Small Business Administration: Actions Needed to Ensure Planned Improvements Address Key Requirements of the Development Company (504) Loan Program
Published: 2014-03-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Title V of the Small Business Investment Act of 1958 established what is commonly referred to as the “504 loan program” to provide small businesses with financing for long-term fixed assets, such as land and buildings. SBA oversees the program, and about 270 CDCs issue “504 loans” that generally cover up to 40 percent of project costs. The program aims to encourage economic development primarily by enabling small businesses to create or retain jobs within their communities. This report examines (1) the lending standards and performance measures SBA has established to help ensure that loans meet key requirements, as well as 504 loan performance, and (2) SBA's processes for reviewing CDCs' eligibility to participate in the program, loan applications, and CDCs' compliance with program requirements. GAO analyzed SBA data, SBA's lending standards and compliance process documentation, and interviewed SBA officials and 10 CDCs selected based on factors such as size and location.
section_title: What GAO Found
paragraphs: The Small Business Administration (SBA) has established lending standards to protect against default and has measured program performance, but lacks guidance on determining the number of jobs supported by 504 program-funded projects. SBA's guidance for certified development companies (CDC)—nonprofits that provide funding to small businesses to promote local economic development in their communities and are certified by SBA—includes credit underwriting standards for determining ability to repay. SBA also has established performance indicators—such as the number of small businesses assisted and jobs supported—for the 504 loan program. However, SBA does not describe how CDCs should calculate jobs created and retained by 504 projects, a key program requirement. Federal internal control standards require control activities that help participants report information accurately. Without specific guidance, SBA cannot ensure that CDCs are calculating this information consistently or accurately. GAO's analysis of SBA data showed that 504 loans approved in fiscal years 2006 through 2008 had the highest 18-month default rates, which correlated with trends in the private sector for commercial real estate loans.
SBA has processes to review (1) CDCs' eligibility to participate in the 504 program, (2) loan applications, and (3) CDCs' compliance with program requirements. The agency is revising some of these processes and expects to finalize the changes by June 2014. However, GAO identified two key areas where additional improvement is needed:
Jobs supported and retained earnings . SBA has guidance for reviewing CDCs' annual reports (used to assess CDC eligibility) and for risk-based reviews of CDCs' compliance with program requirements. However, this guidance does not require SBA staff to review supporting documentation on jobs supported or assess whether CDCs are investing retained earnings in local economic development, as required by regulation. Federal internal control standards require control activities to ensure that program participants report information accurately and comply with requirements. Without reviewing CDCs' information on jobs data and compliance with the retained-earnings requirement, SBA cannot be assured that information on jobs supported is accurate and CDCs are supporting economic development activities as required.
Certification by CDCs with delegated authority . SBA provides initial approval for a 504 loan upon application, but the 504 loan is not closed until after project-related construction is complete (which can be up to 4 years after initial approval). SBA has delegated to certain CDCs additional authority to close a 504 loan. For example, at closing CDCs with this delegated authority can certify that borrowers are still able to repay a 504 loan rather than submit documentation to SBA for approval, as regular CDCs are required to do. SBA renews delegated authority periodically but does not verify that CDCs can support these certifications. Federal internal control standards require agencies to verify compliance with requirements. Without verifying these certifications, SBA lacks assurance that CDCs with delegated authority are following program requirements.
section_title: What GAO Recommends
paragraphs: GAO recommends that SBA issue guidance on calculating jobs created and retained, expand its review of CDCs' annual reports and risk-based reviews of selected CDCs to include assessment of data on jobs supported and compliance with the retained- earnings requirement, and expand its process for renewing the delegated authority of certain CDCs to include a review of CDCs' certifications of borrowers' ability to repay made prior to loan closing. SBA generally agreed with the recommendations and outlined steps it plans to take in response.

section_title: Letter
paragraphs: Small businesses play a critical role in the health of the U.S. economy  and employ a large number of U.S. workers. Given their importance, the  U.S. government has established programs that provide credit and other  support to new and existing small businesses. One such program is a  loan guarantee program authorized by Title V of the Small Business  Investment Act of 1958, commonly referred to as the “504 loan program”  and overseen by the Small Business Administration (SBA). Certified  development companies (CDC), which are nonprofit organizations that  promote economic development in their communities, are certified by  SBA to issue loans to small business borrowers under the 504 loan  program. The program provides long-term, fixed-rate financing for long- term fixed assets, such as land and buildings, to new or growing small  businesses. The goal of the program is to encourage economic  development by providing small businesses with access to credit to  enable them to create or retain jobs within their communities. As of  November 30, 2013, there were approximately 270 CDCs, and SBA’s 504  loan program portfolio included over 61,000 active loans with an  outstanding balance of approximately $27.2 billion.
GAO and the SBA Inspector General have previously reported on the  need for SBA to strengthen oversight of its lenders. In recent oversight  hearings, Congress emphasized the importance of improving the  effectiveness and oversight of SBA programs and reducing costs. You  requested that we review the 504 loan program. This report discusses (1)  the lending standards and performance indicators that SBA has  established to help ensure that loans meet key requirements, as well as  504 loan program performance, (2) the extent to which SBA has  implemented procedures to help ensure that CDCs are eligible to  participate in the program and that loan applications comply with program  requirements, and (3) the extent to which SBA has implemented  procedures to monitor CDC compliance with program requirements.
To address these objectives, we reviewed relevant laws and regulations;  GAO and SBA Inspector General reports; and SBA guidance, including  Standard Operating Procedures (SOP). We also interviewed SBA staff  and officials at 10 CDCs. We selected these CDCs to ensure a range of  CDCs based on factors such as size and location. Due to ongoing  litigation related to a subset of CDCs known as Premier Certified Lenders,  we did not assess loans made using the specific additional authority that  SBA may provide to these lenders.
To respond to our first objective, we analyzed SBA 504 loan data for  fiscal years 2003 through 2013 (as of Mar. 31, 2013) to determine the  composition and performance of the current 504 loan portfolio. We  assessed the reliability of the data by interviewing knowledgeable  officials, reviewing documents about the sources of the data, and  completing electronic testing. We determined that the data were  sufficiently reliable for the purpose of reporting on portfolio composition  and performance. We also assessed whether SBA’s performance  measures were consistent with GAO standards for performance  measurement. To address our second and third objectives, we reviewed  SBA’s compliance processes, including its procedures for oversight of  CDC eligibility and loan approval and for monitoring CDCs. We also  reviewed SBA data and documentation on its compliance activities to  determine the extent to which the agency had implemented these  procedures and whether the procedures were consistent with internal  control standards. Appendix I contains additional information on our  scope and methodology.
We conducted this performance audit from January 2013 to March 2014  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: As authorized by Congress, SBA established the 504 loan program to  foster economic development; create or preserve job opportunities; and  stimulate the growth, expansion, and modernization of small businesses.
The 504 loan program provides long-term, fixed-rate financing to new or  growing small businesses for fixed assets such as owner-occupied real  estate or long-term equipment and machinery. Small businesses may  apply for 504 financing through a CDC serving the area where the 504  project is located. CDCs are generally nonprofit corporations that provide  funding to small businesses in order to contribute to economic  development within their communities. There are about 270 existing  CDCs located throughout the United States and Puerto Rico. A CDC  must obtain certification from SBA to operate in a designated state;  however, a few CDCs offer 504 funding in contiguous states contingent  upon approval from SBA. The 504 loan program is intended to serve  small businesses that might otherwise not have access to privately  financed credit. Similar to other SBA loan guarantee programs, the 504  program has a “credit elsewhere” requirement, which means that small  business applicants must be unable to obtain credit on reasonable terms  from a nonfederal source.
In 1994, Congress authorized SBA to implement two programs to provide  qualified CDCs with delegated authority to carry out certain functions  associated with 504 loans that had previously been reserved for SBA.  These two programs are the Accredited Lenders Program (ALP) and the  Premier Certified Lenders Program. The two programs allow participating  CDCs, in some cases, to unilaterally make decisions related to various  loan activities. As discussed previously, the scope of this review does not  include issues related to the Premier Certified Lenders Program. SBA  may designate a CDC as having ALP authority if the CDC meets certain  statutory and regulatory requirements. The ALP designation is for 2 years  and can be renewed. CDCs with ALP authority assume responsibility for  thorough borrower credit and loan eligibility analysis on initial 504 loan  applications, which we discuss in more detail later in this report.
For a typical 504 loan project, the financing is provided by three parties: a  third-party lender, a CDC, and a small business borrower. A third-party  lender, typically a commercial bank, provides financing totaling at least as  much as the 504 loan, generally 50 percent or more of the total 504  project financing. A CDC provides up to 40 percent of the financing  through a loan (the “504 loan”) that is backed by a debenture that is fully  guaranteed by SBA. The maximum amount a CDC can loan a small  business borrower is $5,000,000 or $5,500,000, depending on the  circumstances. Finally, the small business borrower must contribute at  least 10 percent of the project financing. Exposure to default risk is tiered  in the 504 loan program. The third-party lender’s loan is collateralized by  a first lien on the project property. The CDC’s 504 loan is subordinate to  the bank’s first position on the debt.
