INFORMATION 

TECHNOLOGY 

SBA Needs to Strengthen 

Oversight of Its Loan 

Management and 

Accounting System 

Modernization 

Statement of David A. Powner, Director

Information Technology Management Issues

Testimony 

Before the Committee on Small Business, 

House of Representatives

For Release on Delivery 

Expected at 1:00 p.m. EST

Wednesday, February 8, 2012

GAO-12-395T

United States Government Accountability Office

GAO
 

Page 1 GAO-12-395T 

Mr. Chairman and Members of the Committee:

I am pleased to participate in today’s hearing on the Small Business 

Administration’s (SBA) efforts to modernize its Loan Management and 

Accounting System (LMAS). As you are aware, SBA performs a range of 

significant activities intended to strengthen small businesses and relies 

extensively on information technology (IT) systems to accomplish these 

activities. Among these are financial systems used to support loan 

accounting and track loans through origination, servicing, and liquidation. 

The loan systems, collectively called the Loan Accounting System, were 

implemented in the 1970s and outsourced to be run on a contractor’s 

mainframe hardware. SBA has been pursuing efforts to upgrade and 

modernize its financial systems for several years.

The current effort, referred to as LMAS, dates from 2005 and was a 

response to concerns about the age and information security risks of the 

legacy system. The effort was intended to result in a single, integrated 

loan management and loan accounting solution. However, after an 

independent study and two reviews by the Office of Management and 

Budget (OMB) raised concerns about SBA’s management of the program, 

it was restructured into a series of seven more focused projects with 

shorter time frames, referred to as LMAS-Incremental Improvement 

Projects (IIP).

You asked us to testify on the status of SBA’s LMAS modernization effort 

and whether SBA has adequate processes and procedures in place to 

manage and oversee this effort. My statement today is based on our 

report, Information Technology: SBA Needs to Strengthen Oversight of Its 

Loan Management and Accounting System Modernization, which is being 

released today at this hearing.1

 

1 GAO, Information Technology: SBA Needs to Strengthen Oversight of Its Loan 

Management and Accounting System Modernization, 

This report summarizes the results of our 

study—which specifically describes the status of the modernization effort 

and determines whether SBA has adequate process and procedures in 

place to manage and oversee its LMAS modernization effort. All work on 

which this testimony is based was conducted in accordance with 

generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

GAO-12-295 (Washington, D.C.: 

Jan. 25, 2012).

 
 

Page 2 GAO-12-395T 

based on our audit objectives. We believe that the evidence obtained 

provides a reasonable basis for our findings and conclusions based on 

our audit objectives.

SBA’s mission is to aid, counsel, assist, and protect the interests of small 

business concerns; to preserve free competitive enterprise; and to 

maintain and strengthen the overall economy of the Unites States. One 

way that SBA works to grow businesses is through managing a $90 billion 

portfolio, which includes direct and guaranty loan programs that provide 

small businesses with access to capital. This portfolio includes disaster 

loans, in which SBA makes direct loans to individuals, small businesses, 

and non-profit organizations in declared disaster areas. The portfolio also 

includes loan guaranty programs, through which SBA guarantees loans to 

small businesses that private sector lending institutions would not make 

otherwise. To administer its loan programs, SBA relies on electronic 

systems to support the full life cycle of loans.

SBA has made several attempts to upgrade its financial software and 

migrate it off a mainframe environment. The current effort to modernize 

SBA’s loan systems was designed to, among other things, update and 

improve the agency’s outdated Loan Accounting System. The legacy 

system, implemented in the 1970s, runs on outsourced mainframe 

software and hardware that requires costly contracts to use and maintain. 

This system is programmed in COBOL (Common Business Oriented 

Language), a business application programming language that was 

introduced in the 1960s and is now becoming obsolete and difficult to 

manage. The Loan Accounting System is the primary system used to 

manage and account for loans and loan-related activities for all SBA loan 

programs, including allotment of funds, loan origination, servicing, 

liquidation, collections, and disbursements. New technologies added to 

the loan accounting environment over the years have created a web of 

stove-piped systems and databases, causing issues with interoperability. 

Maintaining data integrity in such an environment requires SBA to employ 

expensive data reconciliations.

In November 2005, SBA announced the initiation of the LMAS program, 

with estimated total costs of approximately $217 million over a 9-year 

period. Its goal was to implement a single, integrated loan management 

and loan accounting solution that aligned with the agency’s strategic 

goals. SBA began work on the LMAS program in early 2006, but was 

unable to replace the legacy system prior to the expiration of its 

mainframe contract in February 2007, making it necessary for SBA to 

Background
 

Page 3 GAO-12-395T 

negotiate new contracts for mainframe and application services until 

December 2011 at a total cost of approximately $30 million.

