Performance Audit Report 

SBA's Lender Loan Reporting Process 


has Systemic Reporting Issues and 


Data Control Weaknesses 


February 23, 2012 Report Number 12-08 
u.s. Small Business Administration 

Office Of Inspector General 

Washington, D.C. 20416 

REPORT TRANSMITIAL 

REPORT No. 12-08 

DATE: February 23, 2012 

To: 	 Jeanne Hulit 

Associate Administrator for Capital Access 

Paul T. Christy 


Chief Operating Officer 


SUBJECT: 	 SBA's Lender Loan Reporting Process has Systemic Reporting Issues and Data Control 

Weaknesses 

This report presents the results of our Audit of Control and Security ofSBA's Fiscal Transfer Agent and 

Reporting Process. Our audit objective was to determine the adequacy of SBA's controls and oversight 

over the development, security, and operation of certain information technology systems and processes 

performed by Colson Services Corporation. 

We request you provide your management decision for each recommendation on the attached SBA 

Form 1824, Recommendation Action Sheet, by March 26, 2012 (30 days after final report date). Your 

decision should identify the specific actions taken or planned for each recommendation and the target 

dates for completion. 

We appreciate the courtesies and cooperation of the Office of the Capital Access and Office of Chief 

Information Officer during this audit. If you have any questions concerning this report, please call me at 

(202) 205-7390 or Jeffrey Brindle, Director, Information Technology and Financial Management Group at 

(202) 205-7490. 

/S/ original signed. 

John K. Needham 

Assistant Inspector General for Auditing 
What DIG Audited 

Since 1989, Colson Services Corporation has performed 

certain functions for SBA in the 7(a) loan program and 

more recently in the 504 loan program. These functions 

include processing certain automated transactions and 

developing new information technology systems. Our 

audit objective was to determine the adequacy of SBA's 

controls and oversight over the development, security, 

and operation of certain information technology systems 

and processes performed by Colson Services Corporation 

(Colson). 

We reviewed Colson's performance and SBA's oversight 

of: 

• 	 the processing of lenders' loan reports on the 

status and balance of all SBA 7(a) loans, using 

SBA Form 1502, Guaranty Loan Status and 

Remittance Report, including error corrections; 

• 	 the design, development, and SBA oversight of 

the 504 First Mortgage Loan Pooling (FMLP) 

system; 

• 	 the security and independent audit requirements 

of Colson's systems; and 

• 	 guaranty fee collection and reconciliations. 

Five Year Loan Error Growth 

45000 

40000 

35000 

30000 

25000 

20000 

15000 

10000 

Apr 2006 M ar 2011 

Figure 1. Loan Error Growth from April 2006 to March 2011 

What DIG Found 

SBA's Lender Loan Reporting process had systemic 

reporting issues and data control weaknesses that 

resulted in an estimated $956 million overstatement of 

unpaid loan balances with an estimated $5.2 million effect 

on program subsidy. Lenders frequently did not report 

the status and balance of their loans to Colson. Less than 

one percent of SBA lenders were responsible for over half 

of identified errors and omissions. Further, Colson and 

SBA systems perform different error checking routines, 

making error correction untimely and labor intensive. The 

loan error volume grew by 63.5 percent from April 2006 

to March 2011, reaching 44,327 errors. 

The SBA provided limited oversight of the 504 FMLP 

system development and did not ensure it met SBA's 

quality standards. 

We also found that SBA systems were being operated by 

Colson without ensuring their compliance with Federal 

security requirements. 

Finally, secondary market late penalty fee collection 

needs improvement. The SBA was due $2.5 million in late 

penalty fees, most of which are at least 180 days 

outstanding. 

DIG Recommendations 

We made 11 recommendations, the most significant 

being to: 1) correct loan balances contributing to the $5.2 

million subsidy overstatement; 2) collect $2.5 million in 

outstanding late penalty fees; 3) ensure that system 

development projects adhere to SBA quality standards for 

systems development projects; and 4) ensure that 

systems are authorized to operate prior to being put into 

production. Management agreed with our 

recommendations except for the recommendation to 

collect the $2.5 million in outstanding late penalty fees. 

Actions Taken 

The SBA initiated a special project to address weaknesses 

in the 1502 reporting process prior to issuance of a draft 

of this report. 
Table of Contents 

Introduction ................................................................................................................................1 


Finding: SBA Management has not Adequately Addressed Systemic Data Control Weaknesses within 


Finding: The SBA did not Provide Adequate Oversight of the First Mortgage Loan Pooling System 


Finding: The SBA Did Not Ensure that Colson's Operation of SBA Systems Met Federal Security 


Objectives ...........................................................................................................................................1 


Background .........................................................................................................................................1 


Results ........................................................................................................................................3 


the 1502 Reporting Process .................................................................................................................3 


Lenders omit loans from the Form 1502 Report ............................................................................... 3 


Lenders report loans incorrectly on the Form 1502 .......................................................................... 4 


SBA and Colson do not use the same edit check criteria ................................................................... 4 


Conclusion .......................................................................................................................................5 


Management Actions Taken and In Process ..................................................................................... 5 


Recommendation(s) ........................................................................................................................5 


Development.......................................................................................................................................7 


Conclusion .......................................................................................................................................7 


Recommendation(s) ........................................................................................................................7 


Requirements ......................................................................................................................................9 


Conclusion .......................................................................................................................................9 


Recommendation(s) ........................................................................................................................9 


Finding: The SBA has not Adequately Enforced Collection of Secondary Market Late Penalty Fees..... 11 


Conclusion ..................................................................................................................................... 12 


Recommendation(s) ...................................................................................................................... 12 


AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE ....................................13 


Appendix I: Scope and Methodology ........................................................................................14 

Appendix III: Lenders Reporting at Least 100 Loans in Error between October 2010 - March 


2011 ..........................................................................................................................................16 


Appendix IV: Summary Table of 1502 Errors .............................................................................17 


Appendix V: Sample of SBA Loans in Error .................................................................................18 


Appendix VI: SBA 1502 Edits not Effectively Utilized by Colson ..................................................20 


Appendix VII: Use of Computer-Processed Data and Prior Coverage .........................................21 


Appendix VIII: Agency Comments ..............................................................................................22 

Introduction 

This audit examines the Small Business Administration's (SBA's) oversight of information 

technology systems and fee recovery processes employed by one of its contractors, Colson 

Services Corporation (Colson). Colson provides services to assist the SBA's administration of its 

business loan programs. The audit identified data control weaknesses, concerns with SBA's 

oversight of system development for a new program, areas of improvement in certain fee 

collection processes, and other internal control weaknesses. 

Objectives 

Our audit objective was to determine the adequacy of SBA's controls and oversight over the 

development, security, and operation of certain information technology systems and processes 

performed by Colson. 

Background 

Colson has been SBA's Fiscal Transfer Agent (FTA)l for the SBA's 7(a) guaranty loan program 

through successive contracts since 1989. Colson also acts as the Central Servicing Agent (CSA) 

for the SBA's 504 Development Company Program. Colson is compensated by the collection of 

fees (e.g., issuance, service, transfer, origination, etc) that it earns on various program-related 

transactions. The FTA earns additional revenue from its role as an intermediary between 

lenders that sell the guaranteed portions of SBA-backed loans (either as individual guarantees or 

in loan pools) to investors on SBA's secondary market. Colson earns float interest from this role. 

