What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

July 2006

SMALL BUSINESS ADMINISTRATION

Actions Needed to Provide More Timely 

Highlights of GAO-06-860, a report to Disaster Assistance 

congressional addressees

Hurricanes Katrina, Rita, and 

Wilma (the Gulf Coast hurricanes) 

caused more than $118 billion in 

estimated property damages across 

the Gulf Coast region in 2005. The

Small Business Administration 

(SBA) helps individuals and 

businesses recover from disasters 

through its Disaster Loan Program.

GAO initiated work to determine

how well SBA provided victims of 

the Gulf Coast hurricanes with 

timely assistance. This report, the 

first of two, focuses primarily on

the Disaster Credit Management

System (DCMS) and disaster loan 

process. Here, GAO evaluates (1) 

what affected SBA’s ability to 

provide timely disaster assistance 

and (2) actions SBA took after the 

disasters to improve its response to 

disaster victims. In conducting this 

study, GAO analyzed data on loan 

applications and assessed key 

aspects of SBA’s acquisition and 

implementation of DCMS. 

What GAO Recommends

GAO recommends four actions 

including reassessing DCMS’s 

maximum user capacity based on 

such things as lessons learned from 

the Gulf Coast hurricanes, a review

of information available from 

catastrophe risk modeling firms 

and disaster simulations, and 

related cost considerations. In 

comments on a draft of this report, 

SBA generally agreed with our 

recommendations but said more 

credit should have been given to its 

improvement efforts. 

Although DCMS provided SBA with a number of benefits, several factors 

affected SBA’s ability to provide timely disaster assistance to victims of the 

Gulf Coast hurricanes. First, the large volume of applications SBA processed 

greatly exceeded any previous disaster, including the 1994 Northridge 

earthquake—the largest single disaster SBA previously faced. Second, SBA 

primarily used this earthquake as the basis for planning the maximum user 

capacity for DCMS and did not consider information available from 

catastrophe risk modeling firms and disaster simulations, such as the 

likelihood and severity of damages from potential catastrophes, to help 

predict the expected application volume from such events. SBA’s limited 

planning contributed to insufficient DCMS user capacity, which restricted 

the number of staff that could access the system and process the large

volume of applications in a timely manner. SBA also did not receive the 

correct computer hardware from its contractor, and the agency did not 

completely stress test DCMS before implementation, which contributed to 

the system instability, outages, and slow response times initially experienced 

by SBA staff. As a result of these and other factors, SBA faced significant 

delays and backlogs in processing loan applications, as depicted in the figure 

below. This backlog peaked at more than 204,000 applications 4 months after 

Hurricane Katrina. As of May 27, 2006, SBA processed applications, on 

average, in about 74 days compared with its goal of within 21 days. 

Some of the actions SBA took after the Gulf Coast hurricanes helped to 

improve its response to disaster victims. For example, SBA addressed 

system-related issues by increasing the number of users that could access 

DCMS, and it plans to further increase the system’s maximum user capacity. 

SBA implemented other initiatives that had limited success. For example, 

SBA made only a few loan guarantees under its Gulf Opportunity Pilot Loan 

Program for small businesses in communities affected by the disasters. SBA

would benefit by expediting its planned business process reengineering 

efforts to analyze ways to more efficiently process loan applications, such as

implementing a secure Internet-based application feature for home loan 

applicants.

Backlog of Applications in Loss Verification and Application Processing

0

50

100

150

200

250

1 2 3 4 5 6 7 8 9

Applications (in thousands)

Source: GAO analysis of SBA data.

Months following Hurricane Katrina

Total Loss verification Application processing

www.gao.gov/cgi-bin/getrpt?GAO-06-860.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact William B. 

Shear at (202) 512-8678 or shearw@gao.gov. 

Page i GAO-06-860 SBA Diaster Loans

Contents

Letter 1

Results in Brief 2

Background 5

Large Volume of Applications, Limited Planning, and Various System 

and Processing Related Challenges Affected SBA’s Ability to 

Provide Timely Disaster Assistance 11

SBA’s Actions after the Gulf Coast Hurricanes Had Varying Degrees 

of Success 26

Conclusions 32

Recommendations for Executive Action 33

Agency Comments and Our Evaluation 34

Appendixes

Appendix I: Scope and Methodology 39

Appendix II: SBA’s Acquisition and Implementation of the Disaster Credit 

Management System 41

Appendix III: Comments from the Small Business Administration 45

Appendix IV: GAO Contact and Staff Acknowledgments 51

Tables Table 1: Significant U.S. Natural Disasters (1988-2005) 6

Table 2: SBA Application Statistics for Gulf Coast Hurricanes and 

Previous Disasters 13

Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That 

Improved Response to Disaster Victims 28

Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That 

Had Limited Success 30

Figures Figure 1: SBA’s Disaster Loan Process 8

Figure 2: Number of Disaster Loan Applications Processed and 

Average Staffing Levels by Month, September 2005 to May 

2006 20

Figure 3: FEMA IA Applicants’ Current Location by State as of 

April 10, 2006 22

Figure 4: Backlog of Applications in Loss Verification and 

Application Processing 24

Figure 5: Average Processing Time Frames for Approval and 

Decline Decisions, October 2005 to May 2006 25

Figure 6: Time Line of DCMS Activities 44
Contents

Page ii GAO-06-860 SBA Diaster Loans

Abbreviations

ALCS Automated Loan Control System

COTS commercial-off-the-shelf

DAO Disaster Area Office

DCMS Disaster Credit Management System

FEMA Federal Emergency Management Agency

IA Individual Assistance

IHP Individuals and Households Program

IV&V Independent Verification and Validation

IRS Internal Revenue Service

ODA Office of Disaster Assistance

PDC Processing and Disbursement Center

SBA Small Business Administration

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.
Page 1 GAO-06-860 SBA Diaster Loans

United States Government Accountability Office

Washington, D.C. 20548

A

July 28, 2006 Letr

Congressional Addressees:

In 2005, Hurricanes Katrina, Rita, and Wilma battered the U.S. Gulf Coast 

region, causing more than $118 billion in estimated property damages and 

over 1,400 deaths.1

 As the federal government’s primary lender to victims of 

disasters, the Small Business Administration (SBA) provides financial 

assistance through its Disaster Loan Program to help homeowners, renters, 

and businesses of all sizes recover from disasters such as earthquakes, 

hurricanes, and terrorist attacks. In this capacity, SBA plays a crucial role 

in the long-term recovery of the Gulf Coast region. Nine months following 

Hurricane Katrina, SBA had approved more than 148,700 disaster 

assistance loans totaling $9.7 billion to individuals and businesses that 

suffered losses from the Gulf Coast hurricanes.2

 However, Congress and 

press reports have expressed concerns that SBA’s response has been slow, 

leaving many disaster victims without the timely assistance that they 

needed.

In January 2005, SBA began using its new Disaster Credit Management 

System (DCMS) to process loan applications for all new disaster 

declarations. SBA intended for DCMS to improve the quality and timeliness 

of its disaster loan process and enhance its overall response to disasters 

compared with SBA’s previous system. However, after the Gulf Coast 

hurricanes, both press reports and Congress were critical of DCMS, citing 

system outages and slow response times as contributing to delays that 

disaster victims experienced in receiving assistance. We have prepared this 

report under the Comptroller General’s authority to conduct evaluations on 

his own initiative as part of a continued effort to assist Congress in 

reviewing how well SBA provided victims of the Gulf Coast hurricanes with 

timely assistance. In this report, we evaluate: (1) what affected SBA’s ability 

to provide timely disaster assistance and (2) the actions SBA took after the 

disasters to improve its response to disaster victims. This report focuses 

primarily on DCMS and the disaster loan process. We plan to issue a 

subsequent report that focuses on other factors not related to DCMS or the

1

Preliminary estimates as reported by the National Oceanic and Atmospheric 

Administration.

2

In this report, we refer to Katrina, Rita, and Wilma collectively as the Gulf Coast hurricanes.
Page 2 GAO-06-860 SBA Diaster Loans

disaster loan process that may have affected SBA’s ability to provide timely 

assistance.3

In conducting this review, we visited the Gulf Coast region to observe 

conditions and meet with federal, state, and local officials and victims of 

the disasters. We obtained documents related to SBA’s disaster lending 

policy and procedures and SBA’s acquisition and implementation of DCMS. 

We also obtained and analyzed SBA’s data on disaster loan applications 

processed through May 27, 2006. In addition, we interviewed officials from 

SBA’s headquarters and its two Field Operations Centers in California and 

Georgia, Customer Service Center in New York, and Processing and 

Disbursement Center (PDC) in Texas. See appendix I for a detailed 

description of our scope and methodology. We conducted our work 

between November 2005 and July 2006 in accordance with generally 

accepted government auditing standards.

Results in Brief We identified several factors that affected SBA’s ability to provide timely 

disaster assistance to Gulf Coast hurricane victims. The sheer volume of 

applications was a significant challenge to SBA. For example, SBA mailed 

more than 2.1 million disaster loan applications and received over 418,000 

in return as of May 27, 2006, which greatly exceeded the volume from any 

previous disaster, including the 1994 Northridge earthquake—the single 

largest disaster SBA previously faced. Although DCMS provided a number 

of benefits compared with its previous system and process, such as 

allowing certain manual tasks to be performed electronically, SBA’s limited 

planning for the maximum number of concurrent users in DCMS reduced 

its ability to provide timely disaster assistance. Specifically, SBA used the 

volume of applications received during the Northridge earthquake and 

other historical data as the basis for planning the maximum number of 

concurrent users that DCMS could accommodate. SBA did not consider 

information available from catastrophe risk modeling firms and disaster 

simulations, such as the likelihood and severity of damages from potential 

catastrophes, to help predict the expected application volume from such 

3

The objectives of this subsequent review are to determine (1) the extent to which SBA has a 

comprehensive disaster response plan and, if so, how it affected the agency’s ability to 

provide timely assistance to Gulf Coast hurricane victims; (2) how work force 

transformation affected SBA’s ability to respond to victims; (3) how SBA’s efforts to modify 

its regulatory and programmatic authority compared with previous major disasters; and (4) 

what outreach strategy SBA used to inform victims about the disaster loan program.
Page 3 GAO-06-860 SBA Diaster Loans

events and the concurrent user capacity needed to process expected 

volumes. Insurance companies and some government agencies use this 

information to plan for catastrophic events. SBA’s limited planning 

contributed to insufficient DCMS user capacity, which restricted the 

number of staff that could access the system and process the large volume 

of applications in a timely manner. If SBA had considered information 

available from catastrophe risk modeling firms and disaster simulations in 

planning for DCMS, the agency may have acquired additional capacity that 

would have enabled it to reduce its backlog of applications sooner. In 

addition, SBA’s hosting contractor provided incorrect computer hardware 

and ineffective technical support, which contributed to the initial system 

instability, outages, and slow response times SBA staff experienced with 

DCMS following the Gulf Coast hurricanes.4

 We also found that SBA did not 

completely stress test DCMS before implementation. If SBA had conducted 

complete stress testing, the agency might have detected that it did not 

receive the correct equipment and had an opportunity to address this issue 

before implementing the system.5

 As a result of these and other processingrelated challenges, SBA developed a large backlog of applications during 

the initial months following Hurricane Katrina. This backlog peaked at 

more than 204,000 applications 4 months after Hurricane Katrina. As of 

May 27, 2006, SBA processed applications on average in about 74 days, 

compared with its goal of within 21 days.6

Some of the actions SBA took to improve its response to disaster victims 

after the Gulf Coast hurricanes were more successful than others. For 

example, SBA enhanced its ability to provide more timely disaster 

assistance by addressing DCMS’s instability issues. Specifically, in October 

2005, SBA obtained the computer hardware as agreed to with its contractor 

and increased the processing capacity of the system. By November 2005, 

SBA added a second work shift for its loan processing staff to better 

balance DCMS’s workload. In November 2005, SBA also began to utilize 

4

SBA’s hosting contractor provides services such as monitoring the DCMS network and 

providing support for leased computer hardware.

