Small Business Administration: Actions Needed to Provide More Timely Disaster Assistance
Published: 2006-07-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused more than $118 billion in estimated property damages across the Gulf Coast region in 2005. The Small Business Administration (SBA) helps individuals and businesses recover from disasters through its Disaster Loan Program. GAO initiated work to determine how well SBA provided victims of the Gulf Coast hurricanes with timely assistance. This report, the first of two, focuses primarily on the Disaster Credit Management System (DCMS) and disaster loan process. Here, GAO evaluates (1) what affected SBA's ability to provide timely disaster assistance and (2) actions SBA took after the disasters to improve its response to disaster victims. In conducting this study, GAO analyzed data on loan applications and assessed key aspects of SBA's acquisition and implementation of DCMS.
section_title: What GAO Found
paragraphs: Although DCMS provided SBA with a number of benefits, several factors affected SBA's ability to provide timely disaster assistance to victims of the Gulf Coast hurricanes. First, the large volume of applications SBA processed greatly exceeded any previous disaster, including the 1994 Northridge earthquake--the largest single disaster SBA previously faced. Second, SBA primarily used this earthquake as the basis for planning the maximum user capacity for DCMS and did not consider information available from catastrophe risk modeling firms and disaster simulations, such as the likelihood and severity of damages from potential catastrophes, to help predict the expected application volume from such events. SBA's limited planning contributed to insufficient DCMS user capacity, which restricted the number of staff that could access the system and process the large volume of applications in a timely manner. SBA also did not receive the correct computer hardware from its contractor, and the agency did not completely stress test DCMS before implementation, which contributed to the system instability, outages, and slow response times initially experienced by SBA staff. As a result of these and other factors, SBA faced significant delays and backlogs in processing loan applications, as depicted in the figure below. This backlog peaked at more than 204,000 applications 4 months after Hurricane Katrina. As of May 27, 2006, SBA processed applications, on average, in about 74 days compared with its goal of within 21 days. Some of the actions SBA took after the Gulf Coast hurricanes helped to improve its response to disaster victims. For example, SBA addressed system-related issues by increasing the number of users that could access DCMS, and it plans to further increase the system's maximum user capacity. SBA implemented other initiatives that had limited success. For example, SBA made only a few loan guarantees under its Gulf Opportunity Pilot Loan Program for small businesses in communities affected by the disasters. SBA would benefit by expediting its planned business process reengineering efforts to analyze ways to more efficiently process loan applications, such as implementing a secure Internet-based application feature for home loan applicants.

section_title: Letter
paragraphs: In 2005, Hurricanes Katrina, Rita, and Wilma battered the U.S. Gulf Coast  region, causing more than $118 billion in estimated property damages and  over 1,400 deaths. As the federal government’s primary lender to victims of  disasters, the Small Business Administration (SBA) provides financial  assistance through its Disaster Loan Program to help homeowners, renters,  and businesses of all sizes recover from disasters such as earthquakes,  hurricanes, and terrorist attacks. In this capacity, SBA plays a crucial role  in the long-term recovery of the Gulf Coast region. Nine months following  Hurricane Katrina, SBA had approved more than 148,700 disaster  assistance loans totaling $9.7 billion to individuals and businesses that  suffered losses from the Gulf Coast hurricanes. However, Congress and  press reports have expressed concerns that SBA’s response has been slow,  leaving many disaster victims without the timely assistance that they  needed.
In January 2005, SBA began using its new Disaster Credit Management  System (DCMS) to process loan applications for all new disaster  declarations. SBA intended for DCMS to improve the quality and timeliness  of its disaster loan process and enhance its overall response to disasters  compared with SBA’s previous system. However, after the Gulf Coast  hurricanes, both press reports and Congress were critical of DCMS, citing  system outages and slow response times as contributing to delays that  disaster victims experienced in receiving assistance. We have prepared this  report under the Comptroller General’s authority to conduct evaluations on  his own initiative as part of a continued effort to assist Congress in  reviewing how well SBA provided victims of the Gulf Coast hurricanes with  timely assistance. In this report, we evaluate: (1) what affected SBA’s ability  to provide timely disaster assistance and (2) the actions SBA took after the  disasters to improve its response to disaster victims. This report focuses  primarily on DCMS and the disaster loan process. We plan to issue a  subsequent report that focuses on other factors not related to DCMS or the disaster loan process that may have affected SBA’s ability to provide timely  assistance.
In conducting this review, we visited the Gulf Coast region to observe  conditions and meet with federal, state, and local officials and victims of  the disasters. We obtained documents related to SBA’s disaster lending  policy and procedures and SBA’s acquisition and implementation of DCMS.  We also obtained and analyzed SBA’s data on disaster loan applications  processed through May 27, 2006. In addition, we interviewed officials from  SBA’s headquarters and its two Field Operations Centers in California and  Georgia, Customer Service Center in New York, and Processing and  Disbursement Center (PDC) in Texas. See appendix I for a detailed  description of our scope and methodology. We conducted our work  between November 2005 and July 2006 in accordance with generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: The Gulf Coast hurricanes collectively represented the most costly natural  disaster in recent U.S. history. As table 1 shows, the estimated property  damage from these hurricanes exceeded $118 billion, nearly five times  greater than the damage from the 1994 Northridge earthquake and more  than two and one-half times greater than the damage from the 2004 Florida  hurricanes. Hurricane Katrina was the first of these disasters, causing  fatalities and damage in southern Florida in late August 2005 before  striking the northern Gulf Coast region. This region received the brunt of  the storm, including extensive damage and significant loss of life in  Louisiana and Mississippi. Damage from Hurricane Katrina also extended  into the Florida panhandle, Georgia, and Alabama and covered  approximately 90,000 square miles—an area larger than the size of Great  Britain. Hurricane Rita was the next disaster to strike the Gulf Coast  region, making landfall near the Texas and Louisiana border on September  24, 2005, and causing a wide swath of damage from eastern Texas to  Alabama, flooding some areas in Louisiana that had already been impacted  by Hurricane Katrina about 1 month earlier. Hurricane Wilma was the last  of these disasters to strike the region, making landfall in southern Florida  on October 24, 2005, and inflicting widespread damage across the state.