A 504 loan is approved but not funded by the sale of the debenture until  project-related construction is completed. Prior to the sale of the  debenture and funding of the 504 loan, the borrower may obtain interim  financing from a third-party lender, usually the same lender that provided  the loan covering 50 percent of the total 504 project financing. After  project-related construction is completed, the 504 loan is closed, and the  debenture is sold by SBA’s central servicing agent. The central servicing  agent distributes the appropriate funds to the small business borrower on  behalf of SBA and the CDC.
SBA’s Office of Capital Access (OCA) is responsible for overseeing the  504 loan program and CDCs. The Office of Financial Assistance (OFA) is  an office within OCA that is responsible for the implementation of the 504  loan program. OFA’s primary responsibilities include structuring the 504  loan application process and making necessary adjustments to  application criteria based on feedback from program participants and data  analysis. OFA also monitors and oversees the requirements and program  protocols that determine SBA’s ability to extend capital to small  businesses. The Office of Performance and Systems Management, also  within OCA, analyzes relevant data to inform final 504 policy decisions  and provides system oversight for the central servicing agent, among  other responsibilities. The Office of Credit Risk Management (OCRM),  another office within OCA, is responsible for managing all activities  regarding lender and CDC oversight. Its duties include assigning risk  ratings to CDCs, conducting reviews, and preparing written reports  addressing CDC oversight. Finally, OCA’s Office of Financial Program  Operations is responsible for the execution of the 504 program through  loan processing and servicing and through liquidation of 504 loans and  management of the loan portfolio.
SBA also has district offices and processing and servicing centers that  have a role in the 504 program. Staff in SBA’s 68 district offices provide  local assistance to participating CDCs and occasionally offer 504 program  training courses to lenders and CDCs. They also conduct annual reviews  of CDCs’ annual reports. In addition, district office counsel review 504  loan closing documentation, among other things. The Sacramento Loan  Processing Center (SLPC) evaluates and issues loan guarantee  commitments to eligible and creditworthy 504 loan applicants. In addition,  there are two servicing centers, located in Little Rock, Arkansas, and  Fresno, California, that serve CDCs based on the CDC’s location. These  two servicing centers collectively handle the entirety of SBA’s commercial  loan servicing activities, including the liquidation of 504 loans. The Office  of Financial Program Operations is responsible for managing SLPC and  the two servicing centers.
We analyzed 504 loan program data for fiscal years 2003 through 2013  (as of Mar. 31, 2013) to identify loans approved and disbursed. Based  on our analysis of this subset of loans, SBA approved loans totaling the  largest amounts in fiscal years 2006 and 2007 (see fig. 1). In fiscal years  2008 and 2009, the total number of 504 loans approved and disbursed  declined slightly. Section 504 of the American Recovery and  Reinvestment Act of 2009 and Section 1122 of the Small Business Jobs  Act of 2010 (Jobs Act) expanded the 504 program to allow debt  refinancing under certain circumstances, which could account for some of  the increase after 2009. The temporary debt refinancing program  authorized by the Jobs Act expired at the end of fiscal year 2012.
Based on our analysis, the top four types of small businesses funded by  504 loans were hotels, restaurants, doctors’ offices, and dentists’ offices.  Respectively, these business types made up 12 percent, 5 percent, 4  percent, and 3 percent of all approved 504 loan dollars from fiscal year  2003 through 2012. Also, 85 percent of approved loans and dollars went  to existing small businesses, and 15 percent went to new small  businesses.
section_title: SBA Has Established Lending Standards and Measured Performance, but Lacks Guidance on Determining Jobs Supported
paragraphs: SBA has established lending standards and guidance that address  program requirements and protect against default risk. However, the  agency has not provided CDCs with specific guidance on compiling and  supporting data on jobs created or retained as a result of 504 loans,  which is a key economic development goal of the 504 loan program. SBA  also has established performance indicators for the 504 program and  analyzed 504 program data to measure loan performance.
subsections: section_title: SBA Lending Standards Address 504 Requirements and Default Risk, but SBA Lacks Guidance on Determining Jobs Supported
paragraphs: SBA has established lending standards and guidance for CDCs that  address 504 program requirements and protect against default risk. Table  1 contains some of the key requirements of the 504 program.
SBA has issued regulations implementing the program as well as SOPs  that address program requirements and provide additional guidance to  CDCs on how to implement the program. SOP 50 10 Subpart C  addresses the 504 loan program. In addition to the noneconomic  development-related requirements listed in table 1, SBA officials said that  credit underwriting standards and reviews of borrowers’ character and  credit history, required by regulation and discussed in the SOP, are  important requirements that protect against default risk. The SOP lays out  the credit underwriting standards that CDCs must comply with as part of  the 504 loan approval process. It specifies that CDCs must analyze each  loan application in a manner consistent with prudent lending standards  and that the cash flow of the small business is the primary source of  repayment. In addition, the SOP discusses the types of financial analyses  CDCs must perform as part of determining the viability of the project. SBA  officials added that the third-party lender also performs its own credit  underwriting of the 504 project, which provides additional review of the  project and also helps protect against default risk. The majority of CDCs  (7 of 10) we spoke with thought SBA 504 lending standards were  sufficient in addressing default risk. Three of the 10 CDCs noted that it  is the CDC’s responsibility to make sure it is underwriting good loans.  SBA also requires reviews of borrowers’ character and credit history.  Specifically, SBA requires that any person with 20 percent or more  ownership interest in the small business applying for the loan be of good  character.
SBA officials said that they consider the 504 financing structure to be  another protection against default risk. As previously discussed, 504 loan  applications are initially approved but are not funded until after project- related construction has been completed (see fig. 2). A third-party  lender—typically, the bank that provides 50 percent of the 504 project  cost—provides interim financing to cover the 504 loan portion of the  project (typically 40 percent) prior to construction being completed. As no  SBA-guaranteed funds are disbursed until key aspects of the project have  been completed, this mitigates the risk of default due to problems with  construction or other issues that may arise prior to project completion.  SBA officials told us that the time between approval and closing varies  depending on the extent of construction. The debenture must be sold to  fund the 504 loan within at least 4 years of the initial approval of the 504  loan. After the project is completed, the 504 loan is closed in accordance  with SBA processes (discussed later in this report) and the debenture is  sold. SBA officials told us that it is rare for loans that were initially  approved not to eventually be funded by the sale of a debenture.  However, as discussed previously, the third-party lender typically holds a  first-lien position on collateral provided under the 504 loan financing  agreement, exposing SBA to potentially higher losses in the event of a  default.
SBA’s commercial loan servicing centers review and approve certain  servicing actions that are not delegated to CDCs. For all CDCs, SBA  must approve certain servicing requests, such as exceptions to policy,  compromise of the principal loan balance, increase in a loan amount,  litigation plans, acquisition of title to any property in SBA’s name, or any  other loan action for which SBA’s prior written consent is required by  another loan program requirement. For regular CDCs and CDCs with  ALP authority, SBA must approve servicing requests such as liquidation  plans, substantial alterations of the terms or conditions of any loan  document, and the compromise of any portion of the loan balance.  Otherwise, regular and ALP CDCs generally have unilateral authority  (meaning they can take action without prior SBA approval) to take all  necessary action to service and liquidate the 504 loans for which they are  responsible, subject to SBA’s right to take over the servicing or liquidation  of any loan. CDCs must provide the appropriate commercial loan  servicing center with written notice of each substantive unilateral loan  action taken on a 504 loan. SBA’s central servicing agent collects loan  payments and reports delinquencies on its secure website. However,  CDCs are responsible for pulling reports and reporting 60-day  delinquencies to SBA. SBA can also pull reports for the 504 program from  the central servicing agent’s website. In October 2013, SBA created SOP  50 55, which consolidated servicing and liquidation guidance specific to  the 504 loan program. SBA officials told us that they did this in order to  make the 504 servicing guidance more user-friendly.