5

Stress testing refers to measuring a system’s performance and availability in times of 

particularly heavy or peak load.

6

In this report, we refer to 21 days as the goal because SBA tells disaster victims that it will 

try to make a decision on each completed application within this time frame. According to 

SBA, the agency’s Government Performance and Results Act goal for fiscal year 2006 is to 

process 85 percent of home loan applications within 14 days and 85 percent of business 

applications within 16 days.
Page 4 GAO-06-860 SBA Diaster Loans

DCMS to conduct preprocessing decline decisions faster for applicants 

with credit scores that indicated a high degree of default risk under a pilot 

program; this enabled these applicants to be referred to the Federal 

Emergency Management Agency (FEMA) for possible grant assistance 

sooner. SBA implemented other initiatives with limited success, including 

the Gulf Opportunity Pilot Loan Program (GO Loan Program) in November 

2005 that provided an 85 percent guaranty to qualified lenders, such as 

banks that made expedited loans available up to $150,000 under the 

agency’s 7(a) loan program to small businesses located in communities 

affected by the disasters. Because these lenders could charge interest rates 

significantly higher than SBA’s disaster loan rates, these loans were not 

very attractive to disaster victims, and SBA guaranteed only 222 loans 

under the program. During the course of our work, we also identified other 

potential opportunities to help SBA improve its loan processing, such as 

implementing a secure Internet-based application feature for home loan 

applications.

To provide more timely assistance to disaster victims in the future, this 

report makes four recommendations designed to improve the efficiency 

and effectiveness of DCMS and the disaster loan process. Specifically, we 

recommend that the Administrator of SBA direct the Office of Disaster 

Assistance (ODA) to (1) reassess DCMS’s maximum user capacity and 

related loan processing resource needs based on such things as lessons 

learned from the Gulf Coast hurricanes, a review of information available 

from catastrophe risk modeling firms and disaster simulations, and related 

cost considerations; (2) improve management controls over assessing 

contractor performance through inspections of equipment purchases for 

DCMS; (3) conduct complete stress testing to ensure that DCMS can 

function at planned for maximum user capacity levels; and (4) expedite 

plans to resume business process reengineering efforts to analyze the 

disaster loan process and identify ways to more efficiently process loan 

applications. 

We obtained written comments on a draft of this report from SBA’s 

Associate Administrator for Disaster Assistance. SBA generally agreed with 

our recommendations and said that it intends to improve the delivery of its 

program for events of all sizes. However, SBA disagreed with some of the 

report findings and conclusions. Specifically, SBA disagreed with our 

conclusions that it performed limited planning and that it would have been 

better prepared to reduce the backlog of applications through the use of 

catastrophe risk models rather than relying primarily on the Northridge 

earthquake to establish its capacity needs. SBA also stated that we did not 
Page 5 GAO-06-860 SBA Diaster Loans

sufficiently recognize the improvement it made before and after the Gulf 

Coast hurricanes. Further, SBA challenged our finding regarding its 

expedited approval process. We continue to believe that catastrophe risk 

modeling firms and disaster simulations provide critical information, such 

as the likelihood and severity of damages from potential catastrophes that 

would have been useful in planning the maximum user capacity of DCMS. 

If SBA had considered this information, it may have expanded the 

maximum user requirement for DCMS and been better prepared to reduce 

the backlog of loan applications more timely. We believe that our report 

provides a fair and balanced presentation of SBA’s performance during a 

difficult period and that our recommendations are aimed at helping the 

agency to be more prepared in the event of another large disaster. The last 

section of this report provides a complete assessment of SBA’s comments, 

and its letter is presented in appendix III.

Background The Gulf Coast hurricanes collectively represented the most costly natural 

disaster in recent U.S. history. As table 1 shows, the estimated property 

damage from these hurricanes exceeded $118 billion, nearly five times 

greater than the damage from the 1994 Northridge earthquake and more 

than two and one-half times greater than the damage from the 2004 Florida 

hurricanes. Hurricane Katrina was the first of these disasters, causing 

fatalities and damage in southern Florida in late August 2005 before 

striking the northern Gulf Coast region. This region received the brunt of 

the storm, including extensive damage and significant loss of life in 

Louisiana and Mississippi. Damage from Hurricane Katrina also extended 

into the Florida panhandle, Georgia, and Alabama and covered 

approximately 90,000 square miles—an area larger than the size of Great 

Britain. Hurricane Rita was the next disaster to strike the Gulf Coast 

region, making landfall near the Texas and Louisiana border on September 

24, 2005, and causing a wide swath of damage from eastern Texas to 

Alabama, flooding some areas in Louisiana that had already been impacted 

by Hurricane Katrina about 1 month earlier. Hurricane Wilma was the last 

of these disasters to strike the region, making landfall in southern Florida 

on October 24, 2005, and inflicting widespread damage across the state.
Page 6 GAO-06-860 SBA Diaster Loans

Table 1: Significant U.S. Natural Disasters (1988-2005)

Source: National Oceanic and Atmospheric Administration, U.S. Geological Survey.

Note: Damage amounts are adjusted to 2005 dollars using gross domestic product price index.

a

Preliminary estimate.

b

Estimated damages.

c

Includes Hurricanes Charley, Frances, Ivan, and Jeanne.

The federal government provides funding and assistance after disasters 

through a variety of agencies and programs. Congress created FEMA to 

coordinate response and recovery efforts under presidential disaster 

declarations. FEMA works with other federal, state, and local agencies to 

assist victims after major disasters, and volunteer organizations such as the 

American Red Cross also participate in these efforts. Following a 

presidential disaster declaration, FEMA will open Disaster Recovery 

Centers where disaster victims can meet with representatives, obtain 

information about the recovery process, and register for federal disaster 

assistance. Victims may also register with FEMA by telephone or via 

FEMA’s Internet site. FEMA provides housing assistance to disaster victims 

through the Individuals and Households Program (IHP).7

 Under the IHP, 

FEMA can make grants available to repair or replace housing damaged in a 

Dollars in billions

Event Year Property damage

Gulf Coast hurricanes 2005 > $118.0a

Severe drought/heat wave (central and 

eastern states)

1988 59.3b

Florida hurricanesc 2004 > 46.2b

Hurricane Andrew 1992 35.0

Midwest flooding 1993 26.6

Northridge earthquake 1994 24.9b

Hurricane Hugo 1989 > 12.9

Severe drought (eastern, western, and 

Great Plains states)

2002 > 10.8

Severe weather and flooding (southeast 

and southwest states)

1995 > 7.3

Northern Plains flooding 1997 4.4

Southern California wildfires 2003 > 2.6

7

FEMA also refers to the IHP program as Individual Assistance (IA).
Page 7 GAO-06-860 SBA Diaster Loans

disaster that is not covered by insurance. However, the IHP is a minimal 

repair program that is designed to make the victim’s home habitable and 

functional, not to restore the home to its predisaster condition. When 

disaster victims register for FEMA assistance, they are asked to provide 

their approximate household income. If the applicant’s income exceeds 

certain thresholds, FEMA automatically refers them to SBA’s Disaster Loan 

Program.8

SBA’s Disaster Loan Program is the primary federal program for funding 

long-range recovery for private sector, nonfarm disaster victims and the 

only form of SBA assistance not limited to small businesses. The Small 

Business Act authorizes SBA to make available the following two types of 

disaster loans:

• Physical disaster loans—These loans are for permanent rebuilding and 

replacement of uninsured or underinsured disaster-damaged property. 

They are available to homeowners, renters, businesses of all sizes and 

nonprofit organizations. These loans are intended to repair or replace 

the disaster victim’s damaged property to its predisaster condition.

• Economic injury disaster loans—These loans provide small businesses 

with necessary working capital until normal operations resume after a 

disaster declaration. They cover operating expenses the business could 

have paid had the disaster not occurred. The act restricts economic 

injury disaster loans to small businesses only.

Under a presidential disaster declaration, SBA disaster assistance staff 

members secure space within FEMA—established Disaster Recovery 

Centers and begin meeting with victims to explain the agency’s disaster 

loan process, issue loan applications and, if requested, assist victims in 

completing applications. Figure 1 illustrates SBA’s disaster loan process.

8

SBA provides the income thresholds to FEMA, which vary based on the applicant’s 

household size and are adjusted annually for inflation. For example, SBA’s minimum income 

threshold for fiscal year 2005 was $13,965 for a household size of one; the threshold 

increased to $14,355 for fiscal year 2006. If the applicant’s household income falls below the 

income thresholds, FEMA will automatically refer them to its Other Needs Assistance 

Program. This program provides financial assistance to individuals and households who 

have other disaster-related necessary expenses or serious needs, such as medical expenses.
Page 8 GAO-06-860 SBA Diaster Loans

Figure 1: SBA’s Disaster Loan Process

Loan closing

checklist

• Screen applications

 for completeness.

• Conduct pre-

 liminary financial 

analysis (home 

 loans only).

• Request tax and 

 credit information 

 from Internal

 Revenue Service

 and credit bureau.

Loan

Authorization and 

Agreement (LA&A)

DCMS

Application entry Loss verification Application processing

Legal

concurs

DCMS

Legal review

Attorney

Loan officer

If applicant doesn’t 

meet minimum income 

requirements,

demonstrate repayment 

ability, or meet minimum

credit criteria:

• Contact applicant to 

 discuss application.

• Verify debts and income 

 with credit bureau report 

and tax transcript.

• Assess eligibility and 

 repayment ability by 

analyzing applicant’s

 financial data.

Closing and

disbursement

Loans can be closed

in person or by mail

SBA can disburse up

to $10,000 initially once

closing documents

are received.

LA&A

Signature

$

DCMS

Source: GAO.

DCMS DCMS entry or output

Declined

Advanced to next stage

DCMS

Loan

approved Application

decision

SBA

accounting system

Funds

obligated

on-site

damage

inspection

(downloaded

from loss

verifier’s

PC tablet)

Applicant

notified

of decline;

most referred

to FEMA for

possible grant

assistance.