The federal government provides funding and assistance after disasters  through a variety of agencies and programs. Congress created FEMA to  coordinate response and recovery efforts under presidential disaster  declarations. FEMA works with other federal, state, and local agencies to  assist victims after major disasters, and volunteer organizations such as the  American Red Cross also participate in these efforts. Following a  presidential disaster declaration, FEMA will open Disaster Recovery  Centers where disaster victims can meet with representatives, obtain  information about the recovery process, and register for federal disaster  assistance. Victims may also register with FEMA by telephone or via  FEMA’s Internet site. FEMA provides housing assistance to disaster victims  through the Individuals and Households Program (IHP). Under the IHP,  FEMA can make grants available to repair or replace housing damaged in a  disaster that is not covered by insurance. However, the IHP is a minimal  repair program that is designed to make the victim’s home habitable and  functional, not to restore the home to its predisaster condition. When  disaster victims register for FEMA assistance, they are asked to provide  their approximate household income. If the applicant’s income exceeds  certain thresholds, FEMA automatically refers them to SBA’s Disaster Loan  Program.
SBA’s Disaster Loan Program is the primary federal program for funding  long-range recovery for private sector, nonfarm disaster victims and the  only form of SBA assistance not limited to small businesses. The Small  Business Act authorizes SBA to make available the following two types of  disaster loans:  Physical disaster loans—These loans are for permanent rebuilding and  replacement of uninsured or underinsured disaster-damaged property.  They are available to homeowners, renters, businesses of all sizes and  nonprofit organizations. These loans are intended to repair or replace  the disaster victim’s damaged property to its predisaster condition.
Economic injury disaster loans—These loans provide small businesses  with necessary working capital until normal operations resume after a  disaster declaration. They cover operating expenses the business could  have paid had the disaster not occurred. The act restricts economic  injury disaster loans to small businesses only.
Under a presidential disaster declaration, SBA disaster assistance staff  members secure space within FEMA—established Disaster Recovery  Centers and begin meeting with victims to explain the agency’s disaster  loan process, issue loan applications and, if requested, assist victims in  completing applications. Figure 1 illustrates SBA’s disaster loan process.
During the application entry stage, SBA screens all incoming applications  to determine if they are acceptable. In addition, SBA conducts a  preliminary financial analysis of home loan applications to determine  whether the applicant’s income falls below the agency’s minimum income  thresholds or if repayment ability is evident based on a review of the  applicant’s gross income and fixed debts. SBA declines home loan  applicants that do not meet its minimum income requirements or  demonstrate repayment ability. SBA also obtains a credit bureau report for  business and home loan applicants, and SBA may decline an applicant  based on information contained in the report. SBA refers to denials made  during the application entry stage as preprocessing declines. SBA intended  for these declines to eliminate delays in notifying applicants about loan  denials. SBA will refer most home loan applicants denied a loan to FEMA  for possible grant assistance under a presidential disaster declaration.  After the application entry stage, applications move to the loss verification  stage, and SBA staff members scan application documents into DCMS.
During the loss verification stage, loss verifiers conduct on-site damage  inspections for physical disaster loan applications to estimate the cost of  restoring damaged property to predisaster condition. Loss verifiers use  tablet personal computers with software tailored to complete and submit  reports electronically into DCMS. The verified loss becomes the basis for  the loan amount. Once the loss verification is complete, an application  moves to the application processing stage, where loan officers check for  duplication of benefits and assess the applicant’s credit history and ability  to obtain credit elsewhere. Loan officers also examine other applicant  eligibility criteria, including compliance with child support obligations and  history on other federal debt, such as student loans. Loan officers use a  financial analysis tool within DCMS to determine if the applicant has the  ability to repay the loan. As with preprocessing declines, SBA generally  refers home loan applicants denied a loan in application processing to  FEMA for possible grant assistance under presidential disaster  declarations.
For secured loans, legal staff members review the draft loan authorization  and agreement for sufficiency of collateral instruments and other legal  concerns. They also create a loan closing checklist—a list of the  requirements necessary to generate the loan closing and other legal  documents. Attorneys enter a legal concurrence into DCMS, which  obligates the loan funds through an interface with SBA’s accounting  system. Legal support staff members prepare closing documents and mail  them to the applicant or nearest Disaster Recovery Center. SBA can make a  maximum initial disbursement, without collateral, of up to $10,000 for  physical disaster loans and $5,000 for economic injury disaster loans, once  the agency receives signed closing documents from the applicant. SBA can  make a maximum initial disbursement of up to $25,000 for physical disaster  loans with collateral—preferably real estate. SBA generally makes  subsequent disbursements on physical disaster loans based on the  applicant’s needs and how they spent prior disbursements.