Float interest is earned by receiving interest between the date payments are received from 

lenders and the date payments are made either to the investors (known as ilregistered holders") 

or to the SBA's Master Reserve Fund2

• 

To ensure the integrity of the guaranteed loan portfolio, the SBA mandates that lenders with 

outstanding 7(a) loans report the status and balance of all SBA 7(a) loans in their portfolio using 

SBA Form 1502: Guaranty Loan Status and Remittance Form3

. The SBA requires the submission 

of this form, even when there are no payment activities from the borrowers for the subject 

month. Since 1996, Colson has collected the Form 1502 data from lenders on the SBA's behalf. 

To facilitate the processing of this data, at the beginning of each month, Colson receives an SBA 

file to establish the population of loans expected to be reported during the month. The 

information Colson receives from lenders is then compared to SBA data using a series of edit 

checks (i.e. error checks) to ensure accuracy and completeness. 

1 The FTA's principal duties are to facilitate the settlement of the first sale of a loan; record current and all prior 

registered holders (investors) of a loan; track loan payment histories; collect payments from lenders on sold 

loans; remit payments to investors; forward all servicing requests from a lender to the investor and forward the 

response back to the lender; notify SBA of delinquent loans; and handle SBA and lender repurchases from the 

investor. 

2 The Master Reserve Fund was created to facilitate operation of loan pooling in SBA's 7(a) secondary market 

program by holding both the principal paid from borrowers and due to investors, as well as accumulated interest 

earnings. 

3 This form also serves as the medium for lender submission of 7(a) loan program guarantee fees and payments for 

loans sold on the secondary market. 

1 
Colson notifies lenders of discrepancies identified by the edit checks so revisions can be made. 

Near the 20th of each month, Colson transmits loan information to the SBA to update the Loan 

Accounting System (LAS). During the same month, the FTA transmits additional information to 

the SBA as lenders correct identified reporting errors or submit 1502 updates. Prior to using any 

of the loan data from Colson, the SBA runs a series of edit checks to ensure that the information 

is valid. The loan data is then updated into the SBA's Electronic Loan Information Processing 

System (ELlPS). The SBA's ELiPS is the system of record for loan accounting and subsidy 

calculations. 

Multiple OIG audits and other reviews conducted between 2005 and 2011 identified the need 

for the Agency to: 

• implement consistent edit check criteria with Colson; 

• identify and address lenders that had consistent 1502 reporting errors; 

• develop and enforce penalties on lenders who do not report on their loans; and 

• provide adequate training to lenders. 

In 2007, the SBA re-solicited the FTA contract and, in response to previous OIG 

recommendations, included contract provisions to improve the quality of 1502 data and 

reporting. Upon contract award in 2008, responsibility for 1502 data error correction was 

transferred from SBA field offices and servicing centers to the FTA. 

The SBA's implementation of provisions of the American Recovery and Reinvestment Act4 

required modifications to Colson systems and operations as SBA's FTA for the 7(a) Loan Program 

and CSA for the 504 Development Company Program. Specifically, section 503 of the American 

Recovery and Reinvestment Act authorized SBA to place a Federal guaranty on a pool of first 

mortgages associated with loans made under its 504 Development Company Program. In June 

2010, the SBA modified its CSA contract with Colson for $2 million to include development of an 

SBA system to service 504 first mortgage loan pools. This application is referred to as the 504 

First Mortgage Loan Pooling System. 

Review of Internal Controls 

The SBA's Standard Operating Proceduress provides guidance on the implementation and 

maintenance of effective systems of internal control as required by Federal Managers Financial 

Integrity Act of 1982. Accordingly, the Office of Management and Budget (OMB) Circular A1236

, provides further guidance for effective systems of internal control to improve the 

accountability and effectiveness of Federal programs and operations by establishing, assessing, 

correcting, and reporting on internal controls. Circular A-123 also provides that processes for 

conducting management's assessment of the effectiveness of internal controls over financial 

reporting should be based on widely recognized internal control standards. 

4 On February 17, 2009, in response to the economic crisis, the American Recovery and Reinvestment Act was 

enacted, establishing new SBA programs as well as changes to existing SBA programs. 

5 SBA SOP 00 02: Internal Control Systems 

6 OMB Circular A-123, "Management's Responsibility for Internal ControL" 

2 
We identified internal control weaknesses as they relate to the audit objective. Specifically, the 

Office of Capital Access (OCA) did not adequately ensure that 7(a) loan transactions exchanged 

between Colson and the SBA received consistent system edits and related error correction 

procedures. In addition, OCA management did not adequately address previous OIG audit and 

external consultant recommendations intended to improve the quality of 1502 data and 

reporting. Further, the SBA was not compliant with its system development guidance and did 

not adhere to Federal security requirements relating to system authorizations. 

We will provide a copy of the final report to the senior officials responsible for internal controls 

in the Office of the Chief Financial Officer and Office of Capital Access. 

Nature of Limited or Omitted Information 

No information has been omitted due to confidentiality or sensitivity, nor were there limitations 

to information on this audit. 

Results 

Finding: SBA Management has not Adequately Addressed Systemic Data Control 

Weaknesses within the 1502 Reporting Process 

Between October 2010 and March 2011, a monthly average of 42,000 loans, or approximately 

13% of the 320,000 active 7(a) loans, did not have their outstanding balance and status updated 

in SBA's ELiPS. Approximately 20,000 of these loans were not updated for this entire six-month 

period. 

Over the past five years, the number of loans in error per month increased from approximately 

27,000 to 44,327 loans7

• This occurred because some lenders did not report all of their loans, 

some reports contained unresolved errors, and edit checks used by the SBA and Colson were 

not consistent. Further, Colson was not effectively complying with its contractual requirement 

to correct errors and the SBA was not enforcing the requirement. As a result, 7(a) loan unpaid 

principal balances and subsidy re-estimates have been overstated and fees due to the SBA may 

not be collected. Specifically, a consultant performed a study on behalf of the Office of the 

Chief Financial Officer, which determined that the unpaid principal balance of the SBA's 7(a) 

portfolio was overstated by $956 million. Because of overstating the amount of unpaid loans in 

its portfolio by nearly $1 billion, the SBA's estimate of the money needed to subsidize projected 

losses in the program was overstated by $5.2 million8 as of April 20119

. 

Lenders omit loans from the Form 1502 Report 

Lenders did not report about 17,000 loans each month (four to five percent of the 

approximately 320,000 loans in the active 7(a) loan portfolio) to Colson via the SBA Form 1502. 

7 Monthly loans in error include unreported loans. 

8 The estimates disclosed in the consultant's study as being based on term loans included both term loans and 

loans with revolving lines of credit. 

9 Annually, under the Credit Reform Act, SBA must assess the adequacy of its loan subsidy balances. Consequently 

the $5.2 million subsidy cost overstatement may result in excess funds being transferred from the 7(a) subsidy 

loan program account as well as overstate SBA's lending costs. 

3 
Loans that are not reported by lenders may overstate the loan balance and adversely affect SBA 

fee collections. For loans not sold on the secondary market, the ongoing guaranty fee is 

remitted with the Form 1502 every month an interest payment is received. Therefore, if a 

lender does not report the status of an unsold loan and remit the fee on the Form 1502, Colson 

cannot determine whether or not an interest payment was made to the lender and thus, 

whether the ongoing guarantee fee is due to the SBA. 

Between October 2010 and March 2011, 20 lenders consistently did not report some or all of 

their loans on the Form 150210. In March 2011, these 20 lendersll, which represent less than 1­

percent of lenders reporting to Colson, were responsible for 53-percent of the 15,533 

unreported loans. 