Decline
Page 9 GAO-06-860 SBA Diaster Loans

During the application entry stage, SBA screens all incoming applications 

to determine if they are acceptable.9 In addition, SBA conducts a 

preliminary financial analysis of home loan applications to determine 

whether the applicant’s income falls below the agency’s minimum income 

thresholds or if repayment ability is evident based on a review of the 

applicant’s gross income and fixed debts.10 SBA declines home loan 

applicants that do not meet its minimum income requirements or 

demonstrate repayment ability. SBA also obtains a credit bureau report for 

business and home loan applicants, and SBA may decline an applicant 

based on information contained in the report. SBA refers to denials made 

during the application entry stage as preprocessing declines. SBA intended 

for these declines to eliminate delays in notifying applicants about loan 

denials. SBA will refer most home loan applicants denied a loan to FEMA 

for possible grant assistance under a presidential disaster declaration.11

After the application entry stage, applications move to the loss verification 

stage, and SBA staff members scan application documents into DCMS.12

During the loss verification stage, loss verifiers conduct on-site damage 

inspections for physical disaster loan applications to estimate the cost of 

restoring damaged property to predisaster condition. Loss verifiers use 

tablet personal computers with software tailored to complete and submit 

reports electronically into DCMS. The verified loss becomes the basis for 

the loan amount. Once the loss verification is complete, an application 

moves to the application processing stage, where loan officers check for 

9

According to SBA’s procedures, an acceptable application is one that has a signed and 

reasonably completed application form and a fully completed and signed Tax Information 

Authorization (Internal Revenue Service Form 8821) for each required taxpayer or entity. 

SBA returns unacceptable applications and requests the information needed to make the 

application acceptable.

10SBA does not conduct the preliminary financial analysis for home loan applicants 

indicating that they (1) are the sole proprietor of a business; (2) have household income 

which includes rents, farms, or other nonsalary sources (not including disability, social 

security pension, etc.); or (3) have household income in excess of $50,000. According to 

SBA officials, the preliminary financial analysis is not a valid measure of repayment ability 

for these individuals because their financial circumstances are more complex or their 

income may be able to support a higher debt level. In these cases, SBA officials stated that a 

more thorough financial analysis is warranted, and these applications go through the normal 

process. 

11FEMA does not provide assistance to cover business-related losses.

12Economic injury loan applications move directly to the application processing stage after 

application entry.
Page 10 GAO-06-860 SBA Diaster Loans

duplication of benefits and assess the applicant’s credit history and ability 

to obtain credit elsewhere.13 Loan officers also examine other applicant 

eligibility criteria, including compliance with child support obligations and 

history on other federal debt, such as student loans. Loan officers use a 

financial analysis tool within DCMS to determine if the applicant has the 

ability to repay the loan. As with preprocessing declines, SBA generally 

refers home loan applicants denied a loan in application processing to 

FEMA for possible grant assistance under presidential disaster 

declarations.

For secured loans, legal staff members review the draft loan authorization 

and agreement for sufficiency of collateral instruments and other legal 

concerns.14 They also create a loan closing checklist—a list of the 

requirements necessary to generate the loan closing and other legal 

documents. Attorneys enter a legal concurrence into DCMS, which 

obligates the loan funds through an interface with SBA’s accounting 

system. Legal support staff members prepare closing documents and mail 

them to the applicant or nearest Disaster Recovery Center. SBA can make a 

maximum initial disbursement, without collateral, of up to $10,000 for 

physical disaster loans and $5,000 for economic injury disaster loans, once 

the agency receives signed closing documents from the applicant. SBA can 

make a maximum initial disbursement of up to $25,000 for physical disaster 

loans with collateral—preferably real estate.15 SBA generally makes 

subsequent disbursements on physical disaster loans based on the 

applicant’s needs and how they spent prior disbursements.

13SBA is required to determine whether applicants are able to obtain financial assistance at 

reasonable rates and terms from nongovernment sources prior to assigning an interest rate. 

A higher interest rate applies for physical disaster loan applicants determined to have credit 

elsewhere, and business physical disaster loan applicants are subject to a maximum 3-year 

term for repayment. Economic injury disaster loan applicants are not eligible for disaster 

loans if SBA determines they can obtain credit elsewhere. For the Gulf Coast hurricanes, 

disaster victims unable to obtain credit elsewhere were assessed an interest rate of 2.687 

percent for home loans and 4 percent for business loans and nonprofit organizations. 

Disaster victims that could obtain credit elsewhere were assessed an interest rate of 5.375 

percent for home loans, 6.557 percent for business loans, and 4.75 percent for nonprofit 

organizations.

14According to SBA procedures, legal review staff members generally do not review draft 

loan authorization and agreements for unsecured loans.

15For victims of the Gulf Coast hurricanes, SBA increased to $50,000, the maximum initial 

disbursement for physical disaster loans with collateral.
Page 11 GAO-06-860 SBA Diaster Loans

DCMS replaced SBA’s largely manual, paper-based loan process and its 

Automated Loan Control System (ALCS), which it had used since the early 

1990s. ALCS enabled SBA to track the movement of paper loan application 

files from one stage of the process to another, but the manual loan process 

required the movement and storage of large volumes of paper. In December 

1998, SBA began planning for a replacement disaster loan system. SBA 

purchased a commercial-off-the-shelf package as the foundation for DCMS 

in 2003 and had the package customized. SBA intended for DCMS to help it 

move toward a paperless processing environment by automating many of 

the functions staff members had performed manually, such as obtaining 

FEMA referral data and credit bureau reports, as well as completing and 

submitting loss verification reports from remote locations. SBA began a 

phased implementation of DCMS in November 2004 at its former Niagara 

Falls Disaster Area Office (DAO).16 In January 2005, SBA began using 

DCMS to process loan applications for all new disaster declarations and by 

March 2006, SBA completed the migration of all data for disaster loan 

applications processed since 2000 from ALCS to DCMS. According to SBA, 

the cost for planning, acquiring, implementing, and operating DCMS totaled 

about $32 million through April 2006. See appendix II for a more detailed 

discussion of SBA’s acquisition and implementation of DCMS.

Large Volume of 

Applications, Limited 

Planning, and Various 

System and Processing 

Related Challenges 

Affected SBA’s Ability 

to Provide Timely 

Disaster Assistance

We identified several factors that affected SBA’s ability to provide timely 

disaster assistance, including a large volume of applications that exceeded 

any previous disaster. In addition, although DCMS allowed SBA to 

streamline the disaster loan process, SBA focused only on its historical 

experience and did not consider the possibility of a single or series of 

disasters of the magnitude of the Gulf Coast hurricanes when planning the 

system’s maximum user requirements. SBA’s limited planning contributed 

to insufficient DCMS user capacity, which restricted the number of staff 

that could access the system and process the large volume of applications 

in a timely manner. Further, SBA did not completely stress test DCMS 

before implementation to help ensure that it could function at its maximum 

16SBA reorganized its Office of Disaster Assistance in 2005 as part of its workforce 

transformation initiative. SBA centralized all loan processing functions for account 

application and account processing at its former Ft. Worth (Texas) DAO, which became its 

PDC. SBA consolidated field operations, verification, congressional, and public information 

office functions at its former Atlanta (Georgia) DAO and Sacramento (California) DAO, 

which became its Field Operations Centers East and West. SBA centralized all victim-related 

support functions at its former Niagara Falls DAO, which became its Buffalo (New York) 

Customer Service Center.
Page 12 GAO-06-860 SBA Diaster Loans

user capacity and thus did not detect that the wrong processors had been 

installed by its hosting contractor and that the system could not support 

planned capacity. As a result of these and other processing-related factors, 

SBA experienced significant backlogs and delays in processing 

applications. Overall, SBA processed disaster loan applications in 74 days, 

on average, as of May 27, 2006, compared with its goal of within 21 days.

Large Volume of Loan 

Applications Affected SBA’s 

Response to Hurricane 

Victims

According to SBA officials, the large volume of disaster loan applications it 

processed for victims of the Gulf Coast hurricanes was a significant 

challenge. The volume of applications associated with these hurricanes 

greatly exceeded any disaster in SBA’s history. As table 2 shows, as of May 

27, 2006, SBA had issued more than 2.1 million applications to victims 

affected by the Gulf Coast hurricanes. This represented almost four times 

as many applications as SBA issued to victims of the Northridge 

earthquake—the single largest disaster SBA had previously faced. In 

addition, our analysis showed that SBA received a large influx of 

applications during the initial months following Hurricane Katrina—at the 

same time that SBA hired and trained a large number of temporary staff to 

process applications received from victims of the disasters. Specifically, 

SBA received about 280,000 applications during the first 3 months 

following Hurricane Katrina, approximately 30,000 more applications than 

SBA received over a period of about 1 year from victims of the Northridge 

earthquake. 
Page 13 GAO-06-860 SBA Diaster Loans

Table 2: SBA Application Statistics for Gulf Coast Hurricanes and Previous 

Disasters

Source: SBA.

Note: According to SBA officials, in 1996, the agency implemented a combined application for 

business physical disaster and economic injury disaster loan applications from the same applicant. 

The number of applications issued and received for Hurricane Andrew and the Northridge earthquake 

has not been adjusted to reflect this change.

a

Represents applications accepted into DCMS. According to SBA, these numbers exclude applications 

that SBA declined during the application entry stage where the applicant did not meet the agency’s 

minimum income thresholds or demonstrate repayment ability.

b

Statistics for Hurricanes Katrina, Rita, and Wilma as of May 27, 2006.

c

Includes Hurricanes Charley, Frances, Ivan, and Jeanne.

SBA officials told us that the large volume of applications that it mailed and 

received resulted in part from the large number of referrals FEMA made to 

SBA’s Disaster Loan Program without applying SBA’s income thresholds, 

specifically for disaster victims who registered for disaster assistance via 

FEMA’s Internet site and did not report any income. According to a FEMA 

official, disaster victims who register via FEMA’s Internet site can select the 

“Income Unavailable/Refused” option if they do not wish to or cannot 

provide their income. The official stated that these individuals are advised 

that selecting this option will result in an SBA referral. The FEMA official 

also stated that, per an SBA request, FEMA refers all applicants who claim 

self-employment as their primary source of income to SBA’s Disaster Loan 

Program, regardless of their income, because the income tests are not a 

valid measure of repayment ability for self-employed applicants. In both 

cases, FEMA’s registration system automatically fills $0 as the disaster 

victim’s income and refers these individuals to SBA’s Disaster Loan 

Program. The FEMA official stated that about 17 percent of the individuals 

referred to SBA for Hurricanes Katrina and Rita refused to provide their 

income, and another 17 percent indicated that they were self-employed. 

SBA officials referred to these cases as “$0 income” referrals.