While SBA guidance addresses many of the program’s key requirements  and default risk, SBA has not provided specific guidance to CDCs on how  to compile and support data they report on jobs created or retained due to  504 lending. When applicable, SOP 50 10 requires that CDCs provide an  estimate of jobs to be created or retained in the loan application and  update the estimate 2 years after a loan is disbursed. The SOP also  states that a job opportunity does not have to be at the project facility, but  75 percent of the jobs must be in the community where the project is  located. In addition, it states that job retention may be used if the CDC  can reasonably show how jobs would be lost to the community if the  project was not done. However, the SOP does not provide any explicit  guidance on which jobs within the community may count towards jobs  supported, nor does it explain how CDCs should reasonably show that  jobs would be lost without a 504-supported project. The SOP also does  not discuss the types of supporting documentation that CDCs should  collect as part of compiling jobs supported information. In the past, we  have commented that reporting on jobs created and retained can be  problematic without clear guidance. Federal internal control standards  emphasize the need for federal agencies to have control activities in  place to help ensure that program participants report information  accurately. Control activities are policies, procedures, and methods  (such as guidance) that enforce management directives. Without clear  and specific guidance on compiling jobs supported data, SBA cannot  ensure that CDCs are compiling and supporting this information  consistently and in accordance with SBA’s expectations.
section_title: SBA Has Established Indicators to Measure Program Performance
paragraphs: SBA has established indicators to track program performance, including a  measure to track a key economic development requirement (number of  jobs created or retained). As shown in table 2, these indicators are loans  approved, small businesses assisted, small businesses assisted in  underserved markets, jobs supported, active lending partners, cost per  small business assisted, and approved applications originated  electronically. SBA’s indicators are consistent with our standards, which  recommend the establishment of performance measures that include key  output measures as well as cost information, such as the unit cost per  output. In fiscal year 2012, SBA met or exceeded its targets for six of its  seven performance indicators, which is an improvement from fiscal year  2011, during which SBA met only one of its targets.
In most cases, SBA has a process in place to collect and validate the  data used to report on its performance indicators. Data for several  indicators—loans approved, small businesses assisted, and active  lending partners—are captured using SBA’s loan application and  accounting systems. With respect to the underserved markets indicator,  there are two components. Data on underserved populations are  captured in SBA’s loan application and accounting systems. Loans are  also geographically coded based on their business address in SBA’s loan  accounting system, from which SBA can determine if the borrower’s  project is in an underserved place. According to SBA, both its loan  application and loan accounting systems are subject to periodic audits of  their completeness and accuracy, and these audits provide validation of  the collected data. According to SBA officials, the agency uses a separate  technique for calculating the cost per small business assisted by  compiling employee-reported information from annual activity surveys on  which SBA staff indicate what portion of their overall time is spent working  on the 504 program. SBA officials stated that supervisors review each  survey for accuracy and completeness prior to submission. SBA validates  the percentage of applications originated electronically by verifying that  the information in its data sets coincides with what is shown in the loan  application system and other data from its loan processing centers.
However, SBA does not have a process for validating the jobs supported  indicator, which is based on data reported by CDCs. According to SBA  guidance, CDCs are to estimate the number of jobs supported at the time  of the loan application and determine the actual number 2 years after a  504 loan is disbursed, as previously discussed. When compiling data for  this indicator, SBA states that it uses the data captured in SBA’s loan  application system at the time of loan approval. SBA officials who are  responsible for reporting on the performance indicators have stated that  no process currently exists for reviewing jobs supported information that  SBA receives from CDCs. SBA’s lack of a process for reviewing jobs  supported information received from CDCs will be discussed in greater  detail later in this report.
section_title: SBA Analyzes Program Performance, and Default Rates Have Followed U.S. Economic Trends
paragraphs: SBA staff analyze 504 loan data on a weekly, monthly, quarterly, and  annual basis and prepare reports at each of these intervals. These  reports analyze various aspects of 504 program performance, including  loan activity (amount of dollars approved), loan status (current, stressed,  delinquent), and cash flows. SBA officials said that they have been  issuing these reports in some form since 2002 and that senior  management, including the Assistant Administrator and managers in OFA  and OCRM, review these reports. They noted that the purposes of these  reports include aiding senior officials in tracking program performance  and identifying potential issues that may have an impact upon the  program’s performance. For example, a report may show a decrease in  504 loan applications, which may indicate a need for increased education  about the 504 loan program to the small business community. SBA  officials will then be able to determine whether or not to further promote  the program to the lending community. SBA officials also noted that these  reports have helped OCRM make changes to its lender oversight policies.  For example, based on their reviews of some of these reports, OCRM has  begun to stratify and compartmentalize its measurement of lenders’  compliance based on delegated authority (ALP or regular), risk, and size.
We analyzed SBA data on 504 loans approved from fiscal year 2003  through fiscal year 2013 (as of Mar. 31, 2013) and found that 504 loans  followed trends in the U.S. economy. Of the loans we analyzed, 10.8  percent were paid in full, 72.9 percent were current, 4.0 percent were  stressed, and 12.3 percent had their debentures purchased (i.e.,  defaulted loans). As seen in figure 3, 504 loans (loans issued by CDCs  and backed by SBA’s 100 percent guarantee) approved during the  economic expansion period from 2005 through 2007 experienced higher  default rates than any other year during the period from 2003 through  2012. Specifically, 504 loans approved from fiscal year 2005 through  fiscal year 2007 had the highest default rates, and loans approved from  fiscal year 2006 through fiscal year 2008 had the highest 18-month  default rates. The default rate (the number of 504 loans whose  debentures were purchased divided by the total loans approved in that  fiscal year) for loans approved in fiscal year 2006 was 24.0 percent, the  highest default rate for the observed period. Loans approved in fiscal year  2007 experienced the highest 18-month default rate at 4.9 percent.  According to SBA officials, the 18-month default rate is an indicator of  default primarily due to poor underwriting.
The 504 default rates followed trends in the U.S. economy during this  period. A study on the U.S. financial crisis stated that the crisis was  triggered by a dramatic weakening of underwriting for U.S. subprime  mortgages, beginning in late 2004 and extending into early 2007, which  was “symptomatic of a much broader erosion of market discipline on the  standards and terms of loans to households and businesses.” Further,  SBA officials told us that the 504 loan program—which primarily finances  commercial real estate—was negatively impacted by declining  commercial real estate values beginning in 2008. According to data from  Moody’s/REAL Commercial Property Price Index for 2002 through 2010,  commercial real estate values increased by more than 85 percent from  2002 to the market’s peak in October 2007, at which point these values  steadily declined, leveling off around 2010. SBA officials noted that this  rapid decline in real estate prices was associated with increased 504 loan  defaults. Declining prices can make refinancing difficult for borrowers and  thus lead to a higher rate of commercial real estate loan defaults.  However, because this period also overlapped with a general economic  recession, some of the defaults may have also been due to a lack of  general business revenue.
We compared 504 loan data to the Federal Deposit Insurance  Corporation’s quarterly analysis of Federal Financial Institutions  Examination Council call report data on the performance of loans issued  by U.S.-chartered commercial banks and found similar patterns. We  analyzed call report data on construction and development loans and real  estate loans (“commercial loans”). As shown in figure 4, the percentage of  defaulted 504 loans that were disbursed within the 2 previous years and  the nonaccrual rates for commercial loans both peaked in the first quarter  of 2010. (Loans in nonaccrual status are nonperforming loans on which  payments are at least 90 days overdue. We used nonaccrual status as a  trend comparison because it was the weakest category of loans and most  similar to purchases made by SBA. However, while trends may be  compared, levels of nonaccrual rates and SBA default rates may not be  compared, as SBA data represent early defaults only and the call report  data represent nonaccruals for total outstanding loans.) Since then, both  of these rates have experienced steady declines.
We also compared the performance of different types of 504 loans  approved in fiscal years 2003 through fiscal year 2013 (as of Mar. 31,  2013). Certain aspects of the 504 program performed better than others  with respect to defaults. ALP loans, for example, had a default rate of  11.0 percent, compared to a default rate of 14.9 percent for regular 504  loans. Further, the 18-month default rate for regular 504 loans was 2.5  percent, while the same rate for ALP loans was lower at 1.6 percent. We  also compared default rates for 504 loans made to new small business  borrowers versus those made to existing small businesses. We found that  existing small businesses experienced a default rate of 10.9 percent and  a 1.6 percent 18-month default rate, while new businesses experienced a  higher default rate of 19.8 percent and a 4.0 percent 18-month default  rate.
In addition, we analyzed 504 loan performance based on the location of  the CDCs making the loans. Figure 5 illustrates default rates and 18- month default rates by state. Mississippi, Puerto Rico, Nevada, West  Virginia, Arizona, and Florida had the highest rates of total defaulted  loans. Puerto Rico, Alabama, Maine, Kentucky, West Virginia, and Florida  had the highest 18-month default rates.
According to SBA analysis, 504 loan program cash flows have  consistently been negative since 2008. In fiscal year 2012, SBA  purchased $871.9 million in defaulted 504 loan debentures, resulting in  an overall net cash flow of negative $555.3 million for the year. Costs of  504 loan defaults are offset by collected fees and any recoveries. Net  cash flow is equal to the sum of all fees and recoveries minus purchases.  In fiscal year 2011, SBA purchased $1.3 billion in defaulted 504 loan  debentures, and the program had a negative cash flow of $1.1 billion. In  fiscal year 2010, the program experienced an even greater negative cash  flow with a deficit of $1.4 billion after purchasing $1.6 billion in defaulted  504 loan debentures that fiscal year. According to SBA, the effects of the  economic recession and the 504 loan program fee reductions that went  into place under the American Recovery and Reinvestment Act and the  Small Business Jobs Act of 2010 played a large role in the substantial  cash flow deficit for fiscal years 2010 through 2012.