Lenders report loans incorrectly on the Form 1502 

Approximately four to five percent of the remaining active 7(a) loans that are reported monthly 

by lenders to Colson contained at least one error. These errors included reporting loans that 

were paid in full or purchased and reporting outstanding loan balances that exceeded the loan 

approval amount. On average, Colson, in coordination with SBA lenders, corrected only 10­

percent of the loans in error prior to submitting the 1502 information to the SBA. Between 

October 2010 and March 2011, 17 lenders12 had consistent 1502 reporting errors. In March 

2011, these 17 lenders, which represent less than 1-percent of lenders reporting to Colson, were 

responsible for 48-percent of the loans with reporting errors identified by Colson13• If an error is 

not corrected, the current loans status and outstanding balance is not updated in ELlPS, thereby 

resulting in inaccurate data. 

SBA and Colson do not use the same edit check criteria 

Inconsistent business rules used by the SBA and Colson systems to perform edit (i.e., error) 

checks on 1502 data resulted in an unresolved backlog of erroneous data. Between October 

2010 and March 2011, twelve error conditions identified by the SBA's system accounted for 96­

percent of the total errors affecting 7(a) loans. However, because Colson used different 

business rules to check for errors, the FTA was unable to identify and address many of the errors 

noted by the SBA. 14 Further the SBA did not provide Colson with the information or 

requirements necessary to correct the errors. We performed limited sampling of errors in 1502 

data1S and found that Colson either did not or was unable to take corrective action for seven 

SBA edit checks, which accounted for approximately 35% of monthly SBA identified 1502 16 errors. 

lOThese 20 lenders did not report at least 100 loans on the Form 1502 for each month. 


11 See Appendix II for the list of lenders that did not consistently report their loans on the Form 1502. 


12 Eleven of these lenders also did not consistently report some or all of their loans to Colson. 


13 See Appendix III for the list of lenders that had consistent Form 1502 reporting errors. 


14 For a detailed breakdown of errors affecting SBA loans see Appendix IV: Summary Table of 1502 Errors. 


15 For details on our sampling methodology see Appendix I: Scope and Methodology. 


16 For detailed information on our sample results see Appendix V: Sample of SBA Loans in Error and Appendix VI: 

SBA 1502 Edits Not Effectively Utilized by Colson. 

4 
The OMB Circular A-123, requires controls to ensure that transactions are properly authorized 

and processed accurately and that data is valid and complete. It also requires that controls, 

such as edit checks, be established within Agency systems to verify inputs and outputs. Further, 

this guidance requires agencies to continuously monitor the effectiveness of internal control. 

Circular A-123 also provides that personnel should be responsible for periodic reviews, 

reconciliations or comparisons of data and periodic assessments should be integrated as part of 

management's continuous monitoring of internal control. 

To correct deficiencies in the 1502 reporting process that were identified by the OIG in 2005 and 

subsequent internal control reviews, the SBA included provisions within the FTA contract to 

improve the quality of 1502 data and reporting. These requirements included: 

• 	 the implementation of a daily electronic loan information exchange with SBA, and 

• 	 the requirement for Colson to resolve 99-percent of the correctable errors identified by 

SBA edit criteria, or 97-percent of the affected loan accounts within one month. 

The SBA did not enforce these provisions, however, since it did not provide Colson with system 

business rules necessary to support them. Additionally, SBA management directed Colson's 

efforts towards other program priorities. These priorities included systems development and 

modifications necessary to enact SBA programs established in the American Recovery and 

Reinvestment Act. Finally, management stated that staffing shortages within the Office of 

Financial Assistance contributed to these ongoing 1502 deficiencies. 

Conclusion 

Agency management had not adequately addressed systemic control weaknesses that prevent 

the updating of loans in ELiPS. As a result, 1502 error rates had increased from previous years. 

This put the quality and reliability of SBA's 7(a) portfolio data at risk, overstated subsidy 

estimates, and exposed the SBA to potential financial losses from uncollected ongoing 

guarantee fees. Specifically, a consultant performed a study on behalf of the Office of the Chief 

Financial Officer that determined that the unpaid principal balance of SBA's 7(a) portfolio was 

overstated by $956 million. This created an estimated $5.2 million subsidy re-estimate 

overstatement as of April 2011, which may result in excess funds being transferred from the 7(a) 

subsidy loan program account to the 7(a) financing account and overstate SBA's lending costs. 

Management Actions Taken and In Process 

In response to our findings, the SBA has initiated a special project to address identified 

weaknesses in the 1502 reporting process. 

Recommendation(s) 

In order to improve the conditions affecting SBA's 1502 reporting process, we recommend that 

the Associate Administrator, Office of Capital Access: 

1. 	 Research and correct loans that have not been reported within the ELiPS for a significant 

length of time (i.e. 6 months or more) which contribute to subsidy overstatements 

currently estimated at $5.2 million. 

5 
2. 	 Utilize the lender exception detail reports to identify and address lenders that 

consistently do not report loans and issue corrective action plans. 

3. 	 Utilize the lender exception detail reports to identify lenders with consistent 1502 errors 

and develop training programs that will significantly reduce their error rates. 

4. 	 Identify SBA business rules that affect most loans and provide them in a useable format 

that Colson can integrate into relevant systems. 

5. 	 Develop a plan to oversee and enforce FTA contractual requirements for the daily 

electronic loan information exchange and error correction. 

Agency Comments 

Recommendation 1 

The SBA fully agreed with our recommendation. The OCA has initiated a project team to 

develop and implement a lender outreach program focused on changing lender behavior. The 

goal of this program is to develop greater lender awareness and connect greater lender 

compliance with program privileges by establishing an enforcement role within the SBA's Office 

of Credit Risk Management (OCRM). The SBA's proposed actions are responsive to 

recommendation 1. 

Recommendation 2 

The SBA fully agreed with our recommendation. The lender exception detail reports have been 

circulated to OCRM each month since August 2010 to focus attention on those lenders 

repeatedly identified with unreported or incorrect and unresolved reporting errors. The SBA's 

proposed actions are responsive to recommendation 2. 

Recommendation 3 

The SBA fully agreed with our recommendation. The SBA has a plan in place to build greater 

awareness within the lender community on proper completion of the Form 1502. The SBA is 

utilizing exception reports to identify lenders and researching Agency resources that could best 

address corrective efforts with these lenders. The SBA's proposed actions are responsive to 

recommendation 3. 

Recommendation 4 

The SBA fully agreed with our recommendation. The SBA 1502 process improvement project 

includes consolidating SBA validation codes at Colson. Development and implementation is 

underway and the Agency expects results by the first quarter of calendar year 2012. The SBA's 

proposed actions are responsive to recommendation 4. 

Recommendation 5 

The SBA fully agreed with our recommendation. The SBA has incorporated oversight functions 

into their improvement project and technical team meetings between the FTA and SBA systems 

information staff are underway. The SBA's proposed actions are responsive to recommendation 

5. 

6 
Finding: The SBA did not Provide Adequate Oversight of the First Mortgage Loan 

Pooling System Development 

The SBA's oversight of the Colson 504 First Mortgage Loan Pooling (FMLP) system development 

project was not adequate to ensure that the project met the standards in SBA's System 

Development Method (SDM)17. Specifically, the SBA did not provide adequate project 

management and oversight, which would include the review, approval, and retention of project 

documentation and deliverables. SBA officials overseeing the project cited a lack of awareness 

of the SDM requirements as the reason for these omissions. 

The SBA procedures18 require the SBA's SDM or its equivalent to be used on all information 

technology (IT) system development projects. The SBA's SDM is a phased approach that 

requires the sponsoring official to assign a project manager who is accountable for ensuring that 

phase deliverables are completed, reviewed, and approved before moving forward to a 

successive phase. This helps ensure that key issues are identified and addressed as early as 

possible, and limits major modifications to the original project. 