Event

Applications 

issued

Applications 

receiveda

Gulf Coast hurricanesb 2,152,793 418,157

Florida hurricanesc (2004) 869,577 179,025

Northridge, California earthquake (1994) 566,260 250,402

Hurricane Andrew, Florida (1992) 110,539 40,568

Upper Midwest floods (1997) 46,968 18,752

September 11 terrorist attacks (2001) 66,893 25,825
Page 14 GAO-06-860 SBA Diaster Loans

In February 2006, SBA’s Office of Inspector General issued an advisory 

memorandum, stating that many $0 income referrals ultimately failed SBA’s 

criteria for disaster loan eligibility and were processed as declines.17 SBA’s 

Office of Inspector General added that these referrals impacted SBA by

• increasing the cost incurred by SBA in mailing loan applications to 

disaster victims that normally would not be referred to SBA’s Disaster 

Loan Program;

• delaying response times for those applicants who did qualify for SBA’s 

Disaster Loan Program;

• lowering SBA’s disaster loan approval rates; and

• increasing the transaction flow through DCMS, which was near 

maximum capacity. 

SBA’s Office of Inspector General recommended that SBA improve its 

screening processes within DCMS when processing $0 income referrals 

and work with FEMA to reduce unnecessary online disaster referrals. In 

commenting on a draft of the advisory memorandum, SBA agreed that it 

should work with FEMA to improve their joint screening process prior to 

referral and issuing an SBA disaster loan application.

Limited Planning for DCMS 

User Capacity Reduced 

SBA’s Ability to Provide 

Timely Disaster Assistance

DCMS provided SBA with a number of benefits compared with its previous 

system, such as the capability to complete loss verification reports and 

other processing-related tasks electronically. However, SBA planned 

DCMS’s maximum user capacity based solely on the volume of applications 

it received from victims of the Northridge earthquake and its other 

historical data; it did not consider the information available from 

catastrophe risk modeling firms or disaster simulations such as the 

likelihood and severity of damages from potential catastrophes. Although 

agencies are not specifically required to consider such information in 

developing their system’s user capacity requirements, this information 

could have helped SBA predict the volume of loan applications to expect 

and the necessary user capacity needed to process such a volume. SBA 

17SBA Office of Inspector General, “Disaster Application Referrals with $0 Income from 

FEMA Online Registration Have Increased Costs and the Demand for SBA Resources,” 

Advisory Memorandum 06-12 (Feb. 17, 2006).
Page 15 GAO-06-860 SBA Diaster Loans

officials acknowledged that they could have considered this information in 

planning DCMS’s user capacity requirements but lacked the funding to do 

so. SBA’s limited planning and other system and processing related issues 

diminished the agency’s ability to provide disaster assistance in a timely 

manner.

Many insurance companies and government agencies currently use 

computer programs offered by several modeling firms to estimate the 

financial consequences of various natural catastrophe scenarios. Risk 

modeling firms, which have existed since the late 1980s, rely on 

sophisticated mathematical modeling techniques and large databases 

containing information on past catastrophes, population densities, 

construction techniques, and other relevant information to assess the 

severity of potential catastrophes so that other organizations can plan 

accordingly. For example, one modeling firm recently estimated that 1.5 

million people were vulnerable to an earthquake on the San Andreas Fault 

in the San Francisco area and that an earthquake similar to the 1906 

earthquake would cause an estimated $260 billion in damages to residential 

and commercial properties. This study also noted that the U.S. Geological 

Survey estimated that there was a 21 percent probability of a major 

earthquake on this fault occurring before 2032.18 Another modeling firm 

study of a strong hurricane striking the densely populated Northeast region 

estimated this event could cause more than $200 billion in economic losses, 

including significant damage from flooding to properties and infrastructure 

in lower Manhattan and Long Island.19 While SBA would not utilize this 

information the way insurance companies do to assess the financial 

consequences of potential disasters, catastrophe risk modeling firms 

provide important information on the severity of damages from such 

events. This information could be helpful in estimating the potential 

number of loan applications that SBA could receive for processing and the 

concurrent user capacity necessary to process such applications in a timely 

manner if such an event were to occur.

Government agencies and other organizations also participate in disaster 

simulation exercises to prepare for their response to natural disasters. 

While SBA would not use this disaster simulation information to plan a 

18Risk Management Solutions, “The 1906 San Francisco Earthquake and Fire: Perspectives 

on a Modern Super Cat” (2006).

19AIR Worldwide Corporation, “Insuring and Mitigating the Risk of Large-Scale Natural 

Disasters” (2006). 
Page 16 GAO-06-860 SBA Diaster Loans

response to victims’ immediate needs, the estimated number of buildings 

damaged and number of people evacuated provides important information 

that can be considered in planning the user capacity of a disaster loan 

system. For example, FEMA brought together numerous officials from 

local, state, federal, and volunteer organizations to conduct an exercise 

referred to as Hurricane Pam in July 2004. This exercise used realistic 

weather and damage information developed by the National Weather 

Service, the U.S. Army Corps of Engineers, the Louisiana State University 

Hurricane Center, and other state and federal agencies to help officials 

develop joint response plans for a catastrophic hurricane in Louisiana. This 

fictional hurricane brought sustained winds of 120 miles per hour, up to 20 

inches of rain in parts of southeast Louisiana, and storm surge that topped 

levees in the New Orleans area. Hurricane Pam, as projected, destroyed 

between 500,000 and 600,000 buildings and forced the evacuation of more 

than 1 million residents from the New Orleans area.

In planning the maximum user capacity for DCMS, SBA relied solely on the 

volume of applications it received from victims of the Northridge 

earthquake and its other historical data, such as the average number of 

applications processed for the previous 5 years. SBA did not plan for the 

likelihood of a single disaster or series of disasters of the magnitude of the 

Gulf Coast hurricanes. If SBA had considered the information available 

from catastrophe risk modeling firms or disaster simulations, such as the 

likelihood and potential damages from catastrophic events, to help it 

predict the volume of loan applications that might be expected and the user 

capacity needed to process this volume, the agency may have acquired 

additional capacity that would have enabled it to reduce its backlog of 

applications sooner. SBA’s limited planning contributed to insufficient 

DCMS user capacity, which restricted the number of staff that could access 

the system and process the large volume of applications in a timely manner.

Ineffective Technical 

Support Affected the 

Stability of DCMS and SBA’s 

Ability to Provide Timely 

Disaster Assistance

SBA experienced instability with DCMS during the initial months following 

Hurricane Katrina, as users experienced outages, difficulties connecting to 

the system, and slow response times in completing loan processing tasks. 

For example, our review of DCMS system logs showed that between 

September and December 2005 SBA experienced the following incidents:

• 19 incidents where DCMS was not available to all system users due to an 

unscheduled outage, and
Page 17 GAO-06-860 SBA Diaster Loans

• 26 incidents where DCMS was not available to various units due to an 

unscheduled outage.

SBA officials told us that the longest period of time DCMS was unavailable 

to users due to an unscheduled outage was 1 business day. These 

unscheduled outages and other system-related issues slowed productivity 

and affected SBA’s ability to provide timely disaster assistance; however, 

we could not determine the specific impact on the agency’s time frames for 

processing disaster loan applications received from Gulf Coast hurricane 

victims.

According to SBA officials, ineffective technical support contributed to the 

system instability experienced by users, as its hosting contractor did not 

properly monitor the DCMS network as contractually required and did not 

make the agency aware of incidents that could make the system unstable 

prior to DCMS users being affected. In addition, SBA officials told us that 

its hosting contractor did not provide the agency with the correct computer 

hardware for DCMS as contractually required, which further contributed to 

the instability users initially experienced with the system and reduced 

processing power by about one-third. Specifically, in developing DCMS, 

SBA planned for a maximum capacity of 1,500 concurrent users. SBA 

officials told us that they discovered that DCMS was operating near 100 

percent capacity in September 2005 before the agency had reached its 

maximum user capacity. At that time, SBA discovered that the hosting 

contractor had not provided the agency with the correct computer 

hardware required per its contract in order to support 1,500 concurrent 

users.

However, SBA did not verify that its hosting contractor provided the 

agency with the correct computer hardware specified in its contract. 

Federal procurement policies require agencies to have trained and 

experienced officials available to judge whether contractors are 

performing according to contract terms and conditions, particularly when 

contracting for highly specialized or technical services.20 In addition, SBA’s 

internal procurement procedures require that the agency inspect each item 

or service provided under a contract, report capital equipment acquisitions 

immediately—including computer equipment, and provide a serial number 

for capital equipment acquisitions for tracking purposes. SBA officials did 

20Office of Management and Budget, “Management Oversight of Service Contracting,” Policy 

Letter No. 93-1 (May 18, 1994).
Page 18 GAO-06-860 SBA Diaster Loans

not have an explanation for why the agency did not verify that the hosting 

contractor provided the correct computer hardware. If SBA had verified 

this equipment as required, the agency might have discovered this issue 

prior to the Gulf Coast hurricanes and been able to take the appropriate 

corrective action.

SBA Did Not Completely 

Stress Test DCMS to Ensure 

It Could Function at 

Maximum Capacity

Prior to implementation, SBA did not completely stress test DCMS to 

ensure that the system could operate effectively at maximum capacity, 

which contributed to the initial system instability SBA experienced. In 

2003, SBA began testing various aspects of DCMS, including the core 

application interfaces and additional components such as loss verification 

and scanning. Although SBA conducted performance testing for DCMS, we 

found that the agency only stress tested the system for up to 120 

concurrent users due to limitations with the hardware in the testing 

environment. The testing environment simulated an increasing number of 

concurrent users and exercised different functional scenarios, but the 

hardware used in the simulation reached its capacity earlier than 

anticipated. Even if the testing environment functioned as planned, an 

estimate showed that DCMS could accommodate approximately 600 

concurrent users at this time—significantly less than the system’s planned 

maximum capacity of 1,500. 

According to leading information technology organizations, to be effective, 

practices for testing software should be planned and conducted in a 

structured and disciplined environment.21 Typically, this involves testing 

increasingly larger increments of a system until the complete system and 

all of its functionality are tested and accepted. It also involves stress testing 

and fully demonstrating the effectiveness and accuracy of the system. 

Additionally, SBA’s internal systems development manual requires that the 

agency determine testing and acceptance criteria that must be met for a 

system to be accepted as “fit for use” by the user or sponsoring 

organization and requires user or sponsoring organization approval of all 

acceptance criteria. Further, the manual identifies how acceptance testing 

is to be conducted and reported to determine whether the system meets its 

requirements upon completion of its development. In doing limited stress 

testing of DCMS, SBA did not completely follow its own requirements or 

21For more information, see GAO, Aviation Security: Secure Flight Development and 

Testing Under Way, but Risks Should Be Managed as System Is Further Developed, GAO05-356 (Washington, D.C.: Mar. 28, 2005).
Page 19 GAO-06-860 SBA Diaster Loans

industry best practices for systems testing. When these requirements are 

not met, there is potential risk that the implemented system will not meet 

the system requirements. If SBA had conducted complete stress testing, the 

agency might have detected that it did not receive the correct equipment 

and had an opportunity to address this issue before implementing DCMS.