DCMS replaced SBA’s largely manual, paper-based loan process and its  Automated Loan Control System (ALCS), which it had used since the early  1990s. ALCS enabled SBA to track the movement of paper loan application  files from one stage of the process to another, but the manual loan process  required the movement and storage of large volumes of paper. In December  1998, SBA began planning for a replacement disaster loan system. SBA  purchased a commercial-off-the-shelf package as the foundation for DCMS  in 2003 and had the package customized. SBA intended for DCMS to help it  move toward a paperless processing environment by automating many of  the functions staff members had performed manually, such as obtaining  FEMA referral data and credit bureau reports, as well as completing and  submitting loss verification reports from remote locations. SBA began a  phased implementation of DCMS in November 2004 at its former Niagara  Falls Disaster Area Office (DAO). In January 2005, SBA began using  DCMS to process loan applications for all new disaster declarations and by  March 2006, SBA completed the migration of all data for disaster loan  applications processed since 2000 from ALCS to DCMS. According to SBA,  the cost for planning, acquiring, implementing, and operating DCMS totaled  about $32 million through April 2006. See appendix II for a more detailed  discussion of SBA’s acquisition and implementation of DCMS.
section_title: Large Volume of Applications, Limited Planning, and Various System and Processing Related Challenges Affected SBA’s Ability to Provide Timely Disaster Assistance
paragraphs: We identified several factors that affected SBA’s ability to provide timely  disaster assistance, including a large volume of applications that exceeded  any previous disaster. In addition, although DCMS allowed SBA to  streamline the disaster loan process, SBA focused only on its historical  experience and did not consider the possibility of a single or series of  disasters of the magnitude of the Gulf Coast hurricanes when planning the  system’s maximum user requirements. SBA’s limited planning contributed  to insufficient DCMS user capacity, which restricted the number of staff  that could access the system and process the large volume of applications  in a timely manner. Further, SBA did not completely stress test DCMS  before implementation to help ensure that it could function at its maximum  user capacity and thus did not detect that the wrong processors had been  installed by its hosting contractor and that the system could not support  planned capacity. As a result of these and other processing-related factors,  SBA experienced significant backlogs and delays in processing  applications. Overall, SBA processed disaster loan applications in 74 days,  on average, as of May 27, 2006, compared with its goal of within 21 days.
subsections: section_title: Large Volume of Loan Applications Affected SBA’s Response to Hurricane Victims
paragraphs: According to SBA officials, the large volume of disaster loan applications it  processed for victims of the Gulf Coast hurricanes was a significant  challenge. The volume of applications associated with these hurricanes  greatly exceeded any disaster in SBA’s history. As table 2 shows, as of May  27, 2006, SBA had issued more than 2.1 million applications to victims  affected by the Gulf Coast hurricanes. This represented almost four times  as many applications as SBA issued to victims of the Northridge  earthquake—the single largest disaster SBA had previously faced. In  addition, our analysis showed that SBA received a large influx of  applications during the initial months following Hurricane Katrina—at the  same time that SBA hired and trained a large number of temporary staff to  process applications received from victims of the disasters. Specifically,  SBA received about 280,000 applications during the first 3 months  following Hurricane Katrina, approximately 30,000 more applications than  SBA received over a period of about 1 year from victims of the Northridge  earthquake.
SBA officials told us that the large volume of applications that it mailed and  received resulted in part from the large number of referrals FEMA made to  SBA’s Disaster Loan Program without applying SBA’s income thresholds,  specifically for disaster victims who registered for disaster assistance via  FEMA’s Internet site and did not report any income. According to a FEMA  official, disaster victims who register via FEMA’s Internet site can select the  “Income Unavailable/Refused” option if they do not wish to or cannot  provide their income. The official stated that these individuals are advised  that selecting this option will result in an SBA referral. The FEMA official  also stated that, per an SBA request, FEMA refers all applicants who claim  self-employment as their primary source of income to SBA’s Disaster Loan  Program, regardless of their income, because the income tests are not a  valid measure of repayment ability for self-employed applicants. In both  cases, FEMA’s registration system automatically fills $0 as the disaster  victim’s income and refers these individuals to SBA’s Disaster Loan  Program. The FEMA official stated that about 17 percent of the individuals  referred to SBA for Hurricanes Katrina and Rita refused to provide their  income, and another 17 percent indicated that they were self-employed.  SBA officials referred to these cases as “$0 income” referrals.
In February 2006, SBA’s Office of Inspector General issued an advisory  memorandum, stating that many $0 income referrals ultimately failed SBA’s  criteria for disaster loan eligibility and were processed as declines. SBA’s  Office of Inspector General added that these referrals impacted SBA by  increasing the cost incurred by SBA in mailing loan applications to  disaster victims that normally would not be referred to SBA’s Disaster  Loan Program;  delaying response times for those applicants who did qualify for SBA’s   lowering SBA’s disaster loan approval rates; and  increasing the transaction flow through DCMS, which was near  maximum capacity.