From fiscal year 2008 through fiscal year 2013 (as of April 2013), SBA  charged off 6,888 504 loans for a total of $3.4 billion in charged-off  dollars. Charged-off dollars are the remaining balance of the loan, after all  recoveries (the amount of funding recovered from defaulted loans) are  made, that SBA charges off its balance sheet. During this period, SBA  recovered $353.5 million from defaulted loans and calculated a recovery  rate of 9.3 percent. SBA officials stated that the 504 loan program has a  low recovery rate due in part to the fact that the third-party lenders (which  generally provide at least 50 percent of the financing on the 504 project)  typically have the first lien on the assets funded by the 504 loan and  receive any recoveries before SBA. SBA’s guarantee of the debenture  lessens the risk exposure associated with bank lending compared with a  conventional commercial loan; SBA’s second lien position further  transfers risk to SBA. By taking on this risk, SBA’s guarantee and lien  position can facilitate lending and economic development that may not  occur otherwise.
section_title: SBA Reviews CDC Eligibility and Loan Applications, but Does Not Confirm Compliance with Some Requirements
paragraphs: SBA has processes to review CDCs’ eligibility to participate in the 504  loan program but, as previously mentioned, does not require or examine  support for CDC-reported data on jobs created or retained. SBA also  does not require SBA staff to review CDC compliance with the retained- earnings requirement when reviewing CDC eligibility. SBA has multiple  processes for reviewing 504 loan applications; however, SBA does not  verify certifications made by CDCs with ALP authority at loan closing that  the small business borrower has not suffered any adverse financial  changes since the 504 loan was initially approved.
subsections: section_title: SBA Reviews CDC Eligibility, but Does Not Confirm Compliance with Jobs-Supported and Retained-Earnings Requirements
paragraphs: SBA has established a process for approving CDCs to participate in the  504 loan program, which includes a probationary period. Institutions that  are interested in participating in the 504 loan program must first apply and  receive approval from SBA to become a CDC. To be eligible, an  institution must, among other things, (1) be a nonprofit corporation, (2) be  in good standing with, and in compliance with all laws in, the state in  which the CDC is incorporated and in any other state in which the CDC  conducts business, and (3) have at least 25 members who actively  support economic development in the proposed area of operations. A  CDC applicant must apply to the SBA district office serving the applicant’s  proposed area of operations for certification. The applicant is required to  submit several documents, including evidence of its nonprofit status and  an operating budget. District office staff make their recommendation and  send the application to headquarters for final approval. If their initial  application is approved, CDCs are then on probation for 2 years, meaning  they do not yet have permanent status as a CDC. At the end of the 2-year  probation, the CDC must petition SBA for permanent CDC status or a  year-long extension of probation. SBA will decide whether to give a  CDC permanent status based, in part, on comments received from the  applicable servicing center, the CDC’s compliance with 504 requirements,  and the performance of the CDC’s 504 loan portfolio.
SBA annually reviews current CDCs’ continuing eligibility to participate in  the 504 loan program. A CDC must submit an annual report to its SBA  district office within 180 days after the end of its fiscal year and include  audited or reviewed financial statements, as applicable, and such interim  reports as SBA may require. In its annual report, a CDC must also  indicate the job opportunities actually or estimated to be provided by each  project. In addition to an annual report, CDCs must also submit to SBA a  statement of personal history for each new associate and staff, reports of  involvement in any legal proceedings, changes in organizational status,  changes in any condition that affects its eligibility to continue to participate  in the 504 program, quarterly service reports on each loan in its portfolio  which is 60 days or more past due, and other reports as required by SBA.  District office staff use an annual report review template to review CDCs’  annual reports before forwarding the reports to SBA staff in headquarters.  The CDC annual report review template covers the CDCs’ 504 activity  (e.g., number of loans approved and closed and delinquencies),  organization (e.g., staff changes), and financial capacity (e.g.,  consistency in revenues and expenses). SBA officials stated that they use  a monthly management report to track the status of CDCs’ annual report  submissions.
The annual report review template does not require SBA staff to confirm  CDC compliance with certain key 504 requirements. For example, while  the template requires SBA staff to review the number of jobs created or  retained included in the annual report, it does not require staff to request  and review supporting documentation for the figures reported. As  discussed previously, each CDC is required to create or retain one job in  its community for every $65,000 of 504 loan funds (every $100,000 if the  project involves a small manufacturer). This requirement is a key  requirement of the 504 loan program that promotes economic  development within CDCs’ communities. SBA officials we spoke with  acknowledged that they do not regularly request and examine supporting  documentation to review the data on jobs supported in CDCs’ annual  reports. However, SBA officials stated they may request supporting  documentation if information appears to be unrealistic based on their  experience. All 10 CDCs we spoke with stated that SBA had not  requested supporting documentation for the jobs-supported information  that they reported in their annual reports. As discussed previously, SBA  also uses CDC-reported jobs data to report on the status of the jobs- supported performance indicator. Federal internal control standards  emphasize the need for federal agencies to have control activities in  place to help ensure that program participants report information  accurately. Control activities are the policies, procedures, and methods  that enforce management directives. In addition, our guidance on data  reliability recommends tracing a sample of data records to source  documents to determine whether the data accurately and completely  reflect the source documents. Finally, our guidance on performance  measurement states that data used to report on performance indicators  should be sufficiently complete, accurate, and consistent. Because SBA  does not request and review at least some supporting documentation  during its reviews of CDCs’ annual reports, it lacks assurance that jobs  data are supported and that CDCs are meeting a key economic  development goal. It also lacks assurance that data it uses to report on  the jobs-supported performance indicator are supported.
The annual report review template also does not require an assessment  of whether CDCs are complying with the retained-earnings requirement,  which is intended to help ensure that earnings are used to fund additional  economic development activities. SBA 504 loan program regulations  require that any funds generated from 504 loan activity remaining after  payment of staff and overhead expenses be retained by the CDC as a  reserve for future operations or for investment in other local economic  development activity. SBA officials stated that they review whether  CDCs are complying with this requirement as part of their review of the  financial statements in CDCs’ annual reports. However, the annual report  review template does not list an item requiring an assessment of  compliance with this requirement. In February 2013, SBA published a  proposed rule that would require, among other things, a CDC’s Board of  Directors to approve all investments over $2,500 and the CDC manager  to approve investments of $2,500 or less to help ensure that the  investments constitute appropriate economic development activity and do  not compromise the adequacy of the reserves. However, the proposed  rule does not include a description of plans for SBA’s review of the Board  of Directors and CDC manager’s approvals of these investments. As of  December 2013, SBA had drafted a final rule and submitted it to the  Office of Management and Budget for review. Federal internal control  standards indicate that federal agencies should have the information  necessary to determine compliance with laws and regulations. Because  the annual report template does not require a review of compliance with  the retained-earnings requirement, SBA cannot be assured that district  office or other staff are consistently reviewing CDCs’ annual reports for  this requirement or that CDCs are compliant with this requirement.
SBA has an additional eligibility review process for CDCs with ALP  authority. According to SOP 50 10, these CDCs are accountable for  thorough credit and eligibility analysis on loan applications and on  servicing actions. SBA relies on the CDC’s credit analyses in making the  decision to guarantee the debenture and complete the documentation in a  reduced time frame. CDCs with the ALP designation have increased  authority to process and close 504 loans. For example, 504 loan  applications from CDCs with ALP authority are to be processed within 3  business days (versus 6 business days for regular loans). To be eligible  for ALP authority, a CDC must, among other things, (1) have permanent  CDC status, (2) attain priority status (with a Designated Attorney and  SBA-required insurance), (3) have at least 20 504 loan applications  approved by SBA within the most recent 3 years, and (4) have a portfolio  of at least 30 active 504 loans. The CDC also must have a record of  complying with SBA’s 504 policies and procedures and of satisfactorily  underwriting, closing, and servicing 504 loans.