Other Processing Related 

Challenges Affected SBA’s 

Ability to Provide Timely 

Disaster Assistance 

Because of the unpredictable nature of disasters and the cost of 

maintaining staff that it might not need, SBA hires and trains a large 

number of temporary staff to help process loan applications following any 

large scale disaster, such as the Gulf Coast hurricanes. SBA also has a 

disaster reserve corps, a group of experienced individuals it relies upon 

who have worked with the agency in responding to previous disasters and 

are trained in its disaster loan process. SBA officials told us that it generally 

took approximately 30 days for loan officers without prior SBA experience 

to become fully productive. This slows processing during the initial months 

following a disaster, as loan officers become familiar with SBA’s disaster 

loan process and DCMS. In response to the Gulf Coast hurricanes, SBA also 

had to secure additional space and equipment to support loan processing. 

According to SBA officials, this process took approximately 30 to 60 days. 

As figure 2 shows, as the average number of loan processing staff 

increased, SBA generally processed more applications than it did during 

the first 2 months following Hurricane Katrina.
Page 20 GAO-06-860 SBA Diaster Loans

Figure 2: Number of Disaster Loan Applications Processed and Average Staffing 

Levels by Month, September 2005 to May 2006

Because SBA normally relies on temporary staff to help process loan 

applications after large disasters, it might be unrealistic to expect the 

agency to process a large volume of applications quickly during the initial 

period following such disasters. 

The geographic dispersion of disaster victims—in particular for Hurricanes 

Katrina and Rita—also affected SBA’s ability to provide timely disaster 

assistance. Figure 3 illustrates the location of displaced applicants affected 

by these disasters that registered for FEMA IA. These applicants relocated 

to all 50 states, with the largest concentrations in Louisiana, Mississippi, 

and Texas. SBA officials told us that FEMA referred many of these 

applicants to its Disaster Loan Program, and their widespread geographic 

dispersion made it more challenging to provide timely disaster assistance. 

Loan officers we met with also told us that contacting applicants to discuss 

the status of their loan application was difficult in some cases—particularly 

during the initial months following the disasters, as some applicants had 

0

20

40

60

80

100

1 2 3 4 5 6 7 8 9

Months after Hurricane Katrina

Applications processed (in thousands) Staff

0

500

1,000

1,500

2,000

2,500

3,000

3,500

Applications processed

Average number of staff

Source: GAO analysis of SBA data. 
Page 21 GAO-06-860 SBA Diaster Loans

moved or changed employment several times since applying for disaster 

assistance. Thus, SBA did not always have an applicant’s most current 

information, which slowed the processing of their application.
Page 22 GAO-06-860 SBA Diaster Loans

Figure 3: FEMA IA Applicants’ Current Location by State as of April 10, 2006

Note: These are applicants that registered for Hurricanes Katrina and Rita only.

Sources: Copyright © Corel Corp. All rights reserved (map) and FEMA (data).

Pa. 

2,880 

Ore. 

1,223

Nev. 

2,541 

Idaho 

238

Mont. 

230 

Wyo. 

181 

Utah 

677 

Ariz. 

2,776 N.Mex. 

1,114 

Colo. 

4,188

N.Dak. 

85 

S.Dak. 

144 

Nebr. 

793

Tex. 

637,487 

Kans. 

1,414 

Okla. 

5,307 

Minn. 

1,671 

Iowa

1,001 

Mo. 

5,907 

Ark. 

14,522 

La. 

 1,071,047 

Ill. 

7,330 

Miss. 

503,051 

Ind. 

2,957 

Ky. 

2,666 

Tenn. 

16,999 

Ala. 

135,340 

Fla. 

 29,184 

Ga. 

41,419 

S.C. 

3,508

N.C. 

6,626 

Va. 

5,895 

Ohio 

4,007 

N.H. 270 

Mass. 1,956 

R.I. 396 Mich. 

4,336 

Calif. 

16,782 

Wash. 

2,265 

Wis. 

1,826 

N.Y. 

5,202 

Maine 

348 160 

 Vt. 

W.Va. 

564 

Alaska

307

Hawaii

236

Conn. 928

N.J. 2,131 

Del. 292 

Md. 3,584 

D.C. 

1,238

P.R. 

174 

Not shown 

Virgin Islands 48

Other locations 243

1,001 - 10,000

10,001 - 100,000

100,001 - 500,000

85 - 1,000

IA applicants (total: 2,557,694)

500,001 - 1,071,047
Page 23 GAO-06-860 SBA Diaster Loans

As a Result of These 

Factors, SBA Did Not 

Significantly Reduce Its 

Backlog of Applications 

until Several Months after 

Hurricane Katrina

Our analysis showed that it took SBA several months to significantly 

reduce the backlog of applications that developed in various stages of its 

disaster loan process because of the large volume of applications, limited 

planning for DCMS, and other processing-related challenges. For example, 

SBA did not clear the backlog in the application entry stage until nearly 3 

months following Hurricane Katrina. SBA nearly cleared the backlog in the 

loss verification stage 8 months after the disaster when the backlog was 

reduced to less than 1,800 applications. However, at that time, SBA still 

needed to complete loan processing for about 25,000 applications.

As figure 4 shows, SBA’s backlog in the loss verification and application 

processing stages increased significantly during the first 3 months 

following Hurricane Katrina as SBA began receiving a large volume of 

applications from victims of the other hurricanes. These backlogs 

combined peaked at over 204,000 applications in late December 2005. 

Figure 4 also shows that, individually, SBA’s backlog in the loss verification 

stage peaked at almost 129,200 applications about 3 months following 

Hurricane Katrina, and the backlog in the application processing stage 

peaked at more than 121,700 applications nearly 6 months after the 

disaster. As a result of the backlogs, victims of the Gulf Coast hurricanes 

waited about 74 days on average for SBA to process their loan applications, 

compared with the agency’s goal of within 21 days.
Page 24 GAO-06-860 SBA Diaster Loans

Figure 4: Backlog of Applications in Loss Verification and Application Processing 

Figure 5 shows SBA’s average processing time frames for approval and 

decline decisions made between mid-October 2005 and May 2006 compared 

with its goal of within 21 days. Although SBA began to reduce the total 

backlog in loss verification and application processing in late December 

2005, average processing time frames for approval and decline decisions 

generally increased through May 2006 because of the average age of 

applications in the backlog. For example, SBA reduced the backlog in 

application processing to less than 4,500 by late May 2006; however, 

average processing time frames were still significantly higher than its goal 

because loan applications had been in the application processing queue for 

a long time—about 63 days on average.

0 

50 

100 

150 

200 

250 

1 2 3 4 5 6 7 8 9 

Applications (in thousands)

Source: GAO analysis of SBA data. 

Months following Hurricane Katrina 

Total

Loss verification

Application processing
Page 25 GAO-06-860 SBA Diaster Loans

Figure 5: Average Processing Time Frames for Approval and Decline Decisions, October 2005 to May 2006

SBA’s processing average for approvals does not include additional time 

frames for loan closings and initial disbursements. For example, SBA 

received signed closing documents from borrowers about 35 days, on 

average, after making the approval, as of May 27, 2006. According to SBA 

officials, delays in closing loans were mostly the result of factors beyond 

their control. For example, SBA officials stated that they scheduled loan 

closings at the convenience of the borrower. These officials added that 

because of the displacement of Gulf Coast hurricane victims, SBA had 

closed about 50 percent of disaster loans by mail, a higher percentage than 

previous disasters, which generally takes more time than closings done in 

person. SBA officials also stated that there were a significant number of 

disaster victims who had not returned to the affected area and who had 

expressed uncertainty about rebuilding their homes and businesses. As a 

result, these victims had been reluctant to quickly close on their loans. 

SBA’s disaster lending procedures generally require applicants to close 

loans within 60 days of the date on the loan authorization and agreement. 

These procedures also allow SBA to accept loan closing documents after 60 

0

20

40

60

80

100

Declines

Approvals

Goal 

Days

October November December January February March April May

2005 2006

Week-ending date

Source: GAO analysis of SBA data for 2005 Gulf Coast hurricanes.

22 29 5 12 19 26 3 10 17 24 31 7 14 21 28 4 11 18 25 4 11 18 25 1 8 15 22 29 6 13 20 27 
Page 26 GAO-06-860 SBA Diaster Loans

days on a discretionary basis. SBA officials told us they had allowed Gulf 

Coast hurricane victims additional time to determine if they really wanted 

the loan. To facilitate loan closings, SBA officials also told us they used 

staff to conduct follow-up calls with borrowers after closing documents 

were mailed.

In addition, our analysis of an SBA data extract further showed that the 

agency made an initial disbursement for approved loans on average about 9 

days after the receipt of closing documents. As of May 27, 2006—9 months 

after Hurricane Katrina—SBA had disbursed about $1.4 billion or 14 

percent of the $9.7 billion approved loan dollars. As of the same date, about 

73,000 approved loans had not been fully disbursed to disaster victims. As 

with loan closings, SBA officials stated that the length of time it took to 

disburse disaster loans was primarily determined by the borrower. SBA’s 

disaster lending procedures require borrowers to arrange for and obtain all 

loan funds within 12 months from the date of the loan agreement. However, 

SBA officials told us that it might be difficult for some disaster victims to 

meet this requirement. In our subsequent report on SBA’s response to the 

Gulf Coast hurricanes, we plan to discuss the perspectives of disaster 

victims related to the disaster loan process.

SBA’s Actions after the 

Gulf Coast Hurricanes 

Had Varying Degrees of 

Success

Although SBA took several actions after the Gulf Coast hurricanes to 

improve its response to disaster victims, our analysis showed that some of 

these actions were more successful at reducing the backlog of loan 

applications than others. For example, SBA increased the number of 

concurrent users that could access DCMS by acquiring additional computer 

hardware and adding a second work shift for loan processing staff to better 

balance the system’s workload. In addition, SBA initiatives to relax filing 

requirements for applicants whose business records were destroyed and 

establish a satellite office to process disaster loans at its former 

Sacramento DAO allowed SBA to improve its response to disaster victims. 

However, SBA did not experience as much success with its initiatives to 

expedite small business financing to communities affected by the disasters 

and use private sector banks to process disaster loan applications. As a 

result, some of SBA’s initiatives did not significantly reduce the backlog of 

loan applications or the time victims waited for SBA to process their 

disaster loan applications. 
Page 27 GAO-06-860 SBA Diaster Loans

SBA Took Actions to 

Address DCMS Instability 

and Other System-Related 

Issues 

As previously discussed, SBA initially experienced instability and other 

issues with DCMS. However, the agency took actions to address these 

issues. In October 2005, SBA obtained the computer hardware, as agreed to 

with its contractor, that increased DCMS’s capacity to about 2,000 

concurrent users. SBA also obtained additional support from its hosting 

contractor, at no additional cost, to ensure adequate monitoring of the 

DCMS network. By November 2005, because DCMS continued to operate 

near its maximum capacity, SBA added a second shift for loan processing 

staff at its Fort Worth processing facility to better balance DCMS’s 

workload. According to SBA officials, DCMS had been stable since January 

2006, and users reported having a greater comfort level and more success 

in processing applications using the system. The officials added that the 

hosting contractor had provided better oversight over DCMS compared 

with the initial months following Hurricane Katrina. In April 2006, SBA 

officials advised us that the agency had not made any payments to its 

hosting contractor since August 2005 because it did not satisfy contract 

requirements, and negotiations were under way to determine the amount of 

any subsequent payments.