SBA’s Office of Inspector General recommended that SBA improve its  screening processes within DCMS when processing $0 income referrals  and work with FEMA to reduce unnecessary online disaster referrals. In  commenting on a draft of the advisory memorandum, SBA agreed that it  should work with FEMA to improve their joint screening process prior to  referral and issuing an SBA disaster loan application.
section_title: Limited Planning for DCMS User Capacity Reduced SBA’s Ability to Provide Timely Disaster Assistance
paragraphs: DCMS provided SBA with a number of benefits compared with its previous  system, such as the capability to complete loss verification reports and  other processing-related tasks electronically. However, SBA planned  DCMS’s maximum user capacity based solely on the volume of applications  it received from victims of the Northridge earthquake and its other  historical data; it did not consider the information available from  catastrophe risk modeling firms or disaster simulations such as the  likelihood and severity of damages from potential catastrophes. Although  agencies are not specifically required to consider such information in  developing their system’s user capacity requirements, this information  could have helped SBA predict the volume of loan applications to expect  and the necessary user capacity needed to process such a volume. SBA  officials acknowledged that they could have considered this information in  planning DCMS’s user capacity requirements but lacked the funding to do  so. SBA’s limited planning and other system and processing related issues  diminished the agency’s ability to provide disaster assistance in a timely  manner.
Many insurance companies and government agencies currently use  computer programs offered by several modeling firms to estimate the  financial consequences of various natural catastrophe scenarios. Risk  modeling firms, which have existed since the late 1980s, rely on  sophisticated mathematical modeling techniques and large databases  containing information on past catastrophes, population densities,  construction techniques, and other relevant information to assess the  severity of potential catastrophes so that other organizations can plan  accordingly. For example, one modeling firm recently estimated that 1.5  million people were vulnerable to an earthquake on the San Andreas Fault  in the San Francisco area and that an earthquake similar to the 1906  earthquake would cause an estimated $260 billion in damages to residential  and commercial properties. This study also noted that the U.S. Geological  Survey estimated that there was a 21 percent probability of a major  earthquake on this fault occurring before 2032. Another modeling firm  study of a strong hurricane striking the densely populated Northeast region  estimated this event could cause more than $200 billion in economic losses,  including significant damage from flooding to properties and infrastructure  in lower Manhattan and Long Island. While SBA would not utilize this  information the way insurance companies do to assess the financial  consequences of potential disasters, catastrophe risk modeling firms  provide important information on the severity of damages from such  events. This information could be helpful in estimating the potential  number of loan applications that SBA could receive for processing and the  concurrent user capacity necessary to process such applications in a timely  manner if such an event were to occur.
Government agencies and other organizations also participate in disaster  simulation exercises to prepare for their response to natural disasters.  While SBA would not use this disaster simulation information to plan a  response to victims’ immediate needs, the estimated number of buildings  damaged and number of people evacuated provides important information  that can be considered in planning the user capacity of a disaster loan  system. For example, FEMA brought together numerous officials from  local, state, federal, and volunteer organizations to conduct an exercise  referred to as Hurricane Pam in July 2004. This exercise used realistic  weather and damage information developed by the National Weather  Service, the U.S. Army Corps of Engineers, the Louisiana State University  Hurricane Center, and other state and federal agencies to help officials  develop joint response plans for a catastrophic hurricane in Louisiana. This  fictional hurricane brought sustained winds of 120 miles per hour, up to 20  inches of rain in parts of southeast Louisiana, and storm surge that topped  levees in the New Orleans area. Hurricane Pam, as projected, destroyed  between 500,000 and 600,000 buildings and forced the evacuation of more  than 1 million residents from the New Orleans area.
In planning the maximum user capacity for DCMS, SBA relied solely on the  volume of applications it received from victims of the Northridge  earthquake and its other historical data, such as the average number of  applications processed for the previous 5 years. SBA did not plan for the  likelihood of a single disaster or series of disasters of the magnitude of the  Gulf Coast hurricanes. If SBA had considered the information available  from catastrophe risk modeling firms or disaster simulations, such as the  likelihood and potential damages from catastrophic events, to help it  predict the volume of loan applications that might be expected and the user  capacity needed to process this volume, the agency may have acquired  additional capacity that would have enabled it to reduce its backlog of  applications sooner. SBA’s limited planning contributed to insufficient  DCMS user capacity, which restricted the number of staff that could access  the system and process the large volume of applications in a timely manner.
section_title: Ineffective Technical Support Affected the Stability of DCMS and SBA’s Ability to Provide Timely Disaster Assistance
paragraphs: SBA experienced instability with DCMS during the initial months following  Hurricane Katrina, as users experienced outages, difficulties connecting to  the system, and slow response times in completing loan processing tasks.  For example, our review of DCMS system logs showed that between  September and December 2005 SBA experienced the following incidents:  19 incidents where DCMS was not available to all system users due to an  unscheduled outage, and  26 incidents where DCMS was not available to various units due to an  unscheduled outage.
SBA officials told us that the longest period of time DCMS was unavailable  to users due to an unscheduled outage was 1 business day. These  unscheduled outages and other system-related issues slowed productivity  and affected SBA’s ability to provide timely disaster assistance; however,  we could not determine the specific impact on the agency’s time frames for  processing disaster loan applications received from Gulf Coast hurricane  victims.
