it in time to support the loan monitoring system project.

Page 5 GAO/T-AIMD-98-233
Challenges and Risks

in Executing SBA’s

Project Plan

While developing the project plan is a good start, SBA must still

successfully execute it to complete the eight mandated actions. In

executing the plan, SBA will face formidable technical and management

challenges and risks, including

• establishing software project management capability while undertaking its

largest information technology project ever;

• using methodologies and practices for the first time while conducting a

large, complex project; and

• implementing the loan monitoring system project without having an

information technology architecture in place.

Establishing Software

Project Management

Capability

SBA recognizes the need to establish defined processes for software project

management and use them on this project. Research by the Software

Engineering Institute has shown that defined and repeatable processes for

managing software acquisition or development are critical to an

organization’s ability to consistently deliver high-quality information

systems on time and within budget. These critical management processes

include project planning, requirements management, software project

tracking and oversight, software quality assurance, software configuration

management, and change control management.5

If SBA cannot implement disciplined software development and acquisition

processes for this project, it risks building or buying a system that does

not effectively meet its requirements, is delivered late or over budget, or

does not perform as specified.

Using Methodologies and

Practices for the First Time

The loan monitoring system project team will be using, for the first time,

methodologies it has selected for benchmarking, business process

reengineering, information technology architecture development, project

management, and systems development. Each of these methodologies is

complex and will require staff with the necessary skills and abilities for

rigorous implementation. The staff currently on the project management

team will need to develop the skills and abilities to use the new

methodologies as they execute this large undertaking. SBA may also need

to hire staff with the necessary skills and abilities to use the new

methodologies, and hire contractors with the necessary expertise to

support the project team.

5

Definitions of these processes were obtained from the Software Engineering Institute’s Capability

Maturity Model for Software, Version 1.1.

Page 6 GAO/T-AIMD-98-233
Successfully learning and employing several new methodologies

simultaneously will present a considerable technical and management

challenge. If the team is not up to the task, the project may not achieve its

intended results.

Implementing the Project

Without an Information

Technology Architecture

SBA plans to work concurrently on an information technology architecture

and the loan monitoring system as separate projects.6

 The act requires SBA

to ensure that the loan monitoring system is consistent with the

architecture. An information technology architecture provides a

comprehensive “construction plan” or “blueprint” that systematically

details the breadth and depth of an organization’s mission-based mode of

operation. An architecture provides details first in logical terms, such as

defining business functions, providing high-level descriptions of

information systems and their interrelationships, and specifying

information flows; and second in technical terms, such as specifying

hardware, software, data, communications, security, and performance

characteristics. By enforcing an information technology architecture to

guide and constrain a modernization program, an agency can preclude

inconsistent systems design and development decisions, and the resulting

suboptimal performance and added cost.

SBA has started developing an information technology architecture by

documenting its current computing environment. It plans to continue

developing the architecture while the loan monitoring system project is

underway. As stated earlier, SBA assumes that the information technology

architecture will be completed before it is needed to support this project.

If both logical and technical components of the architecture are not

completed as scheduled, the loan monitoring system project will likely be

delayed and plans may need to be revised because, as required by the act,

the plans must be consistent with the information technology architecture.

In conclusion, the extent to which SBA meets these challenges and

manages these risks will determine how well business processes and

systems requirements are defined, and the quality of support for

decision-making on the purchase or development of the needed system.

Because this system is a critical part of SBA’s modernization, its senior

officials must closely monitor progress in implementing the project plan

6

The Clinger-Cohen Act of 1996 gives the Chief Information Officer of an executive agency the

responsibility of developing, maintaining, and facilitating the implementation of a sound and integrated

information technology architecture. An information technology architecture is sometimes referred to

as a systems architecture.

Page 7 GAO/T-AIMD-98-233
and ensure that appropriate steps are taken to mitigate the significant

risks involved. SBA should complete all of the eight actions mandated by

the Small Business Reauthorization Act of 1997 before buying hardware or

systems. In particular, SBA should ensure that (1) the project has the active

participation and support of senior program managers and staff, (2) a

disciplined software development and acquisition processes is

implemented for this project, (3) project staff are adequately trained and

supported by contractors with expertise in the methodologies used for this

project, and (4) the information architecture is adequately developed and

used to guide the requirements for the loan monitoring system.

Mr. Chairman, this concludes my statement. I would be happy to respond

to any questions that you or other members of the Subcommittee may

have at this time.

(511464) Page 8 GAO/T-AIMD-98-233
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100