In preparation for the 2006 hurricane season, SBA awarded a new contract 

in April 2006 for up to $54 million to its integration contractor to provide 

project management and information technology support for DCMS over 

the next 5 years. This contractor will continue to upgrade the system to 

support increased loan processing activity by implementing software 

changes and hardware upgrades, providing ongoing support to DCMS 

users, and supporting all information technology operations associated 

with the system under the contract. In addition, SBA has plans to increase 

DCMS’s maximum user capacity to at least 8,000 concurrent users by the 

summer of 2006. However, we could not determine how SBA selected this 

number or whether the agency considered the information available from 

catastrophe risk modeling firms or disaster simulations in determining the 

planned for increase in maximum user capacity. To facilitate this planned 

capacity increase, SBA added on to and extended the contract with its 

hosting contractor in February 2006. Although SBA had experienced 

problems with the initial oversight provided by this hosting contractor, 

according to agency officials, the contractor’s performance had improved. 

For example, the contractor had dedicated a project manager to this effort. 

Because of these improvements and the contractor’s familiarity with SBA’s 

needs, agency officials decided that the contractor could provide a 

hardware solution for the expanded capacity within the agency’s time 

frames.
Page 28 GAO-06-860 SBA Diaster Loans

SBA’s Processing Changes 

and Other Initiatives Had 

Varied Success

After the Gulf Coast hurricanes, SBA made several changes to its disaster 

loan process and implemented other initiatives intended to improve its 

response to victims. While some of these initiatives improved SBA’s ability 

to process large numbers of disaster loan applications, others did not. For 

example, in October 2005, SBA established a satellite office to process 

disaster loans at its former Sacramento DAO.22 SBA increased the number 

of loan processing staff in this Sacramento satellite office from 

approximately 40 in late August 2005 to more than 250 by February 2006. 

According to SBA, 8 months after Hurricane Katrina, the Sacramento 

satellite office had processed about 95,500 home and 4,800 business 

applications through DCMS for Gulf Coast hurricane victims.23 Table 3 

describes other SBA changes or initiatives that improved its response to 

disaster victims by making the application process easier or referring some 

applicants to FEMA for grant assistance sooner.

Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That Improved Response to Disaster Victims

Source: GAO analysis of SBA data.

a

Change made for Hurricanes Katrina and Rita only.

22SBA had planned to phase out loan processing operations at this office by the end of 

October 2005, as it became the Field Operations Center West under SBA’s transformation 

initiative.

23SBA also used the Sacramento satellite office to process about 10,700 home loan 

applications for smaller disaster declarations.

Name Date Description

Revised filing requirements for business 

applicationsa

October 2005 Reduced filing requirements for all business applicants, such as tax 

returns for past three years and monthly sales analysis because 

these records may have been destroyed. This initiative enabled 

victims to file their applications sooner.

Alternate loss verification methods October 2005 Authorized loss verification staff to perform verifications for home 

loan applicants using third party documentation in certain areas 

and to verify property damages without the applicant being present 

in certain cases.

Revised preprocessing decline 

procedures

November 2005 Used DCMS to automatically decline applicants with credit scores 

indicating a high degree of default risk to refer applicants to FEMA 

for possible grant assistance sooner than the normal process.
Page 29 GAO-06-860 SBA Diaster Loans

In contrast to these actions, SBA implemented other initiatives that had 

more limited success. For example, in November 2005, SBA implemented 

the GO Loan Program. SBA intended for this program to expedite small 

business financing for communities severely impacted by Hurricanes 

Katrina and Rita. This program provided an 85 percent guaranty to qualified 

lending partners, such as banks, that agreed to make expedited loans 

available under the agency’s 7(a) loan program up to $150,000 to small 

businesses located in communities affected by the disasters. Under the GO 

Loan Program, small businesses applied directly to qualified lenders, who 

evaluated their creditworthiness and determined if they required an SBA 

guaranty to make the loan. SBA agreed to make a decision on whether to 

apply a guaranty to the loan within 24 hours. While SBA prescribed the 

maximum interest rate lenders could charge, the lender and borrower 

negotiated the actual rate. For loans of $50,000 or less, lenders could 

charge a maximum interest rate of 6.5 percentage points over the prime 

rate and a maximum rate of 4.5 percentage points over the prime rate for 

loans over $50,000. Thus, lenders could charge disaster victims interest 

rates that were significantly higher under the GO Loan Program than the 

rates SBA charged under the Disaster Loan Program. For example, a 

disaster victim applying for a $60,000 GO Loan could have been charged an 

interest rate up to 11.5 percent in November 2005 when the prime rate was 

7 percent. In contrast, a business owner not able to obtain credit elsewhere 

would have received a 4 percent rate under the Disaster Loan Program. 

SBA only guaranteed 222 GO Loans totaling $19 million through May 2006. 

The higher interest rates lenders could charge under the GO Loan Program 

made these loans less attractive than SBA disaster loans and likely 

contributed to the small number of loans made under the program. 

In December 2005, SBA implemented a pilot program to expedite the 

processing of disaster loan applications. Under this program, DCMS made 

automatic approval recommendations for applicants with credit scores 

indicating that they were less likely to default on a loan, and loan officers 

did not have to conduct the lengthy repayment analysis for these 

applications. According to SBA, loan officers processed 8 to 10 home loan 

applications per day, on average, under the pilot program—about twice as 

many applications as under the normal process. However, loan officers did 

not review DCMS-generated approval recommendations until after the loss 

verification stage under the program. In addition, when SBA implemented 

the pilot program, the agency faced a significant backlog of 115,000 

applications in the loss verification stage, and these applications had been
Page 30 GAO-06-860 SBA Diaster Loans

in the queue for 39 days on average.24 As a result, SBA’s data showed that 

the agency actually took longer to process expedited approvals compared 

with SBA’s average processing time frames for all approvals. Specifically, 

SBA processed expedited approvals in about 104 days on average between 

December 2005 and April 2006, compared with 94 days for all approvals 

processed through the end of April 2006. If SBA had implemented this 

initiative sooner when the backlog in loss verification was not so large or if 

the agency had implemented an expedited loss verification process for 

these applications, the pilot program may have been more effective in 

reducing the amount of time disaster victims waited for a decision on their 

application. Table 4 describes other SBA actions or initiatives that did not 

significantly reduce the backlog of loan applications because they were 

either not implemented in a timely manner or did not fully incorporate the 

use of DCMS to process applications.

Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had Limited Success

Source: GAO analysis of SBA data.

a

Change made for Hurricanes Katrina and Rita only.

24Applications for Hurricanes Katrina and Rita only.

Name Date Description

Give a Lending Hand Initiative November 2005 Requested volunteers from the business lending community to help process 

business disaster loan applications. SBA hired only 14 individuals under the 

initiative.

District office processing of disaster 

home loan applications

January 2006 Used district office staff to manually process home loan applications using 

paper copies of the loan applications. This was a labor and time intensive 

process because district office staff did not have access to DCMS, and SBA’s 

Fort Worth PDC staff had to compile and ship files, make corrections to files 

returned, and input completed decisions into DCMS.

Presolicitation notice for loss 

verification servicesa

January 2006 Issued a presolicitation notice for contractors to perform loss verifications 

nearly 5 months after Hurricane Katrina. SBA decided not to issue a 

solicitation because the agency had significantly reduced the backlog of 

applications in loss verification by February 2006.

Disaster Loan Partners February 2006 Solicited proposals from local banks and other entities to process disaster 

loan applications. Similar proposal made by private sector banking 

association in October 2005. According to SBA, the agency decided to make 

three separate awards but received requests for debriefings from several 

unsuccessful entities. SBA determined it could not move forward on awarding 

specific task orders under the initiative until the agency conducted the 

debriefings, and the protests were resolved. 
Page 31 GAO-06-860 SBA Diaster Loans

SBA May Be Able to Process 

Applications More 

Efficiently

DCMS provided SBA with opportunities to help the agency move toward a 

paperless processing environment by automating many of the functions the 

agency previously performed manually, such as obtaining FEMA referral 

data and credit bureau reports as well as completing and submitting loss 

verification reports from remote locations. SBA officials also told us that 

DCMS improved its ability to process disaster loans, and the agency would 

have experienced even greater processing delays using its previous system 

and loan process. However, we found other potential opportunities during 

our review that might help SBA to process loans more efficiently and move 

closer to its goal of processing loan applications within 21 days when faced 

with disasters.

For example, SBA may be able to increase the efficiency of its application 

entry process by implementing a secure Internet-based application feature 

for home loan applicants. Currently, SBA accepts only paper loan 

application documents from disaster victims, and data-entry staff manually 

input application data into DCMS. According to the Direct Loan Systems 

Requirements issued by the Joint Financial Management Improvement 

Program, federal agency loan systems “should provide for an electronic 

application process using various media, such as a secure Internet 

application.”25 SBA could reduce the number of paper application 

documents it receives, the number of documents it subsequently scans into 

DCMS, and the resources and time required to input application data by 

capturing much of this information electronically. According to SBA 

officials, DCMS has the capability to interface with a secure Internet-based 

application feature where this data could be captured electronically. 

However, SBA did not attempt to add this functionality after the Gulf Coast 

hurricanes because of the instability it initially experienced with DCMS. 

SBA officials added that the agency concentrated its efforts on expanding 

the capacity of DCMS and would examine adding this functionality to the 

system in the future. 

25The Joint Financial Management Improvement Program is a joint and cooperative 

initiative to improve financial management practices in the government and was authorized 

under the Budget and Accounting Procedures Act of 1950. The program promotes strategies 

and guides financial management improvement across government; reviews and 

coordinates central agencies’ activities and policy promulgations; and acts as a catalyst and 

clearinghouse for sharing and disseminating information. See JFMIP Direct Loan System 

Requirement: June 1999.
Page 32 GAO-06-860 SBA Diaster Loans

SBA officials told us that, prior to the Gulf Coast hurricanes, the agency 

initiated a business process reengineering effort within ODA to reevaluate 

the disaster loan process. As part of this effort, ODA planned to (1) 

determine what type financial analysis would be performed for applicants 

with credit scores indicating a high degree of default risk, (2) design a 

streamlined loan application (both paper and electronic), and (3) identify 

policy and legislative changes required to implement the new process. 

However, ODA postponed this effort after the Gulf Coast hurricanes 

because of the resources needed to meet the demands of the disaster loan 

program. Business process reengineering can help organizations identify, 

analyze, and redesign their core business processes with the aim of 

achieving dramatic improvements in critical performance measures such 

as cost, quality, service, and speed. According to SBA officials, it has plans 

to resume this effort in 2006 in order to identify ways to more efficiently 

process disaster loan applications and to maximize the benefits of DCMS.