According to SBA officials, ineffective technical support contributed to the  system instability experienced by users, as its hosting contractor did not  properly monitor the DCMS network as contractually required and did not  make the agency aware of incidents that could make the system unstable  prior to DCMS users being affected. In addition, SBA officials told us that  its hosting contractor did not provide the agency with the correct computer  hardware for DCMS as contractually required, which further contributed to  the instability users initially experienced with the system and reduced  processing power by about one-third. Specifically, in developing DCMS,  SBA planned for a maximum capacity of 1,500 concurrent users. SBA  officials told us that they discovered that DCMS was operating near 100  percent capacity in September 2005 before the agency had reached its  maximum user capacity. At that time, SBA discovered that the hosting  contractor had not provided the agency with the correct computer  hardware required per its contract in order to support 1,500 concurrent  users.
However, SBA did not verify that its hosting contractor provided the  agency with the correct computer hardware specified in its contract.  Federal procurement policies require agencies to have trained and  experienced officials available to judge whether contractors are  performing according to contract terms and conditions, particularly when  contracting for highly specialized or technical services. In addition, SBA’s  internal procurement procedures require that the agency inspect each item  or service provided under a contract, report capital equipment acquisitions  immediately—including computer equipment, and provide a serial number  for capital equipment acquisitions for tracking purposes. SBA officials did  not have an explanation for why the agency did not verify that the hosting  contractor provided the correct computer hardware. If SBA had verified  this equipment as required, the agency might have discovered this issue  prior to the Gulf Coast hurricanes and been able to take the appropriate  corrective action.
section_title: SBA Did Not Completely Stress Test DCMS to Ensure It Could Function at Maximum Capacity
paragraphs: Prior to implementation, SBA did not completely stress test DCMS to  ensure that the system could operate effectively at maximum capacity,  which contributed to the initial system instability SBA experienced. In  2003, SBA began testing various aspects of DCMS, including the core  application interfaces and additional components such as loss verification  and scanning. Although SBA conducted performance testing for DCMS, we  found that the agency only stress tested the system for up to 120  concurrent users due to limitations with the hardware in the testing  environment. The testing environment simulated an increasing number of  concurrent users and exercised different functional scenarios, but the  hardware used in the simulation reached its capacity earlier than  anticipated. Even if the testing environment functioned as planned, an  estimate showed that DCMS could accommodate approximately 600  concurrent users at this time—significantly less than the system’s planned  maximum capacity of 1,500.
According to leading information technology organizations, to be effective,  practices for testing software should be planned and conducted in a  structured and disciplined environment. Typically, this involves testing  increasingly larger increments of a system until the complete system and  all of its functionality are tested and accepted. It also involves stress testing  and fully demonstrating the effectiveness and accuracy of the system.  Additionally, SBA’s internal systems development manual requires that the  agency determine testing and acceptance criteria that must be met for a  system to be accepted as “fit for use” by the user or sponsoring  organization and requires user or sponsoring organization approval of all  acceptance criteria. Further, the manual identifies how acceptance testing  is to be conducted and reported to determine whether the system meets its  requirements upon completion of its development. In doing limited stress  testing of DCMS, SBA did not completely follow its own requirements or  industry best practices for systems testing. When these requirements are  not met, there is potential risk that the implemented system will not meet  the system requirements. If SBA had conducted complete stress testing, the  agency might have detected that it did not receive the correct equipment  and had an opportunity to address this issue before implementing DCMS.
section_title: Other Processing Related Challenges Affected SBA’s Ability to Provide Timely Disaster Assistance
paragraphs: Because of the unpredictable nature of disasters and the cost of  maintaining staff that it might not need, SBA hires and trains a large  number of temporary staff to help process loan applications following any  large scale disaster, such as the Gulf Coast hurricanes. SBA also has a  disaster reserve corps, a group of experienced individuals it relies upon  who have worked with the agency in responding to previous disasters and  are trained in its disaster loan process. SBA officials told us that it generally  took approximately 30 days for loan officers without prior SBA experience  to become fully productive. This slows processing during the initial months  following a disaster, as loan officers become familiar with SBA’s disaster  loan process and DCMS. In response to the Gulf Coast hurricanes, SBA also  had to secure additional space and equipment to support loan processing.  According to SBA officials, this process took approximately 30 to 60 days.  As figure 2 shows, as the average number of loan processing staff  increased, SBA generally processed more applications than it did during  the first 2 months following Hurricane Katrina.
Because SBA normally relies on temporary staff to help process loan  applications after large disasters, it might be unrealistic to expect the  agency to process a large volume of applications quickly during the initial  period following such disasters.
The geographic dispersion of disaster victims—in particular for Hurricanes  Katrina and Rita—also affected SBA’s ability to provide timely disaster  assistance. Figure 3 illustrates the location of displaced applicants affected  by these disasters that registered for FEMA IA. These applicants relocated  to all 50 states, with the largest concentrations in Louisiana, Mississippi,  and Texas. SBA officials told us that FEMA referred many of these  applicants to its Disaster Loan Program, and their widespread geographic  dispersion made it more challenging to provide timely disaster assistance.  Loan officers we met with also told us that contacting applicants to discuss  the status of their loan application was difficult in some cases—particularly  during the initial months following the disasters, as some applicants had  moved or changed employment several times since applying for disaster  assistance. Thus, SBA did not always have an applicant’s most current  information, which slowed the processing of their application.
section_title: As a Result of These Factors, SBA Did Not Significantly Reduce Its Backlog of Applications until Several Months after Hurricane Katrina
paragraphs: Our analysis showed that it took SBA several months to significantly  reduce the backlog of applications that developed in various stages of its  disaster loan process because of the large volume of applications, limited  planning for DCMS, and other processing-related challenges. For example,  SBA did not clear the backlog in the application entry stage until nearly 3  months following Hurricane Katrina. SBA nearly cleared the backlog in the  loss verification stage 8 months after the disaster when the backlog was  reduced to less than 1,800 applications. However, at that time, SBA still  needed to complete loan processing for about 25,000 applications.