The SBA also did not participate in system acceptance testing as required by the SDM. Per the 

SDM, system acceptance testing emphasizes the proper functioning of the system from the 

user's point of view and demonstrates whether the program meets the user's written set of 

measurable objectives19 . The SDM provides classes of system acceptance testing that should be 

executed prior to system implementation including: requirements validation tests, functional 

tests, operational tests, interface tests and security tests. 

Conclusion 

Because SBA management did not provide required project oversight or participate in system 

acceptance testing, the SBA does not have adequate assurance that the FM LP system fulfills the 

program's needs. Additionally, SBA management does not have adequate assurance that Colson 

performed all system development activities specified in the contract. Finally, there is an 

increased risk that SBA would be unable to migrate, operate, and maintain the system in a new 

environment as system documentation has not been obtained by the SBA. 

Recommendation(s) 

We recommend that the Associate Administrator, Office of Capital Access: 

6. 	 Retrieve and archive all FMLP system development documentation. 

7. 	 Conduct a post implementation review of the FMLP project deliverables to ensure 

Colson adhered to its SDLC and that all project documentation and deliverables meet 

acceptable quality standards. 

17 The SBA SDM provides a structured and integrated approach to acquiring IT solutions including planning, 

developing and operating those solutions. 

18 SOP 90-47 (2): Automated Information Systems Security Program 

19 The primary focus of the tests should be on translation errors, which are errors made in the process of 

transforming objectives and requirements of the system into design specifications and, finally, into an 

operational system. 

7 
We recommend that the Associate Administrator, Office of Capital Access in coordination with 

the Chief Information Officer: 

8. 	 Ensure that all future internal and external OCA system developments adhere to SBA 

SDM standards for project management and development. 

Agency Comments 

Recommendation 6 

The SBA fully agreed with our recommendation. The SBA will work retrieving and archiving 

FMLP system documentation. The SBA's proposed actions are responsive to recommendation 6. 

Recommendation 7 

The SBA fully agreed with our recommendation. The SBA will conduct a post implementation 

review of the FMLP system. The SBA's proposed actions are responsive to recommendation 7. 

Recommendation 8 

The SBA fully agreed with our recommendation. However, the SBA did not propose actions that 

were fully responsive to the recommendation. Specifically, the SBA did not provide details on 

the measures it will take to ensure that all future internal and external OCA system 

developments adhere to SBA SDM standards for project management and development. 

8 
Finding: The SBA Did Not Ensure that ColsonIS Operation ofSBA Systems Met Federal 

Security Requirements 

Colson was operating SBA-owned systems without SBA ensuring their compliance with Federal 

security requirements. Specifically, since 2007, the SBA had not assessed or authorized Colson's 

FTA system operations in accordance with regulatory requirements. Additionally, the SBA did 

not complete a system control assessment and authorization prior to deployment of the FM LP 

system, which was a significant change to the existing Colson 504 loan servicing system. 

The OMB guidance20 requires that major system applications be authorized to operate prior to 

being put into production and system security controls to be reviewed at least every three 

years. Additional guidance from the National Institute for Standards and Technology (NIST)21 

details the authorization process and further requires systems to be re-assessed when 

significant changes are made to an existing system or unplanned applications are introduced. 

The goal of the system controls assessment and authorization process is to evaluate security 

controls of a system, determine the risk posed by operating the system, authorize a system for 

operation, and monitor controls after a system is placed into production. This process is an 

important element of the Agency's IT security and risk management. 

Due to an oversight by SBA management, the FTA system was not reassessed or reauthorized 

for operation when the previous authorization expired in 2007. Additionally, due to the need to 

introduce new statutorily mandated programs, the SBA focused on implementing the FMLP 

system and originating and servicing 504 first mortgage loan pools rather than completing the 

system authorization. 

Conclusion 

The SBA has allowed Colson to operate SBA systems without adequate knowledge of all system 

risks and vulnerabilities. As a result, management did not ensure system security was 

commensurate with the risk and magnitude of the harm resulting from the unauthorized access, 

use, disclosure, disruption, modification, or destruction of information. 

Recommendation(s) 

We recommend that the Associate Administrator, Office of Capital Access, in coordination with 

the Chief Information Officer: 

9. 	 Complete the review of security controls and authorization of Colson FTA and CSA 

systems. 

10. 	 Ensure that currently operated systems are authorized for operation and meet the 

requirements of applicable NIST guidance and that any new system meets this 

requirement before becoming operational. 

20 0MB Circular A-130 Appendix III "Security of Federal Automated Information Resources" 


21 NIST 800-37, Rev.l"Guide for Applying the Risk Management Framework to Federal Information Systems" 


9 
Agency Comments 

Recommendation 9 

The SBA fully agreed with our recommendation and completed the review, authorization, and 

accreditation of the FTA and CSA systems hosted by Colson on August 3,2011. 

Recommendation 10 

The SBA fully agreed with our recommendation. However, the SBA did not propose actions that 

were fully responsive to the recommendation. Specifically, the SBA did not provide details on 

how it will ensure that new systems are authorized for operation and meet the requirements of 

applicable NIST guidance before becoming operational. 

10 
Finding: The SBA has not Adequately Enforced Collection ofSecondary Market Late 

Penalty Fees 

Over the last five years, Colson, as SBA's FTA, has collected approximately $798 million of 

ongoing guarantee fees from lenders. Limited testing of Colson's collection activities 

determined that controls were generally effective. However, we determined that improvement 

is needed regarding the collection of secondary market late penalty fees from lenders. 

Specifically, $2.5 million in secondary market late penalty fees were due to the SBA and were 

not collected within reasonable timeframes. 

The SBA's Standard Operating Procedures 22require lenders to complete and sign SBA Form 

1086: Secondary Participation Guarantee Agreement for each SBA 7(a) guaranteed loan they sell 

to investors on the secondary market. The form requires lenders to remit payments on 

secondary market loans to the FTA by the third calendar day of every month, or the next 

business day if the third is not a business day. When payments on secondary market loans are 

not submitted to Colson by the time they are due to the investor, Colson will pay the investor 

from a trust fund 23 established for that purpose. For any payment not received by the FTA on 

the second business day after the due date, the lender is subject to the following late payment 

penalties: 

• 	 a late payment penalty to SBA (collected by FTA), which is the greater of $100 or fivepercent of the unremitted amount (subject to a maximum penalty of $5,000 per 

month); 

• 	 a late payment penalty to FTA equal to the interest on the unremitted amount at the 

rate provided in the Note, less the rate of Lender's servicing fee; and 

• 	 a late payment penalty to FTA calculated at a rate of twelve-percent per annum, on the 

unremitted amount. 

The form also states that failure by the lender to pay such penalty and collection fees within ten 

business days of receipt of a bill for such fees may constitute a significant violation of the rules 

and regulations of the secondary market. Finally, the form states that the FTA and the SBA 

reserve the right to withhold these penalty fees from settlement of any future guaranteed 

interest sale, or any payment made by the SBA or FTA to the lender. 

While Colson has billed lenders approximately $8 million in late penalty fees over the last five 

years, unpaid amounts have increased from $1.7 million in 2006 to approximately $3 million in 

2011. We determined that SBA's portion of these outstanding penalty fees was approximately 

$2.5 million, most of which exceeded 180 days. Management was not adequately monitoring 

outstanding secondary market late penalty fees due to a lack of resources within OFA needed to 

collect small outstanding amounts. 

22 SOP 50 10 5(C): Lender and Development Company Loan Programs 

23 The Master Reserve Fund 

11 
Conclusion 

Because the SBA did not dedicate resources to collect these outstanding amounts, 

approximately $2.5 million in funds were not collected. 