Following recommendations from an outside study and two reviews by 

OMB, SBA subsequently reduced the overall scope of the LMAS 

modernization project and decided to pursue the modernization through a 

number of smaller projects with shorter time frames. The revised 

approach, called the LMAS Incremental Improvement Projects (LMASIIPs), was approved by OMB in January 2011. It consists of seven 

projects that are to move software off of the legacy mainframe 

environment, upgrade two administrative accounting systems, develop 

new interfaces that are to interact with updated applications, and develop 

plans for future improvements.

As discussed in our report, SBA had completed one of the seven LMASIIPs and awarded contracts for work on three others as of October 2011. 

However, the projects have experienced increasing costs and schedule 

delays. Specifically, according to the most recent project schedule, dated 

August 2011, SBA completed one project in May 2011, 2 months later 

than planned and expects five of the remaining six projects to finish 

between 4 and 11 months later than the dates reported to Congress in 

October 2010. Further, according to the agency’s most recent report to 

Congress, dated March 2011, the total projected cost of the projects 

increased approximately $5 million since October 2010 and the costs of 

individual projects had risen between approximately 3 and 53 percent. 

SBA plans to complete the seven IIPs at a total cost of approximately $28 

million by July 2013. Table 1 shows the initial and current expected 

completion dates and projected costs for the seven LMAS-IIPs. 

Modernization 

Projects Have 

Experienced 

Increasing Costs and 

Schedule Delays, and 

SBA Has Not Fully 

Implemented Key IT 

Management 

Practices
 

Page 4 GAO-12-395T 

Table 1: IIP Initial and Current Expected Completion Dates and Projected Costs (dollars in millions)

LMAS-IIP Current status

Expected 

completion date 

as of October 

2010

Expected 

completion date

as of August 

2011

Projected 

costs as of 

October 2010

Projected 

costs as of 

March 2011

Percentage 

increase in 

costs

Oracle Upgrade Completed May 

2011

March 2011 Completed May 

2011

$8.45 $8.66 2.5%

Migration of User 

Interfaces

Contract awarded 

and work in 

progress

December 2011 May 2012 3.32 3.76 13.3%

Migrate to New 

Version of COBOL

Contract awarded 

to conduct 

assessment 

May 2012 April 2013 6.05 8.72 44.1%

Sybase to Oracle 

Migration

Contract awarded 

to conduct 

assessment 

October 2011 September 2012 2.51 3.11 23.9%

Root Cause Analyses Planning initiated October 2011 June 2012 n/a n/a 41.0%

Implement 

Improvements

Expected to start 

in March 2012

March 2013 July 2013 n/a n/a 47.8%

Document Loan 

Accounting

Expected to start 

in November 2011

March 2013 January 2013 n/a n/a 52.5%

Source: GAO analysis of SBA data.

Note: Cells marked “n/a” represent potentially sensitive cost estimates, which are therefore not 

printed here. 

Our report also raises concerns about SBA’s inconsistent implementation 

of key management practices. The success of large IT projects is 

dependent on agencies’ implementing management practices in areas 

that include software requirements management, IT risk management, IT 

human capital management, and enterprise architecture. In addition, IT 

investment management, which constitutes effective institutional 

oversight, is necessary to ensure that projects adhere to these 

management capabilities and achieve expected results.

SBA partially implemented the management practices we reviewed. 

Specifically:

• Requirements management–SBA appropriately managed changes to 

requirements for the two projects for which this process would be 

appropriate; however, it did not validate the requirements for one of 

the ongoing IIPs. In addition, requirements were not documented for 

two of the ongoing projects.
 

Page 5 GAO-12-395T 

• Risk management–risks were identified for three of four active 

projects; however, SBA did not fully prioritize risks related to one IIP 

or develop plans to mitigate them.

• IT human capital management–SBA inventoried existing human 

capital capabilities; however, it did not fully identify gaps in project 

workforce skills and did not develop strategies to close them.

• Enterprise architecture–SBA drafted target segment architectures for 

the IIPs; however, the architectures have not been approved by the 

appropriate officials. In addition, the agency did not fully implement 

other basic enterprise architecture practices, including maintaining 

and prioritizing its segment architectures.

• IT investment management–the agency had the overall direction of 

the IIP effort approved by an executive review committee. However, 

SBA did not address other capital planning requirements for the 

program, including approving a schedule baseline or reviewing its risk 

management plan, or provide evidence that it approved the 

subsequent changes to the budget estimates reported to Congress.