As figure 4 shows, SBA’s backlog in the loss verification and application  processing stages increased significantly during the first 3 months  following Hurricane Katrina as SBA began receiving a large volume of  applications from victims of the other hurricanes. These backlogs  combined peaked at over 204,000 applications in late December 2005.  Figure 4 also shows that, individually, SBA’s backlog in the loss verification  stage peaked at almost 129,200 applications about 3 months following  Hurricane Katrina, and the backlog in the application processing stage  peaked at more than 121,700 applications nearly 6 months after the  disaster. As a result of the backlogs, victims of the Gulf Coast hurricanes  waited about 74 days on average for SBA to process their loan applications,  compared with the agency’s goal of within 21 days.
Figure 5 shows SBA’s average processing time frames for approval and  decline decisions made between mid-October 2005 and May 2006 compared  with its goal of within 21 days. Although SBA began to reduce the total  backlog in loss verification and application processing in late December  2005, average processing time frames for approval and decline decisions  generally increased through May 2006 because of the average age of  applications in the backlog. For example, SBA reduced the backlog in  application processing to less than 4,500 by late May 2006; however,  average processing time frames were still significantly higher than its goal  because loan applications had been in the application processing queue for  a long time—about 63 days on average.
SBA’s processing average for approvals does not include additional time  frames for loan closings and initial disbursements. For example, SBA  received signed closing documents from borrowers about 35 days, on  average, after making the approval, as of May 27, 2006. According to SBA  officials, delays in closing loans were mostly the result of factors beyond  their control. For example, SBA officials stated that they scheduled loan  closings at the convenience of the borrower. These officials added that  because of the displacement of Gulf Coast hurricane victims, SBA had  closed about 50 percent of disaster loans by mail, a higher percentage than  previous disasters, which generally takes more time than closings done in  person. SBA officials also stated that there were a significant number of  disaster victims who had not returned to the affected area and who had  expressed uncertainty about rebuilding their homes and businesses. As a  result, these victims had been reluctant to quickly close on their loans.  SBA’s disaster lending procedures generally require applicants to close  loans within 60 days of the date on the loan authorization and agreement.  These procedures also allow SBA to accept loan closing documents after 60  days on a discretionary basis. SBA officials told us they had allowed Gulf  Coast hurricane victims additional time to determine if they really wanted  the loan. To facilitate loan closings, SBA officials also told us they used  staff to conduct follow-up calls with borrowers after closing documents  were mailed.
In addition, our analysis of an SBA data extract further showed that the  agency made an initial disbursement for approved loans on average about 9  days after the receipt of closing documents. As of May 27, 2006—9 months  after Hurricane Katrina—SBA had disbursed about $1.4 billion or 14  percent of the $9.7 billion approved loan dollars. As of the same date, about  73,000 approved loans had not been fully disbursed to disaster victims. As  with loan closings, SBA officials stated that the length of time it took to  disburse disaster loans was primarily determined by the borrower. SBA’s  disaster lending procedures require borrowers to arrange for and obtain all  loan funds within 12 months from the date of the loan agreement. However,  SBA officials told us that it might be difficult for some disaster victims to  meet this requirement. In our subsequent report on SBA’s response to the  Gulf Coast hurricanes, we plan to discuss the perspectives of disaster  victims related to the disaster loan process.
section_title: SBA’s Actions after the Gulf Coast Hurricanes Had Varying Degrees of Success
paragraphs: Although SBA took several actions after the Gulf Coast hurricanes to  improve its response to disaster victims, our analysis showed that some of  these actions were more successful at reducing the backlog of loan  applications than others. For example, SBA increased the number of  concurrent users that could access DCMS by acquiring additional computer  hardware and adding a second work shift for loan processing staff to better  balance the system’s workload. In addition, SBA initiatives to relax filing  requirements for applicants whose business records were destroyed and  establish a satellite office to process disaster loans at its former  Sacramento DAO allowed SBA to improve its response to disaster victims.  However, SBA did not experience as much success with its initiatives to  expedite small business financing to communities affected by the disasters  and use private sector banks to process disaster loan applications. As a  result, some of SBA’s initiatives did not significantly reduce the backlog of  loan applications or the time victims waited for SBA to process their  disaster loan applications.
subsections: section_title: SBA Took Actions to Address DCMS Instability and Other System-Related Issues
paragraphs: As previously discussed, SBA initially experienced instability and other  issues with DCMS. However, the agency took actions to address these  issues. In October 2005, SBA obtained the computer hardware, as agreed to  with its contractor, that increased DCMS’s capacity to about 2,000  concurrent users. SBA also obtained additional support from its hosting  contractor, at no additional cost, to ensure adequate monitoring of the  DCMS network. By November 2005, because DCMS continued to operate  near its maximum capacity, SBA added a second shift for loan processing  staff at its Fort Worth processing facility to better balance DCMS’s  workload. According to SBA officials, DCMS had been stable since January  2006, and users reported having a greater comfort level and more success  in processing applications using the system. The officials added that the  hosting contractor had provided better oversight over DCMS compared  with the initial months following Hurricane Katrina. In April 2006, SBA  officials advised us that the agency had not made any payments to its  hosting contractor since August 2005 because it did not satisfy contract  requirements, and negotiations were under way to determine the amount of  any subsequent payments.