Recommendation(s) 

We recommend that the Associate Administrator, Office of Capital Access: 

11. 	 Collect the $2.5 million in secondary market late penalty fees by either billing lenders or 

offsetting against any guarantee purchase amounts. 

Agency Comments 

Recommendation 11 

The SBA did not agree with our recommendation to collect the $2.5 million in secondary market 

late penalty fees. The SBA does not view the outstanding penalty fees as a material item in the 

context of total fees collected that requires the dedication of limited staff resources and time to 

collect. The OIG believes that the $2.5 million in secondary market late penalty fees is an 

outstanding amount owed to the Agency that should be collected through direct billing or 

offset. 

12 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE 

On October 12, 2011, we provided a draft of this advisory memorandum to the Associate 

Administrator for Capital Access and the Chief Information Officer. On January 9, 2012, the 

Office of Inspector General received SBA's final comments. The Acting Associate Administrator 

for Capital Access generally agreed with all of the recommendations. A summary of 

management's comments and our response follows. 

Agency Comments 

Management agreed that SBA's Lender Loan Reporting process had systemic reporting issues 

and stated that it has made improving the process a top priority for the OCA and has already 

resolved two of the eleven recommendations. Management, however, was concerned that our 

references to the $5.2 million subsidy re-estimate overstatement did not clearly identify this 

value as an estimate and included enough context. Management also stated that the audit 

report did not adequately disclose whether the analysis conducted in 2006 included unreported 

loans. 

OIG Response 

In response to the Agency's comments, we added additional language in the executive summary 

to clarify that the $5.2 million subsidy amount was an estimated figure. We also revised the 

report to provide additional information regarding the composition of loans used to derive the 

estimate. Additionally, the OIG added language within the report to disclose that the analysis of 

loan errors conducted in 2006, which identified approximately 27,000 loans in error, included 

unreported loans. 

Actions Required 

Please provide your management decision for each recommendation on the attached SBA 

Forms 1824, Recommendation Action Sheet, within 30 days from the date of this report. Your 

decision should identify the specific action(s) taken or planned for each recommendation and 

the target date(s) for completion. 

We appreciate the courtesies and cooperation of the Small Business Administration during this 

audit. If you have any questions concerning this report, please call me at (202) 205-7390 or Jeff 

Brindle, Director, IT and Financial Management Group at (202) 205-7490. 

13 
Appendix I: Scope and Methodology 

To accomplish our objective we reviewed contractor performance and SBA's oversight of contracts with 

Colson Services Corporation (Colson) for Fiscal Transfer Agent (FTA) and Central Servicing Agent (CSA) 

services. For the FTA contract, we reviewed activities related to 1502 data collection, error correction 

and reconciliation, guaranty fee collection and reconciliation, secondary market transactions, SBA Form 

159 data collection, and summary and variance reporting requirements. For the CSA contract, we 

reviewed SBA's oversight of the design and development of the FMLP system. Finally, we reviewed the 

security and independent audit requirements of Colson's systems including system Certification and 

Accreditations, Statement of Accounting Standards 70 (SAS 70) reports for Colson and its parent and 

SBA's Plans of Action and Milestones covering Colson system vulnerabilities. 

Our audit methodology consisted of interviews with program officials and Colson personnel, review and 

analysis of SBA contracts with Colson, as well as relevant reports and system documentation. 

Additionally, we performed analytical procedures on data extracts obtained from Colson and the SBA for 

the period of October 2010 through March 2011 and conducted limited sampling of 1502 report errors. 

We conducted this audit in accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings and conclusions based on our 

audit objectives. 

Sampling 

Our analysis of SBA error conditions affecting 7(a) loans identified that 12 error codes were responsible 

for approximately 96-percent of the total errors each month. In order to further understand the 

conditions that result in lIerrors" identified by SBA, we selected a judgmental sample of 36 loans, 3 per 

error code, that were affected by these 12 errors. This sample was sufficient to identify whether the 

error was the result of an unreported loan, a condition that Colson had knowledge of but was unable to 

correct, or exclusive to SBA edit criteria. 

To select our judgmental sample, we performed a series of data queries to select and insert records into 

new monthly tables from an extract of SBA's 1502 data. The table of records for the month of March 

2011 was selected and sorted by the error and the first three loans affected by a singular error from the 

top 12 error codes were selected for our sample. Sampling only loans with a single error code was 

performed to facilitate the isolation and identification of the condition resulting in the error. Loans 

affected by error codes 1044 and 1196 were only observed in combination with other error codes. In 

response, we sampled loans with error code combinations of 11044, 1006' and 11042, 1196' as these 

combinations were the most common in both instances. This sample was then submitted to Colson 

requesting that the following information be provided: 

1. 	 Whether the loan was reported on the 1502 by the lender during the month. 

2. 	 Whether the loan was reported on the 1502 by the lender and identified in error by Colson. 

3. 	 Whether the identified error(s) on a given loan were corrected by Colson prior to the final 1502 

data submission to SBA. 

For the results of this test, see Appendix V: Sample of SBA Loans in Error. 

14 
Appendix II: Lenders Not Reporting at Least 100 Loans between October 2010 - March 

2011 

Table 1. Lenders Not Reporting at Least 100 Loans between October 2010 - March 2011 

LENDER NAME 

Loans 

Not 

Reported 

Oct-10 

Loans 

Not 

Reported 

Nov-10 

Loans 

Not 

Reported 

Dec-10 

Loans 

Not 

Reported 

Jan-11 

Loans 

Not 

Reported 

Feb-11 

Loans 

Not 

Reported 

Mar-11 

BANCO POPULAR DE PUERTO RICO 221 218 242 245 240 246 

BANCO POPULAR NORTH AMERICA 1,550 104 104 100 1,421 100 

BRANCH BANKING & TRUST CO. 116 111 118 127 135 146 

CAPITAL ONE FSB 271 272 273 300 304 300 

CHARTER ONE BANK N.A. 178 158 167 542 178 187 

CITIZENS BANK 1,372 1,395 1,391 1,383 1,415 1,409 

CITIZENS BANK PENNSYLVANIA 279 292 296 305 314 319 

CITIZENS BANK OF MASSACHUSETIS 188 192 193 190 375 387 

CITIZENS BANK OF RHODE ISLAND 114 116 113 115 116 113 

DORAL FEDERAL SAVINGS BANK 104 104 104 104 104 103 

FIRST COMMONWEALTH BANK 131 125 124 120 114 111 

HSBC BANK USA 220 241 244 249 253 253 

HUNTINGTON NATIONAL BANK 101 105 121 100 130 127 

INNOVATIVE BANK 229 414 369 515 495 675 

JPMORGAN CHASE BANK, NA 527 489 522 529 558 324 

MANUFACTURERS & TRADERS TRUST 254 200 219 206 216 200 

SOVEREIGN BANK MID ATlANTIC 101 1,833 100 104 1,894 1,922 

TD BANK, NA 508 491 491 505 508 511 

WASHINGTON MUTUAL BANK, FA 115 131 125 126 329 124 

WELLS FARGO BANK N.A. 392 417 434 633 676 735 

TOTAL 6,971 7,408 5,750 6,498 9,775 8,292 

Source: Colson Services Corporation 

15 
Appendix III: Lenders Reporting at Least 100 Loans in Error between October 2010 ­

March 2011 

Table 2. Lenders Reporting at Least 100 Loans in Error between October 2010 - March 2011 