A CDC applies for ALP authority first through its SBA district office. As  part of its application, the CDC must provide, among other things,  information on the experience and qualifications of its staff, the size and  performance of its 504 loan portfolio, and compliance with 504  requirements. The CDC reviews by SBA must be current (within the past  2 years, if applicable), and the CDC must have received an assessment  of “Acceptable” or “Acceptable with Corrective Actions Required.” The  district office reviews the ALP application and forwards its  recommendation to SBA headquarters staff for their final determination. In  fiscal year 2013, 83 CDCs had ALP authority. ALP status is generally  provided to CDCs for a period of 2 years, and according to SBA officials,  renewals usually occur every 1 to 2 years. Ninety days prior to the end of  its ALP term, a CDC should apply for renewal of its status and submit  certain information to SBA.
section_title: SBA Has Multiple Processes for Reviewing 504 Loan Applications
paragraphs: As shown in figure 6, SBA performs multiple reviews of 504 loan  application packages to assess whether loan applications comply with  program requirements. First, SBA’s Sacramento Loan Processing Center  (SLPC) reviews all loan application packages to determine whether  borrowers meet the program’s eligibility and creditworthiness  requirements. Second, it also reviews all application packages to assess  their completeness. Third, SLPC conducts periodic reviews of loan  applications submitted under its streamlined processing guidelines— called the Abridged Submission Method (ASM)—to help ensure that a  CDC’s abbreviated application submitted to SLPC is consistent with the  complete loan application maintained by the CDC.
At the time of application, the small business must meet SBA’s eligibility  requirements and with the exception of size, must continue to meet these  requirements through the closing and disbursement of the loan. The  applicant must be an operating business; be organized for profit; be  located in the United States; be small; and demonstrate a need for the  desired credit. CDCs must certify that credit is not available elsewhere on  reasonable terms, and the applicant must show that funds are not  available from alternative sources, including personal resources of the  principals.
CDCs must submit all 504 loan application packages to SLPC for  processing. The loan application covers key 504 requirements, including  the borrower’s capital injection and economic development goals (jobs- created and public policy goals), as well as financial summary  information, analysis of debt to net worth ratio, and cash flow information.  CDCs must submit certain documents with the loan application, including  eligibility information, a credit memorandum, a personal history statement  for each officer and director and individuals with 20 percent or more  ownership of the small business, a personal financial statement that is  current within 90 days for individuals with 20 percent or more ownership,  a participating lender commitment letter, a balance sheet and income  statement, and a cash flow analysis. According to SBA’s guidance, the  credit memorandum should provide a clear representation of the loan  proposal and a complete analysis of the business, including an analysis  of management’s ability and the business’s financial capacity. The  memorandum should also explain why the transaction completely  satisfies SBA’s credit standards. This memorandum, along with the other  documents, demonstrates the CDC’s basis for the applicant’s ability to  repay the loan. For example, SBA requires that a CDC perform a financial  analysis of the applicant’s repayment ability based on historical income  statements, tax returns, and projections. The CDC must also analyze  cash flow because cash flow of the small business applicant is the  primary source of repayment, not the liquidation of collateral.
According to SBA officials, two SLPC loan officers review all 504 loan  application packages to determine whether applicants meet SBA’s  eligibility and creditworthiness requirements. During these reviews, the  loan officers analyze financial data to determine if the loan satisfies SBA’s  credit standards and use a checklist to determine whether the project  fulfills SBA’s eligibility requirements, such as loan eligibility, jobs created  and retained, and economic development goals. Upon completion of its  review, SLPC issues an authorization to the CDC if the applicant meets  the eligibility requirements and is creditworthy. Staff may screen out  applications if information is missing or they have questions about the  application. In effect, screen outs are similar to declines if the CDC fails  to respond with additional information to resolve the issue. SBA must  decline a loan request if, for example, a CDC’s financial analysis  demonstrates that the small business applicant lacks reasonable  assurance of repayment in a timely manner from the cash flow of the  business. See table 3 for information on the number of loans SBA  approved, screened out, and declined in recent years. As the table  shows, the largest number of loans approved in the past 4 fiscal years  was in 2012. SBA officials told us that most of the screen outs and  declines stemmed primarily from failure to meet eligibility standards, poor  credit quality, or incomplete application packages. The officials also told  us that the agency experienced an increase in loan applications in fiscal  year 2012 because of the debt refinancing program authorized by the  Small Business Jobs Act, which expired in September 2012.
During the processing of each 504 loan application, SLPC staff also  evaluate the completeness of the package and assign a letter grade to  each application package. This letter grade is later converted to a  numeric calculation to derive a CDC’s loan package score based on the  25 most recent loans submitted to SLPC. According to SBA officials, the  grading is not an indication of the credit quality of the applicant but is  simply a measure of how complete the application is. The grades range  from “A” to “E,” with “A” being the highest possible rating. SBA converts  these grades to numeric scores ranging from “1” to “5,” with “1”  corresponding to “A,” so that a lower score indicates a better rating. SLPC  determines the rating by evaluating whether the CDC (1) submitted all  necessary documents and data, (2) completely and accurately analyzed  the eligibility of the transactions, and (3) produced a complete and  thorough credit analysis.
SBA uses the loan package score, among other things, to determine a  CDC’s eligibility to participate in ASM, a streamlined loan application  processing procedure. Under this process, eligible CDCs can submit  fewer documents in order to expedite the application process but must  collect and maintain all required documentation in their files. According to  SBA officials, while it generally takes about 6 business days to process  an application package submitted by a regular CDC, the application  package processing time for a loan submitted under ASM is about 3  business days. The ASM process facilitates a faster review of application  packages because loan officers have fewer documents to review. To  participate in ASM, CDCs must have ALP or Premier Certified Lender  Program authority or have submitted 10 complete loan packages during  the preceding 12 months and earned a numeric equivalent average loan  package score of no more than “2.0” among the 25 most recent loan  applications submitted to SLPC. While SBA officials told us that they do  not keep historical records of CDCs that have ASM status, they said 128  CDCs had this status as of September 2013.
In addition to evaluating all application packages, SBA’s policy requires  that SLPC conduct periodic reviews of loan applications submitted under  the ASM processing guidelines. According to SOP 50 10, SBA is to  review 1 out of every 10 loan applications annually for each CDC. Each  CDC will have at least 1 but no more than 12 loans reviewed during a 12- month period. To accomplish this, SLPC randomly selects ASM files to  review. The primary purpose of these ASM audits is to help ensure that  the abridged application is consistent with the complete loan application  file that is maintained by the CDCs and to monitor CDCs’ continued  eligibility to use ASM. Using a checklist, SLPC staff review the files  selected for the audit to determine, among other things, whether all  documents that the CDC collected were appropriately signed and dated,  the project costs were consistent with the cost stated on the abbreviated  application, financial analysis such as cash flow was correctly  determined, and the size analysis was correct.
We reviewed the results of five ASM audits conducted between January  2011 and August 2013 (1,047 files were reviewed) to determine whether  SLPC was performing these audits as required and what the results  showed. We found that SBA graded the 1,047 files and reported that the  one major exception of concern identified during the first four audits was  resolved satisfactorily. SBA reported that the fiscal year 2013 audit  identified some exceptions, which resulted in a 1-year suspension of two  CDCs’ ASM status. According to SBA officials, when CDCs lose their  ASM status, they generally do so because they cannot provide all loan  application documentation they should retain in their files, or the  documentation they submitted to SBA is not properly signed. According to  SBA’s policy, a CDC will also lose its ASM status if its average loan  package score for the most recent 25 applications submitted to SLPC  exceeds 2.0. In addition, the SLPC center director or a designee may  approve or remove ASM status at any time for good cause including, but  not limited to, misrepresentation, quality of post approval actions, and  findings of internal or external audits of the CDC.
section_title: SBA Does Not Verify Certifications Made by Certain CDCs Prior to Closing but Does Conduct Some Other Reviews
paragraphs: As noted previously, significant time (as much as 4 years) can pass  between approval of the initial 504 loan application and loan closing.  Therefore, CDCs must issue an opinion, prior to closing, that there has  been no adverse change in the borrower’s ability to repay the loan prior to  closing. Prior to closing, a CDC must issue a certification that to the best  of its knowledge there has been no unremedied substantial adverse  change in the borrower’s ability to repay the 504 loan since its submission  of the loan application to SBA. Regular CDCs must provide their finding to  SLPC along with copies of financial statements that are current within 120  days supporting the finding of no adverse change. If SBA disagrees with  a CDC’s determination of no adverse change, the debenture will not close  until SBA has been satisfied that any adverse change has been  remedied. CDCs with ALP authority are required to conduct a review to  determine no adverse change but are not required to submit the results of  this review to SBA. Instead, CDCs with ALP authority retain in their files  the finding and copies of the financial statements on which they relied.  According to SBA officials, if a CDC with ALP authority is in good  standing, SLPC accepts certification that there has been no adverse  change and does not perform an additional check. If a CDC with ALP  authority is not in good standing, SBA officials stated that the loan file  would not be approved.