In preparation for the 2006 hurricane season, SBA awarded a new contract  in April 2006 for up to $54 million to its integration contractor to provide  project management and information technology support for DCMS over  the next 5 years. This contractor will continue to upgrade the system to  support increased loan processing activity by implementing software  changes and hardware upgrades, providing ongoing support to DCMS  users, and supporting all information technology operations associated  with the system under the contract. In addition, SBA has plans to increase  DCMS’s maximum user capacity to at least 8,000 concurrent users by the  summer of 2006. However, we could not determine how SBA selected this  number or whether the agency considered the information available from  catastrophe risk modeling firms or disaster simulations in determining the  planned for increase in maximum user capacity. To facilitate this planned  capacity increase, SBA added on to and extended the contract with its  hosting contractor in February 2006. Although SBA had experienced  problems with the initial oversight provided by this hosting contractor,  according to agency officials, the contractor’s performance had improved.  For example, the contractor had dedicated a project manager to this effort.  Because of these improvements and the contractor’s familiarity with SBA’s  needs, agency officials decided that the contractor could provide a  hardware solution for the expanded capacity within the agency’s time  frames.
section_title: SBA’s Processing Changes and Other Initiatives Had Varied Success
paragraphs: After the Gulf Coast hurricanes, SBA made several changes to its disaster  loan process and implemented other initiatives intended to improve its  response to victims. While some of these initiatives improved SBA’s ability  to process large numbers of disaster loan applications, others did not. For  example, in October 2005, SBA established a satellite office to process  disaster loans at its former Sacramento DAO. SBA increased the number  of loan processing staff in this Sacramento satellite office from  approximately 40 in late August 2005 to more than 250 by February 2006.  According to SBA, 8 months after Hurricane Katrina, the Sacramento  satellite office had processed about 95,500 home and 4,800 business  applications through DCMS for Gulf Coast hurricane victims. Table 3  describes other SBA changes or initiatives that improved its response to  disaster victims by making the application process easier or referring some  applicants to FEMA for grant assistance sooner.
In contrast to these actions, SBA implemented other initiatives that had  more limited success. For example, in November 2005, SBA implemented  the GO Loan Program. SBA intended for this program to expedite small  business financing for communities severely impacted by Hurricanes  Katrina and Rita. This program provided an 85 percent guaranty to qualified  lending partners, such as banks, that agreed to make expedited loans  available under the agency’s 7(a) loan program up to $150,000 to small  businesses located in communities affected by the disasters. Under the GO  Loan Program, small businesses applied directly to qualified lenders, who  evaluated their creditworthiness and determined if they required an SBA  guaranty to make the loan. SBA agreed to make a decision on whether to  apply a guaranty to the loan within 24 hours. While SBA prescribed the  maximum interest rate lenders could charge, the lender and borrower  negotiated the actual rate. For loans of $50,000 or less, lenders could  charge a maximum interest rate of 6.5 percentage points over the prime  rate and a maximum rate of 4.5 percentage points over the prime rate for  loans over $50,000. Thus, lenders could charge disaster victims interest  rates that were significantly higher under the GO Loan Program than the  rates SBA charged under the Disaster Loan Program. For example, a  disaster victim applying for a $60,000 GO Loan could have been charged an  interest rate up to 11.5 percent in November 2005 when the prime rate was  7 percent. In contrast, a business owner not able to obtain credit elsewhere  would have received a 4 percent rate under the Disaster Loan Program.  SBA only guaranteed 222 GO Loans totaling $19 million through May 2006.  The higher interest rates lenders could charge under the GO Loan Program  made these loans less attractive than SBA disaster loans and likely  contributed to the small number of loans made under the program.
In December 2005, SBA implemented a pilot program to expedite the  processing of disaster loan applications. Under this program, DCMS made  automatic approval recommendations for applicants with credit scores  indicating that they were less likely to default on a loan, and loan officers  did not have to conduct the lengthy repayment analysis for these  applications. According to SBA, loan officers processed 8 to 10 home loan  applications per day, on average, under the pilot program—about twice as  many applications as under the normal process. However, loan officers did  not review DCMS-generated approval recommendations until after the loss  verification stage under the program. In addition, when SBA implemented  the pilot program, the agency faced a significant backlog of 115,000  applications in the loss verification stage, and these applications had been in the queue for 39 days on average. As a result, SBA’s data showed that  the agency actually took longer to process expedited approvals compared  with SBA’s average processing time frames for all approvals. Specifically,  SBA processed expedited approvals in about 104 days on average between  December 2005 and April 2006, compared with 94 days for all approvals  processed through the end of April 2006. If SBA had implemented this  initiative sooner when the backlog in loss verification was not so large or if  the agency had implemented an expedited loss verification process for  these applications, the pilot program may have been more effective in  reducing the amount of time disaster victims waited for a decision on their  application. Table 4 describes other SBA actions or initiatives that did not  significantly reduce the backlog of loan applications because they were  either not implemented in a timely manner or did not fully incorporate the  use of DCMS to process applications.
section_title: SBA May Be Able to Process Applications More Efficiently
paragraphs: DCMS provided SBA with opportunities to help the agency move toward a  paperless processing environment by automating many of the functions the  agency previously performed manually, such as obtaining FEMA referral  data and credit bureau reports as well as completing and submitting loss  verification reports from remote locations. SBA officials also told us that  DCMS improved its ability to process disaster loans, and the agency would  have experienced even greater processing delays using its previous system  and loan process. However, we found other potential opportunities during  our review that might help SBA to process loans more efficiently and move  closer to its goal of processing loan applications within 21 days when faced  with disasters.