LENDER NAME 

Loans 

Reported 

In Error 

Oct-10 

Loans 

Reported 

In Error 

Nov-10 

Loans 

Reported 

In Error 

Dec-10 

Loans 

Reported 

In Error 

Jan-ll 

Loans 

Reported 

In Error 

Feb-ll 

Loans 

Reported 

In Error 

Mar-ll 

BANCO POPULAR DE PUERTO 

RICO 142 157 129 138 160 164 

BANCO POPULAR NORTH AMERICA 157 118 197 182 202 144 

BANK OF AMERICA N.A. 610 1,139 722 864 885 871 

CAPITAL ONE FSB 843 766 823 815 836 299 

CHARTER ONE BANK N.A. 199 183 190 177 208 206 

CITIZENS BANK 736 755 825 788 833 845 

CITIZENS BANK PENNSYLVANIA 435 433 441 440 445 444 

CITIZENS BANK NA 175 172 165 145 169 170 

CITIZENS BANK NEW HAMPSHIRE 273 274 292 298 304 320 

CITIZENS BANK OF CONNECTICUT 104 108 110 100 115 111 

CITIZENS BANK OF MASSACHUSETIS 479 478 486 521 447 459 

CITIZENS BANK OF RHODE ISLAND 239 237 248 269 254 264 

FIRST CITIZENS F/K/A TEMECULA 168 167 173 171 136 169 

JPMORGAN CHASE BANK, NA 208 181 176 205 182 144 

MANUFACTURERS & TRADERS TRUST 258 279 242 244 214 216 

PNC BANK, NATIONAL ASSOCIATION 319 212 217 345 204 767 

WELLS FARGO BANK N.A. 351 340 307 883 298 289 

TOTAL 5,696 5,999 5,743 6,585 5,892 5,882 

Source: Colson Services Corporation 

16 
Appendix IV: Summary Table of 1502 Errors 

Table 3. Summary of 1502 Errors 

SBA Error 

Code SBA Error Code Text 

Oct-10 

39,326 

loans 

Nov-10 

41,233 

loans 

Dec-10 

39,969 

loans 

Jan-ll 

43,863 

loans 

Feb-ll 

43,107 

loans 

Mar-ll 

44,286 

loans Total 

%of 

Total 

Errors 

1006 Lender not reported 17,544 19,403 17,828 22,336 22,994 19,559 119,664 32% 

1044 

Guarantee Report status 

code is mandatory 11.239 13,759 12,559 15,805 15,218 13,421 82,001 22% 

1030 

Outstanding Balance 

cannot decrease as 

Principal Payment is 0 8,875 8,923 9,096 8,707 7,759 11,855 55,215 15% 

1037 

If Guaranty Service Status 

Code is 1,2,3,4 Current 

Loan Status must be 1 or 2 7,821 7,490 7,585 7,031 6,845 6,978 43,750 12% 

1042 

Outstanding Balance plus 

Total Amount Undisbursed 

cannot exceed Current 

Loan Approval Amount 2,699 2,699 2,677 2,732 2,559 3,133 16,499 4% 

1029 Loan has been Purchased 1,113 1,215 1,484 1,273 1,358 1,691 8,134 2% 

1196 

Outstanding Balance must 

be less than or equal to 

Current Loan Approval 

Amount 1,406 1,371 1,342 1,415 1,320 1,306 8,160 2% 

1048 

First Disbursement Date 

cannot be null when Loan 

Disbursed Indicator is Y 783 951 1,033 1,203 935 1,064 5,969 2% 

1050 

Total Amount Undisbursed 

must be 0 for a loan in 

Liquidation 1,092 1,135 1,020 963 894 1,004 6,108 2% 

1011 

Current loan status must 

be 1 (Approved - Fully 

Undisbursed) , 2 (Disbursed 

- Regular Servicing) or 3 

(Disbursed -In-Liquidation) 552 985 1,091 805 1,013 1,089 5,535 1% 

1033 

If Guaranty Service Status 

Code is 9 or 0, Total 

Amount Undisbursed must 

equal Current Loan 

Approval Amount 720 784 744 879 1,070 765 4,962 1% 

1035 

If Guaranty Service Status 

Code is 1,2,3,4 Outstanding 

Balance must be greater 

than 0 757 670 716 774 598 621 4,136 1% 

Remaining 

Errors 2,775 2,986 2,849 2,529 2,776 2,636 16,551 4% 

Total Errors 57,376 62,371 60,024 66,452 65,339 65,122 376,684 

Source: SBA 1502 Data Warehouse information 

17 
Appendix V: Sample of SBA Loans in Error 

Table 4. Sample of SBA loans in Error 

Sample 

Item 

SBA Loan 

Number 

SBA Error 

Code SBA Error Message(s) for loans in error 

Loan 

reported on 

1502 by 

lender to 

Colson 

Loan reported 

on 1502 and 

identified in 

error by Colson 

Error 

Corrected 

by Colson 

1 1689785006 1006 Lender not reported 

2 1720975003 1006 Lender not reported 

3 1943406000 1006 Lender not reported 

4 

2041145004 1011 

Current loan status must be 1 (Approved - Fully 

Undisbursed) , 2 (Disbursed - Regular Servicing) or 

3 (Disbursed -In-Liquidation) 

X 

5 

4327845007 1011 

Current loan status must be 1 (Approved - Fully 

Undisbursed) , 2 (Disbursed - Regular Servicing) or 

3 (Disbursed -In-Liquidation) 

X X 

6 

9347654002 1011 

Current loan status must be 1 (Approved - Fully 

Undisbursed) , 2 (Disbursed - Regular Servicing) or 

3 (Disbursed -In-Liquidation) 

X 

7 [Ex. 4, 6] 1029 Loan has been Purchased X 

8 [Ex. 4] 1029 Loan has been Purchased X 

9 [Ex. 4] 1029 Loan has been Purchased X 

10 

1803545009 1030 

Outstanding Balance cannot decrease as Principal 

Payment is 0 

X X 

11 

2256355005 1030 

Outstanding Balance cannot decrease as Principal 

Payment is 0 

X 

12 

9147504009 1030 

Outstanding Balance cannot decrease as Principal 

Payment is 0 

X 

13 

3607465000 1033 

If Guaranty Service Status Code is 9 or 0, Total 

Amount Undisbursed must equal Current Loan 

Approval Amount 

X 

14 

4313825000 1033 

If Guaranty Service Status Code is 9 or 0, Total 

Amount Undisbursed must equal Current Loan 

Approval Amount 

X 

15 

4341205010 1033 

If Guaranty Service Status Code is 9 or 0, Total 

Amount Undisbursed must equal Current Loan 

Approval Amount 

X 

16 

2191446002 1035 

If Guaranty Service Status Code is 1,2,3,4 

Outstanding Balance must be greater than 0 X X 

17 

4197205004 1035 

If Guaranty Service Status Code is 1,2,3,4 

Outstanding Balance must be greater than 0 X X 

18 

6507933003 1035 

If Guaranty Service Status Code is 1,2,3,4 

Outstanding Balance must be greater than 0 

X X 

19 

1999106003 1037 

If Guaranty Service Status Code is 1,2,3,4 Current 

Loan Status must be 1 or 2 

X 

20 

6206544007 1037 

If Guaranty Service Status Code is 1,2,3,4 Current 

Loan Status must be 1 or 2 

X 

21 

6586044000 1037 

If Guaranty Service Status Code is 1,2,3,4 Current 

Loan Status must be 1 or 2 

X 

22 

1919076008 1042 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount 

X X 

18 
Sample 

Item 

SBA Loan 

Number 

SBA Error 

Code SBA Error Message(s) for loans in error 

Loan 

reported on 

1502 by 

lender to 

Colson 

Loan reported 

on 1502 and 

identified in 

error by Colson 

Error 

Corrected 

by Colson 

23 

4241145008 1042 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount 

X X X 

24 

4382135009 1042 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount 

X X 

25 

1771774006 

1044, 

1006* 

Guarantee Report status code is mandatory; 