According to SBA officials, SBA reviews CDCs’ ALP authority for renewal  every 1 to 2 years. We found that the assessment form SBA uses when  determining whether to renew ALP authority does not include a step  verifying that CDCs with ALP authority can support their certification that  there was no adverse change in a borrower’s ability to repay the loan  after initial submission of the loan application. SBA officials confirmed that  they have not reviewed CDCs with ALP authority for compliance with this  requirement. They stated that CDCs were closely scrutinized before SBA  granted them ALP authority and that any problems with certifying that  there were no adverse changes would show up in loan performance data  or in OCRM reviews of the CDC. However, federal internal control  standards require that federal agencies have control activities in place,  such as verification, to ensure compliance with key program  requirements. Furthermore, annually since 2005, more 504 funds have  been loaned using ALP authority than regular authority. In fiscal years  2010 through 2012, the dollar amount of 504 loans made with ALP  authority was about twice the dollar amount of regular 504 loans.  Without incorporating a step in its renewal process to assess compliance  with this requirement, SBA cannot be assured that CDCs with ALP  authority are meeting the requirement.
SBA district office counsel conduct other reviews in conjunction with loan  closing. CDCs and their attorneys are responsible for the 504 loan  closing, including compliance with all SBA loan program requirements.  The SBA district office counsel reviews the closing documents submitted  by the CDC for legal sufficiency and issues a legal opinion on whether  SBA may guarantee the debenture. The SBA officials we spoke with told  us that the counsel also reviews SBA’s authorization and all modifications  transmitted by SLPC. If the counsel determines that a loan was not  closed properly, he or she notifies the CDC of the deficiencies in the  package as well as changes needed to address the concern. If the CDC  is unable to provide the information or otherwise alleviate the concern, the  counsel will not submit the debenture for sale. According to SBA officials,  SBA rarely declines to close a debenture. Usually, declines occur early in  the loan approval process.
section_title: SBA Is Implementing a New Approach to Monitoring CDC Compliance but Has Not Yet Documented Key Processes
paragraphs: SBA has made several changes to its processes used to monitor CDC  compliance with 504 program requirements, including revising the areas  to be reviewed and the types of reviews to be conducted. However, the  processes have not been finalized, and review of certain key  requirements is not yet documented. Further, SBA is updating its  corrective action process to improve review of actions taken.
subsections: section_title: SBA’s New Review Process Covers Five Areas of CDC Operations and Tailors the Level of Review Based on Risk
paragraphs: According to the OCRM Director, SBA is finalizing a new process for  monitoring CDCs and developing its first risk plan for 2014. According to  SBA officials, the plan will be used to monitor CDC performance and  enforce 504 program requirements. They noted that it will include the  OCRM Director’s objectives for the year ahead; lender and loan portfolio  stratifications; a description of the types of lender reviews OCRM will be  undertaking; a proposed list of planned reviews; proposed supervisory  and enforcement actions; and a section on matters internal to OCRM  (e.g., policy updates, training, and staffing). OCRM expects to finalize this  plan by March 31, 2014.
As a part of its new process, OCRM is incorporating risk as a criterion for  selecting CDCs for review. Based on data in its Loan and Lender  Monitoring System, SBA assigns all CDCs a quarterly risk rating of 1 to  5. A rating of “1” reflects lower risk to SBA, and “5” reflects greater  risk. In a November 2009 report, we recommended that SBA use its risk  ratings to select CDCs for review. At that time, the agency targeted  CDCs for review based on the size of their portfolios, focusing on CDCs  with balances of at least $30 million. In fiscal year 2012, OCRM began  incorporating risk ratings into its CDC selection criteria. OCRM placed  emphasis on CDCs that were rated “4” or “5” (higher risk). In fiscal year  2013, SBA selected a number of CDCs for review and prioritized them  based on risk ratings and other factors, such as portfolio size, time  elapsed since last review, and last review assessment.
The OCRM Director also told us that the agency is developing a new  process for assessing CDCs that have been selected for review, but this  process is not yet finalized. Draft guidance on this new process, known as  SMART, shows that SBA has developed preliminary benchmarks to  assess each CDC’s performance and compliance under five areas:  Solvency and financial condition, Management and board governance,  Asset quality and servicing, Regulatory compliance, and Technical issues  and mission. Figure 7 illustrates the SMART components and examples  of preliminary benchmarks that are to be used to assess CDCs’ activities.  In February 2014, the OCRM Director told us that the agency expects to  finalize these benchmarks by March 31, 2014.
In general, once CDCs have been selected for review, the benchmarks  and CDC risk ratings are to be used to determine the level of review.  Under the new review process, SBA plans to conduct three types of risk- based reviews—select analytical reviews, targeted reviews, and full  reviews (see fig. 8). A select analytical review will be OCRM’s initial  review of a CDC’s operations and performance. A targeted review will  examine specific components of SMART in more detail, and a full review  will examine all components of SMART in more detail. Targeted and full  reviews are only to be performed if the select analytical review indicates  that they are warranted. For each CDC selected, OCRM plans to notify  the CDC of the planned select analytical review and request documents  such as a current organizational chart, interim financial statements, and  credit policy manual. In addition, based on its draft guidance, OCRM  plans to use a questionnaire to inquire about, among other things, any  significant changes regarding delegations, responsibilities, and structure  since the CDC’s last risk-based review or submission of its last annual  report. The OCRM Director said OCRM also intends to solicit information  about the CDC from SLPC, the commercial loan servicing center that  works with the CDC, and SBA’s district office counsel. According to SBA  officials, OCRM does not initially plan to request loan files in connection  with select analytical reviews. However, they stated that OCRM could  decide to review loan files in the future. To perform a select analytical  review, OCRM plans to use a CDC profile assessment template to  analyze and document review of a CDC’s activities aligned with each of  the SMART components. Further, OCRM intends to summarize the  findings of the review as well as the review assessment on a report  summary template.
Based on our review of draft guidance, each component of SMART is to  receive one of three assessment scores—Preferred, Acceptable, or Less  than Acceptable with Corrective Actions. In addition, CDCs are to receive  one of four overall review assessments after their review is completed— Acceptable, Acceptable with Corrective Actions Required, Marginally  Acceptable with Corrective Actions Required, or Less than Acceptable  with Corrective Actions Required. Select analytical reviews are to be  conducted remotely, and the results will determine whether a targeted or  full review is necessary. They also are to be used to assess CDCs for  renewal of their ALP authority. OCRM plans to align risk-based reviews  with ALP renewals because during its risk-based reviews OCRM  analyzes information similar to that reviewed during ALP renewals. In  addition, OCRM has expanded the scope of the ALP renewal analysis to  include a review of issues such as the structure of the organization,  board-approved internal control policy, and industry concentrations. In  fiscal year 2013, 83 CDCs had ALP authority. Of those CDCs with ALP  authority, 65 were due for renewal in fiscal year 2013. SBA reported that  they completed 15 of those renewals in fiscal year 2013. SBA officials  commented that they are addressing the backlog by dividing the process  by risk rating. They explained that most of the CDCs with a 4 or 5 risk  rating are undergoing a SMART select analytical review before a longer- term ALP renewal is considered. OCRM provided lenders with risk ratings  of 1, 2, and 3 with temporary extensions of their ALP status. SBA officials  also noted that OCRM has devoted additional staff to reviewing and  processing ALP renewals beginning in calendar year 2014.
According to SBA’s draft guidance, if a select analytical review identifies  risks, OCRM is to perform a targeted or full review. In a targeted review,  OCRM would focus on the aspects of the CDC and its operations that  warrant further attention, based on the SMART components. For  example, the OCRM Director told us that OCRM may target areas such  as loan originations, loan authorizations that may not have been funded,  or financial statement matters. SBA officials told us that in deciding to  conduct a targeted review, OCRM plans to consider a CDC’s risk rating  and loan purchases and apply some judgment in addition to the results of  the select analytical review. OCRM plans to conduct a full review when  the select analytical review identifies issues that are critical or crucial in  nature. A full review would involve examining all components of SMART.  A targeted or full review may be conducted remotely or on-site. An on-site  review is to be used if CDCs do not have technological capabilities for  remote reviews or if OCRM needs to observe an activity as it is being  performed.
In 2013, OCRM initiated 20 select analytical reviews and 5 on-site  reviews using the SMART protocol. According to the OCRM Director, the  purpose of these reviews was to continue developing the new compliance  processes, as well as providing oversight of CDCs. There were more total  reviews in fiscal year 2013 than in previous years but fewer on-site  reviews. In fiscal year 2011 and fiscal year 2012, SBA conducted 21 and  19 on-site risk-based reviews, respectively. Staff from various SBA offices  and contractor staff hired to conduct risk-based reviews participated in the  fiscal year 2013 reviews and will continue to do so. Previously, only  contractors, not SBA staff, conducted on-site reviews.