Conclusions The Gulf Coast hurricanes presented SBA with unprecedented challenges 

that, in combination, led to significant backlogs and delays in processing 

disaster loan applications. For example, SBA faced the largest volume of 

disaster loan applications in its history, as the United States experienced 

three extremely destructive natural disasters over a period of about 2 

months. This large volume was due in part to the large number of 

applicants automatically referred to SBA by FEMA’s Internet site, many of 

whom ultimately did not qualify for disaster loans. We also agree that SBA 

should improve its screening process within DCMS when processing “$0 

income” referrals and continue to work with FEMA to reduce unnecessary 

online disaster referrals, as recommended by SBA’s Office of Inspector 

General. In addition, various system and processing-related issues also 

challenged SBA, such as a new disaster loan system that was not designed 

to effectively respond to a disaster of this magnitude and that was unable to 

operate at the planned maximum capacity. Moreover, SBA based the 

maximum number of concurrent users for DCMS solely on its historical 

experience rather than considering information available from catastrophe 

risk modeling firms and disaster simulations, such as the likelihood and 

severity of damages from potential catastrophes to help predict the volume 

of applications that it might expect from such events. While SBA has plans 

to greatly expand its capacity of concurrent users for DCMS and should be 

more capable of processing larger volumes of loan applications once it 

achieves this increased capacity, it is not clear how the agency determined 

the new maximum number of concurrent users and whether this new 

capacity will be appropriate to handle future large scale disasters like the 
Page 33 GAO-06-860 SBA Diaster Loans

Gulf Coast hurricanes. If SBA had considered information available from 

catastrophe risk modeling firms and disaster simulations to help predict 

the volume of loan applications it could expect to receive, SBA could have 

made better informed decisions and might have acquired additional 

capacity that could have enabled SBA to reduce the backlog of applications 

in a more timely manner. Such an analysis would also better position SBA 

to determine its loan processing capacity for future disasters. SBA’s limited 

planning was further exacerbated by the lack of complete stress testing and 

the ineffective technical support provided by the hosting contractor. If SBA 

had appropriately stress tested the system before implementation, it might 

have discovered before the Gulf Coast hurricanes struck that it had 

received the incorrect computer hardware. Going forward, SBA would 

benefit from improving its process for verifying that the equipment 

provided by contractors meets all required specifications.

While some of SBA’s initiatives improved its response to disaster victims, 

other efforts did not help the agency significantly reduce the large backlog 

of applications because they were either not implemented in a timely 

manner, not attractive to the applicant, or did not fully incorporate the use 

of DCMS to process applications. If some of these initiatives had been 

implemented soon after the Gulf Coast hurricanes struck, they might have 

enhanced SBA’s ability to process a large volume of loan applications in a 

timely manner. In addition, DCMS has the capability to interface with an 

Internet-based application feature that could reduce the resources and time 

required to input application data for home loan applicants by capturing 

much of this information electronically. As the 2006 Atlantic hurricane 

season has already begun, SBA would benefit by expediting its plans to 

resume its business processing reengineering efforts to analyze ways to 

more efficiently process loan applications, including an evaluation of 

implementing an Internet-based application feature.

Recommendations for 

Executive Action

In order to provide more timely disaster assistance in the future, we 

recommend that the Administrator of SBA direct the Office of Disaster 

Assistance to take the following four actions:

• reassess DCMS’s maximum user capacity and related loan processing 

resource needs based on such things as lessons learned from the Gulf 

Coast hurricanes, a review of information available from catastrophe 

risk modeling firms and disaster simulations, and related cost 

considerations;
Page 34 GAO-06-860 SBA Diaster Loans

• conduct complete stress testing to ensure that DCMS can function at 

planned for maximum user capacity levels; 

• improve management controls over assessing contractor performance 

through inspections of all equipment purchased or leased to support 

DCMS; and

• expedite plans to resume business process reengineering efforts to 

analyze the disaster loan process and identify ways to more efficiently 

process loan applications including an evaluation of the feasibility of 

implementing a secure Internet-based application feature for home loan 

applicants.

Agency Comments and 

Our Evaluation

We provided SBA with a draft of this report for review and comment. The 

Associate Administrator for Disaster Assistance provided written 

comments that are presented in appendix III. In these comments, SBA 

provided additional context regarding the magnitude of the disasters and 

the impact on the Disaster Loan Program. SBA stated that it generally 

agreed with our recommendations and intended to improve the delivery of 

the Disaster Loan Program for events of all sizes. However, SBA disagreed 

with the following four findings and conclusions in our draft. 

First, SBA disagreed with our conclusions that it performed limited 

planning and that it would have been better prepared to reduce the backlog 

of applications through the use of catastrophe risk models rather than 

relying primarily on the Northridge earthquake to establish its capacity 

needs. As we noted in our report, SBA planned the maximum user capacity 

for DCMS based on the volume of applications it received from victims of 

the Northridge earthquake—the single largest disaster SBA had previously 

faced—and did not anticipate the likelihood of a single disaster or series of 

disasters of the magnitude of the Gulf Coast hurricanes. We continue to 

believe that catastrophe risk modeling firms and disaster simulations 

provide critical information, such as the likelihood and severity of damages 

from potential catastrophes. Combined with other elements of a 

comprehensive planning process, such information would have been useful 

in planning the maximum user capacity of DCMS. If SBA had considered 

this information, the agency may have concluded that the likelihood of 

large scale disasters exceeding the magnitude of the Northridge earthquake 

was significant enough to expand its maximum concurrent user
Page 35 GAO-06-860 SBA Diaster Loans

requirement. This additional capacity would have better prepared SBA to 

reduce the backlog of loan applications more rapidly because additional 

staff in all phases of the loan application process would have been able to 

access DCMS. 

Second, SBA stated in its comments that our draft report does not include 

an analysis of the difference between using DCMS and ALCS—SBA’s 

previous system. SBA also highlighted in its comment letter many of the 

benefits offered by DCMS. While it was not in the scope of our work to 

conduct a comparative analysis of ALCS and DCMS, our report recognized 

some of the benefits realized by adopting DCMS. For example, we noted 

that ALCS tracked the movement of paper loan application files from one 

stage of the loan process to another and required the movement and 

storage of large volumes of paper. We also noted that DCMS helped SBA 

move toward a paperless processing environment by automating many of 

the functions staff members had performed manually using ALCS such as 

obtaining FEMA referral data and credit bureau reports, as well as 

completing and submitting loss verification reports from remote locations. 

Third, SBA stated that the draft report does not indicate that the specific 

computer components, which the hosting contractor incorrectly provided, 

were processing chips that were embedded subcomponents of the 

computer servers, which SBA personnel could only detect by opening and 

dismantling the computer hardware. We agree that the hardware was 

embedded in the computer servers and could have been verified by 

physical inspection. SBA conducted such an inspection in September 2005. 

However, alternative ways of verifying the computer hardware were 

possible. For example, SBA staff could have used its system utilities to 

view details of the hardware and operating system after the processors 

were installed and may have detected the incorrect processors and taken 

corrective actions in a more timely manner. 

Finally, SBA took issue with our finding that it actually took longer to 

process expedited approvals under a pilot program, compared with its 

average processing time frames for all approvals. SBA stated that our 

interpretation of the data was misleading because it did not adjust for the 

length of time an application was in the loss verification inventory before 

being assigned to the loan department for processing. We disagree that our 

interpretation of the data was misleading because all physical disaster loan 

applications had to go through loss verification before a decision was 

made, regardless of whether the application was part of the expedited pilot 

program. While the expedited approval pilot program may have reduced 
Page 36 GAO-06-860 SBA Diaster Loans

the amount of time for loan officers to complete the underwriting decision, 

our intent, consistent with our overall objective, was to show the total time 

disaster victims waited for SBA to make a decision on their application. 

This includes the time an application is in other stages of the disaster loan 

process, such as application entry and loss verification. As we noted in our 

report, SBA implemented the pilot program when the agency faced a 

significant backlog of 115,000 applications in the loss verification stage, 

and these applications had been in the queue for 39 days on average. SBA’s 

data showed that the agency actually took longer to process expedited 

approvals, about 104 days on average, compared with 94 days on average 

for all approvals. We continue to believe that it is appropriate to consider 

the total processing time frames when comparing applications approved 

under the pilot program with all approved applications.

SBA also provided other technical corrections and comments, which have 

been incorporated in this report, where appropriate.

We are sending copies of this report to appropriate congressional 

committees, the Administrator of the Small Business Administration, and 

other interested parties and will make copies available to others upon 

request. In addition, the report will be available at no charge on the GAO 

Web site at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact 

me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made major contributions to this report are 

listed in appendix IV.

William B. Shear

Director, Financial Markets and

Community Investment
Page 37 GAO-06-860 SBA Diaster Loans

List of Addressees

The Honorable William Thad Cochran

Chair

Committee on Appropriations

United States Senate

The Honorable Susan M. Collins

Chair 

The Honorable Joseph I. Lieberman 

Ranking Minority Member

Committee on Homeland Security 

and Governmental Affairs

United States Senate

The Honorable Olympia J. Snowe

Chair

The Honorable John F. Kerry

Ranking Minority Member

Committee on Small Business and Entrepreneurship

United States Senate 

The Honorable Richard C. Shelby

Chair

The Honorable Barbara A. Mikulski

Ranking Minority Member

Subcommittee on Commerce, Justice, and Science

Committee on Appropriations

Unites States Senate

The Honorable Tom Davis

Chair

The Honorable Henry A. Waxman

Ranking Minority Member

Committee on Government Reform

House of Representatives
Page 38 GAO-06-860 SBA Diaster Loans

The Honorable Donald Manzullo

Chair

The Honorable Nydia M. Velazquez

Ranking Minority Member

Committee on Small Business

House of Representatives

The Honorable Frank R. Wolf

Chair

The Honorable Alan B. Mollohan

Ranking Minority Member

Subcommittee on Science, State, Justice, Commerce, 

and Related Agencies

Committee on Appropriations

House of Representatives

The Honorable Dianne Feinstein

United States Senate

The Honorable Mary L. Landrieu

United States Senate
Page 39 GAO-06-860 SBA Diaster Loans

Appendix I

Scope and Methodology AAppenednxidexiIs

In this report, we evaluate: (1) what affected the Small Business 

Administration’s (SBA) ability to provide timely disaster assistance and (2) 

the actions SBA took after the disasters to improve its response to disaster 

victims. This report focuses primarily on the Disaster Credit Management 

System (DCMS) and the disaster loan process. We visited the Gulf Coast 

region to observe conditions and meet with federal, state, and local 

officials and victims of the disasters. We also interviewed officials from the 

Office of Disaster Assistance at SBA’s headquarters and officials from the 

Processing and Disbursement Center in Texas, Field Operations Centers 

East and West in Georgia and California, Customer Service Center in New 

York, DCMS Operations Center in Virginia, and Georgia District Office. We 

reviewed SBA’s standard operating procedures for approving, declining, 

and withdrawing disaster loans. In addition, we reviewed documents 

related to the agency’s response to the Gulf Coast hurricanes, 

congressional testimony, and other program documentation.