Inconsistencies in SBA’s application of IT management practices

occurred, in part, because it did not provide adequate executive oversight 

through its investment management process, even though it is using two 

executive bodies to oversee the projects. While these bodies have 

overlapping responsibilities and lines of authority, several basic oversight 

responsibilities, including executive approval of the project’s schedule, 

were left unaddressed by either body. In addition, the cost baselines 

approved by SBA’s executive oversight body differ from the projected 

costs reported to Congress 2 months later. According to SBA officials, 

additional oversight was provided through undocumented meetings and 

reviews of reports to Congress. Nevertheless, these weaknesses in the 

use of basic management practices make it less likely that SBA will be 

able to complete the IIPs within the time, budget, and scope parameters 

originally planned.
 

Page 6 GAO-12-395T 

To better ensure that the loan management Incremental Improvement 

Projects are completed as planned and provide anticipated capabilities, 

we are making several recommendations to the Administrator of SBA in 

our report. Specifically, we are recommending that SBA apply the 

appropriate information technology management practices to the IIPs, by 

ensuring that

• IIP requirements are managed appropriately, including elicitation, 

documentation, and verification and validation;

• IT risks to the IIPs are adequately managed, including preparing for 

risk management, identifying and analyzing risks, mitigating risks, and 

providing executive oversight of risk management activities;

• the human capital necessary for the IIPs is managed appropriately, 

including the determination of human capital needs, the identification 

of gaps between current capabilities and needs, the development of a 

strategy to close those gaps, and the documentation of these 

activities; and

• the enterprise architecture segments related to the IIPs are managed 

appropriately, including the development, prioritization, and 

maintenance of the segments.

In addition, we are recommending that SBA clarify the responsibilities of 

the executive bodies responsible for the IIPs and ensure they provide the 

appropriate oversight of the project’s progress. Specifically, these 

executive bodies should conduct and document executive review and 

approval of the LMAS modernization’s risk management approach, target 

segment architectures, and cost and schedule baselines.

In written comments on the draft of this report, the Small Business 

Administration’s Assistant Administrator, Office of Congressional and 

Legislative Affairs, stated that SBA generally agreed with our 

recommendations. The Assistant Administrator also asked that we clarify 

two points. First, he stated that the costs of the LMAS modernization had 

not increased, and that the figures we included from an October 2010 

report to Congress included only contractor costs while the figures from a 

March 2011 report included both contractor and government costs. 

However, neither the original request nor SBA’s response specifically 

indicate that the costs discussed included only contractor costs. Further, 

this lack of clarity on the projected cost of the modernization reinforces 

the need for an approved cost and schedule baseline that can be used to 

evaluate program progress, as discussed in our briefing.

SBA Needs to Apply 

Appropriate 

Information 

Technology 

Management 

Practices and Clarify 

Roles of Oversight 

Bodies
 

Page 7 GAO-12-395T 

Second, the Assistant Administrator stated that SBA’s executive oversight 

bodies reviewed the LMAS modernization’s overall schedule and cost 

estimates through both formal and informal discussions, including 

executive-level meetings in August and September 2010. We considered 

this information in our initial assessment. However, we do not believe that 

the records he cites demonstrate that SBA is maintaining current cost or 

schedule baselines because the approved project cost estimates are 

inconsistent with estimates subsequently reported to Congress and 

neither of the meetings’ minutes included project-level schedule 

estimates. The Assistant Administrator stated that SBA is considering 

formalizing the additional reviews that are currently undocumented. We 

agree that fully documenting decisions about the projects’ costs and 

schedules would improve SBA’s ability to manage the improvement 

projects.

In conclusion, Mr. Chairman, while SBA has made progress in 

modernizing its loan accounting system, cost increases and schedule 

slippage raise concerns about SBA’s ability to complete the 

modernization as planned. More consistent application of basic 

information management techniques and stronger executive oversight 

could help SBA arrest or reverse these conditions.

Mr. Chairman, this concludes my prepared statement. I would be pleased 

to answer any questions you or other Members of the Committee may 

have.

If you have questions concerning this statement, please contact David A. 

Powner, Director, Information Technology Management Issues, at (202) 

512-9286. Other individuals who made key contributions include James 

R. Sweetman (Assistant Director), Eric Costello, Franklin Jackson, Lee 

McCracken, Meredith Raymond, and Karl Seifert.

GAO Contact and 

Staff 

Acknowledgments

(311281)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.