Lender not reported 

26 

1864765009 

1044, 

1006* 

Guarantee Report status code is mandatory; 

Lender not reported 

27 

1951005002 

1044, 

1006* 

Guarantee Report status code is mandatory; 

Lender not reported 

28 

1847505010 1048 

First Disbursement Date cannot be null when Loan 

Disbursed Indicator is Y X 

29 

3476615007 1048 

First Disbursement Date cannot be null when Loan 

Disbursed Indicator is Y X 

30 

4075825004 1048 

First Disbursement Date cannot be null when Loan 

Disbursed Indicator is Y X 

31 

[Ex. 4] 1050 

Total Amount Undisbursed must be 0 for a loan in 

Liquidation X 

32 

[Ex. 4, 6] 1050 

Total Amount Undisbursed must be 0 for a loan in 

Liquidation X 

33 [Ex. 4, 6] 1050 

Total Amount Undisbursed must be 0 for a loan in 

Liquidation X 

34 

1397645008 

1196, 

1042* 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount; Outstanding Balance must <= Current 

Loan Approval Amount 

X X 

35 

1431805002 

1196, 

1042* 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount; Outstanding Balance must <= Current 

Loan Approval Amount 

X X 

36 

4514505005 

1196, 

1042* 

Outstanding Balance plus Total Amount 

Undisbursed cannot exceed Current Loan Approval 

Amount; Outstanding Balance must <= Current 

Loan Approval Amount 

X X 

Source: SBA 1502 Data Warehouse information and supplemental information provided by Colson 

Services Corporation 

This appendix provides the results of a sample of SBA identified 1502 errors on 36 loans and whether 

Colson Services Corporation identified the loans as: 1) not reported by lenders, 2) reported in error by 

lenders, or 3) corrected by Colson Services Corporation. 

19 
Appendix VI: SBA 1502 Edits not Effectively Utilized by Colson 

Table 5. SBA 1502 Edits not Effectively Utilized by Colson 

SBA Edit 

Check 

Error Message Percent of Total 

SBA Errors 

1011 Current loan status must be 1 (Approved - Fully Undisbursed), 2 

(Disbursed - Regular Servicing) or 3 (Disbursed -In-Liquidation) 

1% 

1029 Loan has been purchased 2% 

1030 Outstanding balance cannot decrease as principal payment is 0 15% 

1033 If guaranty service status code is 9 or 0, total amount undisbursed must 

equal current loan approval amount 

1% 

1037 If guaranty service status code is 1,2,3 or 4, current loan status must be 

lor 2 

12% 

1048 First disbursement date cannot be null when loan disbursed indicator is 

V 

2% 

1050 Total amount undisbursed must be 0 for a loan in liquidation 2% 

Total 35% 

Source: SBA 1502 Data Warehouse information and supplemental information provided by 

Colson Services Corporation 

20 
Appendix VII: Use of Computer-Processed Data and Prior Coverage 

Use of Computer-Processed Data and Prior Coverage 

We were provided several documents and reports containing computer-processed data. The majority of 

these were Microsoft Excel documents created by Colson to support contractual requirements for their 

FTA responsibilities. These reports included summarized lender 1502 exception reports, 7(a) Monthly 

Dashboard reports, and outstanding secondary market late penalty fee reports. 

We were also provided SBA 1502 Data Warehouse information for the period covering October 2010 

through April 2011. We conducted detailed data analyses of 1502 records to determine common errors 

and error counts and compared them to summary reports generated by SBA to monitor loan records 

that do not update in ELiPS. We performed limited tests of these reports and 1502 Warehouse 

information and determined that the data was reasonably complete, authentic and accurate. 

Prior Coverage 

Multiple audits and reviews have been conducted between 2005 and 2011 related to the 1502 loan 

reporting process and SBA's oversight of Colson operations. The SBA OIG reports and other review 

reports used in this audit include: 

SBA OIG Reports 

• 	 Review of the 1502 Reporting Process, December 9, 2005, Report Number 06-07. 

• 	 Loan Classifications and Overpayments on Secondary Market Loans, March 26, 2008, Report 

Number 08-09. 

• 	 Audit of SBA's FY 2010 Financial Statements - Management Letter, December 15, 2010, Report 

Number 11-05. 

SBA OIG reports can be accessed at http://www.sba.gov/office-of-inspector-general. 

Other Reports 

• 	 Kearney & Company: Summary of the 1502 Project, August 24, 2006 

• 	 FI Consulting: 1502 Reporting Process Analysis, August 13, 2010 

• 	 FI Consulting: 1502 Reporting Process Analysis, July 14, 2011 

21 
Appendix VIII: Agency Comments 

RESPONSE TO "AUDIT OF CONTROL AND SECURITY OF SBA'S FISCAL TRANSFER AGENT" 

Improving the 1502 process is a top priority for the Office of Capital Access (OCA). The OCA is leading an 

intra-agency team to identify core issues and improvement opportunities to remedy lender loan 

reporting in the 7(a) program. These should be resolved upon execution of the project plan over the 

next six months. 

OCA has reviewed the Office of Inspector General (IIOIG") draft report titled IIAudit of Control and 

Security of SBA's Fiscal Transfer Agent" dated October 13, 2011 (the lIaudit")24. 

In discussions that we have had with the OIG, we understand that the OIG's reference to a report 

prepared for the CFO by an outside third party contractor (referred to from this point as the IICFO 

contractor report")25, was only to determine the financial impact of reported errors on the subsidy 

estimates. We believe reference to the CFO contractor report as a means to develop a numerical point 

estimate should be disclosed in the audit so that the reader knows is aware of the limited use of the 

analysis and can determine on their own if other aspects of the analysis have merit. The objective of the 

audit is to determine the adequacy of SBA's controls and oversight over the development, security, and 

operation of certain information technology systems and processes performed by the agency's procured 

contractor serving as the Fiscal Transfer Agent (FTA) for SBA's secondary market for SBA 7(a) loans and 

as Central Servicing Agent (CSA) for SBA's 504 loan program. 

OIG has issued eleven recommendations following its review, three of which require input from the 

Office of Chief Information Officer. The comments below address the report contents in general and 

recommendations for action that have been made to the Associate Administrator for Capital Access. 

OCA's response to the audit is coordinated with the format of the audit report so, for example, 

comments to statements made in the IIExecutive Summary" of the audit can be found under the header 

IIExecutive Summary" in this document. 

RESPONSE TO RECOMMENDATIONS 

Executive Summary 

In the Executive Summary, the OIG stated that it found that the lender loan reporting process had issues 

and weaknesses that resulted in a $956 million overstatement of unpaid loan balances with a $5.2 

million effect on subsidy estimates. 

Response: The summary purports to disclose the overstatement as a matter offact instead of the 

CFO contractor report estimate. 

24 In this document, the term "audit" shall refer both to the draft audit report and the audit activity underlying the 

report. 

25 Small Business Administration 1502 Reporting Process Analysis, 14 July 2011 by FI Consulting. 

22 
The subsequent statement that the overstatement results in a $5.2 million effect on subsidy 

estimates lacks context unless it is compared with the re-estimate total provided in the same 

CFO contractor report $26.24 million. This results in a 0.54% impact on the overall subsidy 

estimate. 

We would expect this disclosure to be contained in the audit. 