We reviewed documents related to SBA’s acquisition and implementation of 

DCMS. In addition, we discussed the acquisition process with officials from 

SBA’s DCMS Operations Center, which provides technical and program 

management support for the system. We also reviewed SBA’s standards for 

system development and compared the acquisition process for DCMS with 

industry standards for effective information technology acquisition. 

Further, we interviewed officials from SBA’s Office of Inspector General 

and reviewed their reports related to the implementation of DCMS and 

SBA’s Disaster Loan Program. We did not conduct a comparative analysis of 

DCMS and ALCS—SBA’s previous system—as part of our work. To obtain 

the perspectives of system users, we interviewed loan processing staff at 

various SBA locations. We also obtained SBA’s total costs for planning, 

acquiring, and implementing DCMS through April 2006. However, we did 

not audit the reported costs and thus cannot attest to their accuracy or 

completeness.

We obtained documents related to the performance of DCMS, including 

system status reports, troubleshooting reports, and system change 

requests. We reviewed these documents to assess the extent to which 

system-related problems detailed in the documents affected SBA’s ability to 

provide timely disaster assistance. In addition, we obtained various reports 

on SBA’s disaster lending activity for victims of Hurricanes Katrina, Rita, 

and Wilma. We used these reports to calculate descriptive statistics on the 

number of applications mailed and received, the number and amount of 

approved loans, the backlog of applications in various stages, and other 

characteristics for applications processed through May 27, 2006. For 
Appendix I

Scope and Methodology

Page 40 GAO-06-860 SBA Diaster Loans

comparative purposes, we also obtained summary statistical reports 

related to SBA’s disaster lending for past significant disasters. We also 

obtained data extracts from DCMS of disaster loan applications SBA 

received from victims of Hurricanes Katrina, Rita, and Wilma for various 

dates. We used the extracts to calculate average time frames for various 

stages of the disaster loan process.

In assessing the reliability of SBA’s data, we reviewed documents such as 

the DCMS Privacy Act Assessment and met with appropriate SBA officials. 

To increase our confidence in the reliability of SBA’s data, we compared 

information from selected hard copy application files with the information 

recorded in DCMS. We also performed various tests of the information in 

the data extracts we obtained to ensure the completeness of the data. We 

concluded that SBA’s data were sufficiently reliable for the purposes of our 

report.

To evaluate actions SBA took after the disasters to improve its response to 

disaster victims, we reviewed documents related to changes SBA made to 

DCMS and changes SBA planned to make to the system. We discussed 

these changes with officials from SBA’s DCMS Operations Center. In 

addition, we obtained and reviewed documents related to changes SBA 

made to the disaster loan process and other initiatives intended to improve 

SBA’s response to disaster victims. We discussed these changes and 

initiatives with the appropriate SBA officials and obtained data on the 

impact of these efforts where available.

We reviewed documents related to the Federal Emergency Management 

Agency’s (FEMA) Individuals and Households Program, which makes 

assistance available to victims of major disasters. We also contacted FEMA 

to obtain additional information regarding the agency’s process for 

referring applicants to SBA’s Disaster Loan Program.

We performed our work in Atlanta, Ga.; Buffalo, N.Y.; Fort Worth, Tex.; New 

Orleans and Metarie, La.; Sacramento, Calif.; Bay St. Louis, Biloxi, Gulfport, 

and Waveland, Miss.; Herndon, Va.; and Washington, D.C. We conducted 

our work between November 2005 and July 2006 in accordance with 

generally accepted government auditing standards.
Page 41 GAO-06-860 SBA Diaster Loans

Appendix II

SBA’s Acquisition and Implementation of the 

Disaster Credit Management System ApendxiI

Since the early 1990s, SBA utilized its Automated Loan Control System to 

track the movement of paper application files from each stage of the 

process until it made a decision on the application, disbursed funds for 

approved applications, and transferred the application file to servicing. 

SBA also obtained data manually from external data sources, including 

FEMA, the Internal Revenue Service (IRS), and the credit reporting 

agencies. In December 1998, after using a significant number of resources 

in response to victims of Hurricane Georges, which struck Puerto Rico that 

previous September, SBA began an effort to modernize its manual and 

paper-based disaster loan process. 

SBA intended for its new disaster loan system to support: (1) a “paperless” 

electronic loan application and loan process, (2) loan processing from any 

location where the system is implemented, (3) multiple interaction 

methods between loan applicants and the Office of Disaster Assistance 

(e.g., by Internet or telephone), and (4) access to external data sources. 

The modernization effort entailed the following actions:

• documenting SBA’s current loan process and proposed future loan 

process;

• performing requirements analysis, conducting a commercial-off-theshelf (COTS) market survey, and developing a business case; and

• acquiring, customizing, and implementing the system.

In March 1999, SBA completed a business process reengineering study to 

document the current process and proposed future process. In August 

2000, SBA completed the initial development of the new system 

requirements. Subsequently, SBA contracted for a COTS survey of products 

meeting its requirements and leveraging its other information technology 

resources. The survey identified two products that met a significant 

number of SBA’s requirements, with some customization and integration of 

additional products needed to meet all requirements. 

After the contractor completed the survey, SBA’s information technology 

investment review board required the agency to complete a business case 

analysis for the proposed disaster loan system. SBA’s analysis involved 

researching the existing requirements, evaluating potential alternatives, 

and providing a recommendation. In March 2001, SBA completed the 

analysis, which evaluated three alternatives: (1) develop a custom solution, 

(2) acquire a COTS product, or (3) stay with the current environment. SBA 
Appendix II

SBA’s Acquisition and Implementation of the 

Disaster Credit Management System

Page 42 GAO-06-860 SBA Diaster Loans

determined that the COTS product represented the best solution after 

considering the costs and time frames associated with each alternative.

In June 2002, a SBA contractor developed more specific requirements for 

the project because a considerable amount of time had passed since the 

first survey and because of the uniqueness of certain aspects of the disaster 

loan process, such as loss verification and a check for duplication of 

benefits. Later that year, SBA contracted for a separate COTS survey that 

utilized the Carnegie Mellon University’s Software Engineering Institute 

process for evaluating COTS products.1

 SBA evaluated products from 10 

different vendors, and after narrowing the selection to two products, 

received vendor demonstrations in January 2003. In March 2003, the 

contractor recommended a COTS product for SBA to use as the foundation 

for the Disaster Credit Management System (DCMS).

In September 2003, SBA completed an analysis of the DCMS design to 

identify potential gaps between the recommended COTS product and the 

requirements for the system. For example, SBA recognized that the COTS 

product did not have the functionality to perform loss verification 

activities; therefore, SBA decided to implement a custom loss verification 

application and link the application to the core system. This ensured that 

loss verification data would automatically synchronize with DCMS. 

In 2003, SBA also began to test various aspects of its new system. In 

November 2003, the agency began testing the core application, interfaces, 

and additional components (loss verification, scanning, etc.). User 

validation readiness testing was conducted between December 2003 and 

March 2004. In October 2004, SBA contracted for an Independent 

Verification and Validation (IV&V) of an initial release of DCMS. An IV&V 

can help provide reasonable assurance that a system satisfies its intended 

use and user needs, and its use is recognized as an industry best practice. 

The IV&V conducted for DCMS found that the system was supported by 

strong requirements, test plans, test cases, and other supporting 

1

The Software Engineering Institute has identified specific processes and practices that 

have proven successful in fostering quality software development. The processes and 

practices identified focus on software development and acquisition activities. The institute 

has constructed models for developing and acquiring software, developing and 

implementing software process improvement programs, and integrating hardware and 

software. The institute created the models to provide general guidance for software 

development and acquisition activities that programs can tailor to meet their needs (See 

GAO, Defense Acquisitions: Stronger Management Practices Are Needed to Improve DOD’s 

Software-Intensive Weapon Acquisitions, GAO-04-393 (Washington, D.C.: Mar. 1, 2004).
Appendix II

SBA’s Acquisition and Implementation of the 

Disaster Credit Management System

Page 43 GAO-06-860 SBA Diaster Loans

documentation. In addition, the IV&V found that DCMS was developed with 

a high level of user involvement. However, the IV&V did not evaluate 

performance testing, including tests to help ensure that the system could 

function at its maximum user capacity, because these tests were not 

completed until December 2004 after the agency had begun 

implementation. This performance testing was conducted with only up to 

120 concurrent users due to problems with the hardware associated with 

the testing environment. If the testing environment had functioned as 

planned, it was estimated the system could accommodate approximately 

600 concurrent users.

SBA used a phased approach for implementing DCMS. In November 2004, 

SBA first implemented DCMS in its Niagara Falls, New York, Disaster Area 

Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas, 

and Sacramento, California DAO. SBA also began using DCMS to process 

applications for all new disaster declarations. As figure 6 illustrates, SBA’s 

process of moving from its former manual, paper-based disaster loan 

process to a more automated process using DCMS took about 6 years. 

SBA’s costs for planning, acquiring, implementing, and operating DCMS 

totaled about $32 million through April 2006.
Appendix II

SBA’s Acquisition and Implementation of the 

Disaster Credit Management System

Page 44 GAO-06-860 SBA Diaster Loans

Figure 6: Time Line of DCMS Activities

1998 1999 2000 2001 2002 2003 2004 2005

Hurricane Georges hits Puerto Rico Hurricane Katrina hits Gulf Coast

Business process

reengineering study 

completed

System requirements

developed

COTS market survey 

completed

Demonstration of selected 

COTS packages

COTS survey 

updated

DCMS requirements

revalidated

Business case 

completed

Gap analysis/ 

system design

Source: GAO.

DCMS implemented in 

Niagara Falls, N.Y., 

office

DCMS implemented 

in Ft. Worth and 

Sacramento offices
Page 45 GAO-06-860 SBA Diaster Loans

Appendix III

Comments from the Small Business 

Administration ApendxiI
Appendix III

Comments from the Small Business 

Administration

Page 46 GAO-06-860 SBA Diaster Loans
Appendix III

Comments from the Small Business 

Administration

Page 47 GAO-06-860 SBA Diaster Loans
Appendix III

Comments from the Small Business 

Administration

Page 48 GAO-06-860 SBA Diaster Loans
Appendix III

Comments from the Small Business 

Administration

Page 49 GAO-06-860 SBA Diaster Loans
Appendix III

Comments from the Small Business 

Administration

Page 50 GAO-06-860 SBA Diaster Loans
Page 51 GAO-06-860 SBA Diaster Loans

Appendix IV

GAO Contact and Staff Acknowledgments ApendxiIV

GAO Contact William B. Shear, (202) 512-8678, shearw@gao.gov

Staff 

Acknowledgments

In addition to the individual named above, Daniel Blair, Assistant Director; 

Barbara Oliver, Assistant Director; Bernice Benta; Tania Calhoun; Marshall 

Hamlett; Marc Molino; David Pittman; Jennifer Popovic; Rhonda Rose; and 

Eric Trout made key contributions to this report.

(250263)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548