SBA officials told us that as part of SBA’s targeted and full risk-based  reviews, OCRM has begun to request two samples of loan files— origination loan files and servicing loan files. OCRM currently uses two  checklists to review individual loan files. One checklist primarily includes  questions about loan origination and routine servicing such as whether  the business was organized for profit, whether there was written evidence  documenting that credit was not available elsewhere without the  guarantee provided by SBA, and whether monitoring of continued  creditworthiness is considered sufficient and describes the evidence in  the file. The other checklist includes questions for defaulted loans in  liquidation status on loan closing and servicing, such as whether evidence  shows that all closing documents were legally sufficient and that the CDC  engaged in intensive servicing activities when a loan became 60 days  past due. OCRM plans to eventually merge the checklists as it refines the  new process. According to SBA officials, prior to 2012 OCRM did not  routinely examine a sample of servicing files. Instead, it performed  reviews of CDCs’ servicing files on an ad hoc basis. SBA officials told us  that servicing issues emerged in 2012 because there was a lag effect for  real estate loans after the economic downturn.
Many aspects of the new SMART process have not been finalized. For  instance, the OCRM Director told us that the agency is assessing the  results of a benchmark study, which will be used to finalize the  benchmarks used to rate CDCs on the various SMART components.  Also, OCRM has not yet finalized the assessment templates used for  select analytical reviews or the checklist used for targeted and full  reviews. According to the OCRM Director, these forms are evolving with  OCRM’s review processes. In addition, OCRM is considering creating a  composite CDC risk grade, similar to a bank’s CAMELS rating, to assess  the overall condition of a CDC. These grades would help communicate  to CDCs how they are doing with respect to the overall quality of their  operations, compliance, and portfolio risks. According to the OCRM  Director, SBA expects to fully implement SMART by June 1, 2014.
section_title: SBA’s Review of Key Requirements Is Not Yet Documented
paragraphs: As noted previously, OCRM currently uses two checklists to review loan  files as a part of its risk-based reviews. One checklist primarily focuses on  origination and routine servicing, while the other focuses on loan closing  and servicing of problem loans. However, OCRM’s current compliance file  review checklists do not require a review of documentation supporting the  numbers reported by CDCs for jobs created or supported. SBA officials  told us that in the past OCRM did not examine documentation supporting  jobs data, but that such a review would be included under the SMART  process. Based on our review of SBA’s draft SMART protocols, under the  Asset quality and servicing component OCRM staff are expected to  determine whether 504 projects meet specified economic development  goals and job opportunity criteria. Furthermore, under the Technical  issues and mission component, staff are expected to determine whether a  CDC’s loan portfolio meets the required minimum job opportunity  average. While some oversight has been built into the SMART guidance,  the guidance does not call for a review of documentation supporting the  jobs numbers.
OCRM’s current compliance file review checklists also do not require the  review of whether retained earnings were used in compliance with CDC  eligibility requirements. SBA staff told us that in the past OCRM did not  examine CDCs’ compliance with the requirement that CDCs retain excess  funds generated from the 504 loan program as a reserve for future  operations or for investment in other local economic development activity,  but that assessing compliance with this requirement would be included  under SMART. Based on our review of SBA’s draft SMART protocol,  under the Solvency and financial condition component OCRM is expected  to analyze whether the CDC has sufficient cash flow to support ongoing  operations and the reserve requirement. However, there is no specific  mention of verifying compliance with the retained-earnings requirement  concerning how the reserves can be used. According to federal internal  control standards, federal agencies should have control activities in place  to help ensure compliance with key requirements. Without documenting  in its examiner checklists or guidance that key requirements—such as the  jobs-supported and retained-earnings requirements—should be reviewed,  SBA cannot be assured that SBA and contractor staff are reviewing  compliance.
section_title: SBA Is Revising Its Corrective Action Process to Improve Review of Actions Taken
paragraphs: SBA is revising its corrective action process. According to the OCRM  Director, if SBA identifies weaknesses in a CDC’s operations during its  reviews, it may request that the CDC take corrective actions to address  the deficiencies. For instance, if SBA determines that a CDC’s credit  analysis is deficient, the CDC may be required to modify its process for  performing credit analyses. OCRM documents its review findings in a  report and notifies the CDC in writing if there is a need for corrective  actions. In its September 2012 report, SBA’s Inspector General reported  that SBA had closed out corrective actions related to the 7(a) program  without verifying their implementation and effectiveness. The Inspector  General recommended that SBA develop and implement a corrective  action follow-up process to require analysts to monitor lender progress in  implementing corrective actions and obtain and verify evidence from  lenders to ensure corrective actions have been effectively implemented  prior to close-out. While the Inspector General’s review pertained to the  7(a) loan program, the process in use at the time also was used for the  504 loan program. SBA officials told us they are in the process of  developing a new corrective action process to capture more specific  findings from reviews and to determine whether testing of a CDC’s  corrective responses is needed prior to the CDC’s next review. See table  4 for information on the number of reviews that required corrective actions  in recent years.
From October 1, 2010, through March 31, 2012, SBA identified some  frequently occurring findings, including inadequate verification of the  borrower’s contribution prior to closing, failure to meet Internal Revenue  Service tax transcript requirements prior to closing, and failure to assess  creditworthiness periodically. According to the OCRM Director, SBA  expects to complete the new processes for resolving corrective actions by  March 31, 2014.
section_title: Conclusions
paragraphs: SBA is developing new processes for monitoring 504 loan performance  and CDCs’ compliance with 504 requirements. However, SBA’s current  processes and planned improvements do not sufficiently address all  program requirements. Creating and retaining jobs is a key economic  development goal of the 504 program. While SBA has provided general  guidance to CDCs and its staff on compliance with this requirement, it has  not provided CDCs with specific guidance needed to consistently and  accurately compile and support jobs information. Further, SBA’s current  annual report review and risk-based review guidance do not require SBA  staff to request and review supporting documentation for CDC-reported  data on jobs supported or assess compliance with the requirement that  CDCs invest retained earnings in local economic development. Federal  internal control standards require agencies to establish control activities  to ensure that program participants report information accurately and  comply with requirements. Without developing guidance for CDCs and  reviewing at least some documentation on jobs data and compliance with  the retained-earnings requirement, SBA cannot be assured that self- reported information on jobs supported is consistent and accurate and  that CDCs are following program requirements.
In addition, while SBA has established multiple reviews for 504 loan  applications, the agency does not verify certifications made by CDCs with  ALP authority that borrowers are still able to repay a 504 loan at loan  closing, which can take place years after the loan was initially approved.  Again, federal internal control standards require agencies to have control  activities in place, such as verifying compliance with key requirements.  Annually since 2005, more 504 loans have been made using ALP  authority than regular authority, making the need for some review of these  certifications all the more important. Without verifying self-certifications  made prior to loan closings, SBA lacks assurance these CDCs are in  compliance with SBA credit analysis requirements established to help  protect against default risk.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that CDCs are meeting the 504 loan program’s jobs- supported requirement, we recommend that the SBA Administrator take  the following actions:
Develop specific guidance on how CDCs should compile information  on jobs created or retained and on the documentation CDCs should  maintain to support these data.
When reviewing CDCs’ annual reports, implement a process to  assess the supporting documentation for a sample of the jobs data  that CDCs report.
When finalizing the agency’s risk-based review procedures, include in  the checklists or guidance for examiners a requirement to review  supporting documentation on the number of jobs created or retained  by 504 loan projects.
To help ensure that CDCs are meeting the 504 loan program’s  requirement that CDCs invest retained earnings in local economic  development, we recommend that the SBA Administrator take the  following actions:
When reviewing CDCs’ annual reports, add an item to its annual  report review template requiring SBA staff to assess compliance with  this requirement.
When finalizing the agency’s risk-based review procedures, include in  the checklists or guidance for examiners a requirement to review  compliance with the retained-earnings requirement.
To help ensure that CDCs with ALP authority are taking the necessary  steps to determine whether there has been no adverse change to  borrowers’ financial condition prior to loan closing, we recommend that  the SBA Administrator include oversight of CDCs’ compliance with this  requirement in the agency’s process for renewing ALP authority.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments from SBA on a draft of this report, and the  agency provided written comments that are presented in appendix II. SBA  generally agreed with our recommendations and outlined steps it plans to  take to address them. In response to our recommendations regarding the  504 loan program’s jobs-supported requirement, SBA stated that it will (1)  work to provide guidance on the compilation of job creation and retention  information and document maintenance requirements and (2) consider  ways to phase in the implementation of jobs data sampling and review of  supporting documentation in its annual report and risk-based reviews. In  regard to our recommendations concerning the 504 loan program’s  retained-earnings requirement, SBA stated that a final rule discussing 504  loan program updates (not yet finalized at the time of SBA’s comment  letter) will require that a CDC’s annual report include a written report on  the CDC’s investments in local economic development. SBA stated that  after publication of the final rule, it plans to work to provide additional  guidance on the retained-earnings requirement and consider ways to  review compliance with this requirement in its annual report and risk- based reviews. In response to our recommendation regarding CDCs with  ALP authority, SBA stated that it will consider ways to review compliance  with the requirement to determine whether there has been an adverse  change to borrowers’ financial condition prior to loan closing during SBA’s  ALP renewal processes and risk-based reviews. As noted in the report, a  504 loan is not closed until after project-related construction is complete,  which can be up to 4 years after initial approval. Given that a borrower’s  financial condition can change over time, we reiterate the importance of  assessing CDCs’ compliance with this requirement.