Response to Specific Recommendations 

Seven of the eleven recommendations center on improving lender reporting behavior, introducing daily 

data transfers, and aligning business validation rules that exist separately at the SBA and at Colson 

Services Corp, our fiscal and transfer agent. The OCA is leading an intra-agency team to identify core 

issues and improvement opportunities to remedy lender loan reporting in the 7(a) program. These 

should be resolved upon execution of the project plan over the next six months. 

Two of the eleven have been resolved separate from the report, and three others require input from 

information systems development staff. 

First Finding - SBA Management has not Adequately Addressed Systemic Data Control 

Weaknesses within the 1502 Report Process 

The statement is made in the second paragraph that 1t ••• Colson is not complying with its contractual 

requirement to correct errors ..." 

Response: The fiscal and transfer agent contract with Colson sets performance measures based 

on correctable errors that are received back from lenders issued exception notices. If lenders do 

not respond to lender exception notifications, Colson remains obligated to return all accounts 

received at the beginning of a monthly report cycle. In this report cycle framework, it is not 

possible for Colson to adjust incorrect account information arbitrarily. 

OCA has also investigated the differences in what Colson deems as a correct account, and what 

SBA considers as remaining in error. We have engaged SBA stakeholders in developing uniform 

validation rules that will be implemented in 2012 to eliminate this divergence from occurring. 

This exercise has been initiated by SBA and Colson within the last 90 days, and SBA is tracking 

this as a priority project in Capital Access. 

In addition, the finding is based on increases in the number of unreported and uncorrected data errors 

related to SBA loan balances in the 7(a) program. 

Response: The analysis ofloan error increases considers two discrete points in time and 

establishes a ratio accordingly. The audit does not disclose whether the analysis conducted in 

2006 included unreported loans as they are now in 2011. Nor does the audit look at the change 

in the portfolio composition and the flow of accounts in and out of the portfolio between the two 

time periods. To that end, SBA presents the following 

23 
Loan Error Rate Increase 

March 2011 Loans in Error 44,327 

April 2006 Loans in Error 27,111 

Reported Increase in Loan Error Rate 63.5% 

Number of Loans in Portfolio at Sep 30 2005: 	 265773 

# of Loan Loans Removed from Active # of Loans 

FY Approvals Portfolio Outstanding II'" 

2006 97,291 	 70,204 292,860 II'" 

2007 99,607 	 71,459 321,008 II'" 

2008 69,437 	 71,050 319,395 II'" 

2009 41,289 	 61,122 299,562 II'" 

2010 47,000 62,384 284,178 

336,219 

Number of Loans in Portfolio at Sep 30 2010: 

Total Number of Accounts in Portfolio that 276,746 


Involved Change in Status, 2006 - Apr 2011 


Total Accounts That Impacted Active Portfolio 


Loan Error Rate - Revised 	 7.23% 

When viewed in this context, the loan error rate is 7.23%, not 63.5%, and should be the baseline 

for process improvement. OCA respectfully disagrees with this element of the finding as 

presented. 

Response to Recommendations 

1. 	 Research and correct loans that have not been reported within the Electronic Loan Information 

Processing System (ELlPS) for a significant length of time (i.e. 6 months or more) which 

contribute to subsidy overstatements currently estimated at $5.2 million. 

Response: The Office of Capital Access has initiated a project team to develop and implement a 

lender outreach program focuses on changing lender behavior in order to comply with reporting 

standards. The goal is to develop greater lender awareness ofloan reporting impact on SBA 

stakeholders, connect greater lender compliance with program privileges (PLP authority, secondary 

market participation, waiver from SBA right of offset) by establishing an enforcement role within the 

Office of Credit Risk Management (OCRM) for those lenders with repeated errors in Form 1502 

report filings. 

2. 	 Utilize the lender exception detail reports to identify and address lenders that consistently do 

not report loans and issue corrective action plans. 

24 
Response: These reports have been circulated to OCRM each month since August 2010 to focus 

attention on those lenders repeatedly identified with unreported or incorrect and unresolved 

reporting errors. We expect risk-based reviews to include corrective action recommendations to 

improve lender loan reporting. 

3. 	 Utilize the lender exception detail reports to identify lenders with consistent 1502 errors and 

develop training programs that will significantly reduce their error rates. 

Response: As mentioned above, we have a plan in place to build greater awareness within the 

lender community on proper completion of the Form 1502. We utilize the exception report to 

identify lenders, and are looking into which Agency resource could best address corrective efforts 

with these lenders. 

4. 	 Identify SBA business rules that affect most loans and provide them in a useable format that 

Colson can integrate into relevant systems. 

Response: Our 1502 process improvement project includes consolidating SBA validation codes at 

Colson. Development and implementation is underway and we expect to see results by the first 

quarter of calendar year 2012. 

5. 	 Develop a plan to oversee and enforce FTA contractual requirements for the daily electronic 

loan information exchange and error correction. 

Response: This effort is incorporated into our improvement project with technical team meetings 

between the FTA and SBA systems information staff underway. 

Second Finding - SBA did not Provide Adequate Oversight of the First Mortgage Loan Pooling 

System Development 

Response to Recommendations 

6. 	 Retrieve and archive all FMLP system development documentation. 

Response: SBA will work on retrieving and archiving this documentation. 

7. 	 Conduct a post implementation review of FMLP project deliverables to ensure Colson adhered 

to its SLDC and all project artifacts meet acceptable quality standards. 

Response: SBA agrees and will conduct a post implementation review. 

8. 	 Ensure that all future internal and external OCA system developments adhere to SBA SDM 

standards for project management and development. 

Response: SBA agrees. 

25 
Third Finding - SBA Did Not Ensure That Colson's Operation of SBA Systems Met Federal 

Security Requirements 

The reports states that systems owned by SBA and operated by Colson were operating without SBA 

ensuring the system compliance with Federal security requirements. 

Response: SBA has worked hand-in-hand with the Office of the Chief Information Officer since 

early 2011 to obtain system security accreditation and authorization. This authorization and 

accreditation was secured for these systems in August 2011. This extensive effort included the 

system elements associated with the FMLP program was being completed at the same time of 

this review. We would recommend the report reflect this as a subsequent event that has been 

addressed. OCA agrees with the finding and has since corrected the finding. 

Response to Recommendations 

9. Complete the review of security controls and authorization of Colson FTA and CSA systems. 

Response: The review, authorization and accreditation of the FTA and CSA systems hosted by 

Colson were completed August 3, 2011. 

10. Ensure that currently operated systems are authorized for operation and meet the requirements 

of applicable NIST guidance and that any new system meets this requirement before becoming 

operational. 

Response: SBA agrees. 

Fourth Finding - SBA has not Adequately Enforced Collection ofSecondary Market Late 

Penalty Fees 

The draft report estimates that over the last five years, SBA has not collected $2.5 million in late fees 

through Colson. 

Response: This estimate of uncollected fees should be viewed in the context of all fees collected 

in the 7(a) program over this same period. See below: 

Fee Collection 

Reported Collection Deficiency 2,500,000 

Total Fees Collected, FY2006 - March 2011 798,000,000 

Fees Oustandingj Fees Collected 0.313% 

OCA considers the recommendation to devote resources to collect late fees to be immaterial in 

relation to total fee collection activity. 

26 
Response to Recommendations 

11. Collect the $2.5 million in secondary market late penalty fees by either billing lenders or 

offsetting against any guarantee purchase amounts. 

Response: The Office of Capital Access does not view this as a material item and does not agree 

with the recommendation to dedicate limited staff resources and time to collect secondary market 

late penalty fees. 

27