SBA also provided several technical comments, which we incorporated as  appropriate. In one technical comment regarding our discussion of the  need for SBA to review some supporting documentation for jobs data  during its review of CDCs’ annual reports, SBA’s Associate Administrator  of the Office of Capital Access stated that validating job creation and  retention data can only occur following loan disbursement and is a  separate issue from the indicator on jobs supported that SBA includes in  its performance report. As we discuss in the report, SBA uses the data  captured in SBA’s loan application system at the time of loan approval  (which are estimates) when compiling the jobs supported indicator. CDCs’  annual reports contain both estimated and actual jobs data for 504 loan  projects. Therefore, adding reviews of supporting documentation for a  sample of jobs data—both actual and estimated—during the annual  report review process could also inform CDCs’ processes for compiling  estimates for jobs created or retained in their loan applications, and  provide better assurance that the data used for the jobs supported  indicator are supported.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to SBA and  interested congressional committees. The report also will be available at  no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  William B. Shear at (202) 512-8678 or shearw@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to examine (1) the lending standards and  performance indicators that the Small Business Administration (SBA) has  established to help ensure that loans meet key requirements, as well as  504 loan program performance, (2) the extent to which SBA has  implemented procedures to help ensure that certified development  companies (CDC) are eligible to participate in the program and that loan  applications comply with program requirements, and (3) the extent to  which SBA has implemented procedures to monitor CDC compliance with  program requirements.
To address these objectives, we reviewed relevant laws and regulations;  GAO and SBA Inspector General reports; SBA guidance for the 504 loan  program, including Standard Operating Procedures (SOP), the form used  to apply for 504 loans, and checklists for different SBA processes; and  internal SBA guidance for its staff and examiners. We interviewed  relevant staff at SBA, the National Association of Development  Companies (the trade association for the 504 loan program), and staff  from 10 CDCs. We selected these CDCs to ensure a range of CDCs  based on factors such as size and geographic location. Specifically, we  selected one CDC from each of SBA’s 10 regions based on loan portfolio  size. We used the five peer groups that SBA uses for monitoring  purposes to establish which CDCs were large versus small. To ensure a  mix of large and small CDCs and geographic locations, we selected 7  large CDCs from the regions with the largest 504 loan portfolios and 3  small CDCs from the regions with the smallest 504 loan portfolios. As a  secondary measure, we considered the default rates, as calculated by  GAO, of the selected CDCs to ensure that we selected CDCs that had a  mix of default rates. Five of the 10 CDCs had default rates below 10  percent, and 5 had default rates of 12 percent or higher. Due to ongoing  litigation related to a subset of CDCs known as Premier Certified Lenders,  we did not assess loans made using the specific additional authority that  SBA may provide to these lenders.
To respond to our first objective, we reviewed relevant laws, regulations,  and SOPs to identify SBA’s lending standards and servicing policies. We  then compared SBA’s guidance on compiling data on jobs created and  retained with 504 loan funds to federal internal control standards. We  also reviewed SBA’s annual performance reports for fiscal years 2010  through 2012 to identify SBA’s performance measures for the 504 loan  program and assessed whether they addressed the program’s economic  development goals and were consistent with GAO standards for  performance measurement. In addition, we reviewed documentation on  SBA’s processes for reviewing and validating its performance indicators.
We also analyzed 504 loan data for fiscal years 2003 through 2013 (as of  Mar. 31, 2013) to determine the composition and performance of the  current 504 loan portfolio. For example, we analyzed default rates (the  number of 504 loans whose debentures were purchased divided by the  total loans approved in that fiscal year) and 18-month default rates for  loans approved in fiscal years 2003 through 2012. We only analyzed  loans that were approved as of March 2013 and had been disbursed.  According to SBA, the 18-month default rate is an indicator of default  primarily due to poor underwriting. We also calculated default rates  weighted by the approved values of loans and found the rates  comparable to the rates discussed above.
For context, we reviewed Moody’s/REAL Commercial Property Price  Index data for 2002 through 2010 on commercial real estate values. We  also compared 504 loan data to Federal Deposit Insurance Corporation  quarterly analysis of Federal Financial Institutions Examination Council  call report data on nonaccrual rates for commercial loans, specifically  construction and development loans and real estate loans. We  calculated the nonaccrual rate for commercial loans as the percentage of  loan dollars in nonaccrual status. Loans in nonaccrual status are  generally loans that are maintained on a cash basis because of the  deterioration in the financial condition of the borrower and for which  principal or interest has been in default for at least 90 days (unless the  loan is in “the process of collection” and “well secured”) or payment in full  is not expected. We divided the dollar value of loans in nonaccrual status  by the total amount of outstanding loan dollars for the quarter of that  calendar year. We used nonaccrual status as a trend comparison  because it was the weakest category of loans and most similar to  purchases made by SBA. In order to compare 504 loan data with this  rate, we calculated the percentage of defaulted 504 loans that were  disbursed within the past 2 years for each quarter of the calendar year.  However, while trends may be compared, levels of nonaccrual rates and  SBA default rates may not be compared as SBA data represent early  defaults only and the call report data represent nonaccruals for total  outstanding loans. We also compared 504 loan default rates and 18- month default rates by geographic location by analyzing these rates for  loans based on the location of CDCs making the loans. This analysis  covers all states with CDCs, the District of Columbia, and Puerto Rico.  (There is no CDC located in Alaska.) To assess the reliability of the SBA  loan-level data, we interviewed SBA representatives from the Office of  Performance and Systems Management about how they collected the  data and helped ensure data integrity. We also reviewed documentation  about the sources of the data and performed electronic testing to detect  errors in completeness and reasonableness. We determined that the data  were sufficiently reliable for the purpose of reporting on portfolio  composition and performance. To assess the reliability of the  Moody’s/REAL Commercial Property Price Index and Federal Deposit  Insurance Corporation quarterly analysis of call report data we used, we  reviewed prior GAO assessments of the reliability of this data. We  determined the data were sufficiently reliable for the purpose of  comparing trends in related private sector loan program performance and  SBA 504 loan program performance.
To respond to our second objective, we identified SBA’s compliance  processes for overseeing CDC eligibility and loan approval. To determine  whether SBA had implemented compliance procedures to help ensure  that CDCs are eligible and that loan applications comply with program  requirements, we reviewed (1) checklists SBA uses to review CDCs’  eligibility and renew CDCs’ Accredited Lenders Program (ALP) authority,  (2) the template used to review CDCs’ annual reports, (3) checklists used  to review applicant eligibility and creditworthiness, and (4) checklists used  to conduct Abridged Submission Method (ASM) audits. We also reviewed  the data on these processes, including the results of SBA’s loan  application review processes for fiscal years 2010 through 2013 and  results of ASM audits performed between January 2011 and August 2013  to determine whether SBA was performing these audits as required and  review their results. We assessed the reliability of the data on these  processes by interviewing officials knowledgeable about the data and  determined that they were sufficiently reliable for the purpose of  discussing the results of SBA’s compliance processes. We also reviewed  504 loan data on the amounts of loans made with ALP authority versus  regular authority from fiscal years 2003 through 2012. These data came  from the same SBA data system as the set of 504 loan data discussed  previously, which we found reliable for the purposes of this report. Finally,  we assessed whether the above processes were consistent with federal  internal control standards.
To respond to our third objective, we assessed SBA’s monitoring of  CDCs’ compliance with program requirements. To determine whether  SBA implemented compliance procedures to monitor CDC compliance,  we reviewed documentation on SBA’s (1) CDC risk-rating processes; (2)  previous compliance processes as represented in relevant SOPs and  other guidance; and (3) new preliminary “SMART” approach to monitoring  CDCs, including risk-based review checklists, draft protocols, preliminary  benchmarks, and CDC profile assessment templates. We also reviewed  the data on these processes, including data on lender risk ratings as of  September 2013 and the results of SBA’s risk-based reviews from fiscal  years 2007 through 2012, to assess the extent to which SBA was  implementing its compliance processes. We assessed the reliability of  these data by interviewing officials knowledgeable about the data and, in  some cases, reviewing documentation about the sources of the data. We  determined that they were sufficiently reliable for the purpose of  discussing the results of SBA’s compliance processes. Finally, we  compared SBA compliance processes to federal internal control  standards.
We conducted this performance audit from January 2013 to March 2014  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Small Business Administration
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact above, Andrea (Paige) Smith (Assistant  Director), Allison Abrams, Benjamin Bolitzer, Pamela Davidson, Rachel  DeMarcus, Yola Lewis, Daniel McKenna, Marc Molino, Patricia Moye, and  Jennifer Schwartz made key contributions to this report.