For example, SBA may be able to increase the efficiency of its application  entry process by implementing a secure Internet-based application feature  for home loan applicants. Currently, SBA accepts only paper loan  application documents from disaster victims, and data-entry staff manually  input application data into DCMS. According to the Direct Loan Systems  Requirements issued by the Joint Financial Management Improvement  Program, federal agency loan systems “should provide for an electronic  application process using various media, such as a secure Internet  application.” SBA could reduce the number of paper application  documents it receives, the number of documents it subsequently scans into  DCMS, and the resources and time required to input application data by  capturing much of this information electronically. According to SBA  officials, DCMS has the capability to interface with a secure Internet-based  application feature where this data could be captured electronically.  However, SBA did not attempt to add this functionality after the Gulf Coast  hurricanes because of the instability it initially experienced with DCMS.  SBA officials added that the agency concentrated its efforts on expanding  the capacity of DCMS and would examine adding this functionality to the  system in the future.
SBA officials told us that, prior to the Gulf Coast hurricanes, the agency  initiated a business process reengineering effort within ODA to reevaluate  the disaster loan process. As part of this effort, ODA planned to (1)  determine what type financial analysis would be performed for applicants  with credit scores indicating a high degree of default risk, (2) design a  streamlined loan application (both paper and electronic), and (3) identify  policy and legislative changes required to implement the new process.  However, ODA postponed this effort after the Gulf Coast hurricanes  because of the resources needed to meet the demands of the disaster loan  program. Business process reengineering can help organizations identify,  analyze, and redesign their core business processes with the aim of  achieving dramatic improvements in critical performance measures such  as cost, quality, service, and speed. According to SBA officials, it has plans  to resume this effort in 2006 in order to identify ways to more efficiently  process disaster loan applications and to maximize the benefits of DCMS.
section_title: Conclusions
paragraphs: The Gulf Coast hurricanes presented SBA with unprecedented challenges  that, in combination, led to significant backlogs and delays in processing  disaster loan applications. For example, SBA faced the largest volume of  disaster loan applications in its history, as the United States experienced  three extremely destructive natural disasters over a period of about 2  months. This large volume was due in part to the large number of  applicants automatically referred to SBA by FEMA’s Internet site, many of  whom ultimately did not qualify for disaster loans. We also agree that SBA  should improve its screening process within DCMS when processing “$0  income” referrals and continue to work with FEMA to reduce unnecessary  online disaster referrals, as recommended by SBA’s Office of Inspector  General. In addition, various system and processing-related issues also  challenged SBA, such as a new disaster loan system that was not designed  to effectively respond to a disaster of this magnitude and that was unable to  operate at the planned maximum capacity. Moreover, SBA based the  maximum number of concurrent users for DCMS solely on its historical  experience rather than considering information available from catastrophe  risk modeling firms and disaster simulations, such as the likelihood and  severity of damages from potential catastrophes to help predict the volume  of applications that it might expect from such events. While SBA has plans  to greatly expand its capacity of concurrent users for DCMS and should be  more capable of processing larger volumes of loan applications once it  achieves this increased capacity, it is not clear how the agency determined  the new maximum number of concurrent users and whether this new  capacity will be appropriate to handle future large scale disasters like the  Gulf Coast hurricanes. If SBA had considered information available from  catastrophe risk modeling firms and disaster simulations to help predict  the volume of loan applications it could expect to receive, SBA could have  made better informed decisions and might have acquired additional  capacity that could have enabled SBA to reduce the backlog of applications  in a more timely manner. Such an analysis would also better position SBA  to determine its loan processing capacity for future disasters. SBA’s limited  planning was further exacerbated by the lack of complete stress testing and  the ineffective technical support provided by the hosting contractor. If SBA  had appropriately stress tested the system before implementation, it might  have discovered before the Gulf Coast hurricanes struck that it had  received the incorrect computer hardware. Going forward, SBA would  benefit from improving its process for verifying that the equipment  provided by contractors meets all required specifications.
While some of SBA’s initiatives improved its response to disaster victims,  other efforts did not help the agency significantly reduce the large backlog  of applications because they were either not implemented in a timely  manner, not attractive to the applicant, or did not fully incorporate the use  of DCMS to process applications. If some of these initiatives had been  implemented soon after the Gulf Coast hurricanes struck, they might have  enhanced SBA’s ability to process a large volume of loan applications in a  timely manner. In addition, DCMS has the capability to interface with an  Internet-based application feature that could reduce the resources and time  required to input application data for home loan applicants by capturing  much of this information electronically. As the 2006 Atlantic hurricane  season has already begun, SBA would benefit by expediting its plans to  resume its business processing reengineering efforts to analyze ways to  more efficiently process loan applications, including an evaluation of  implementing an Internet-based application feature.
section_title: Recommendations for Executive Action
paragraphs: In order to provide more timely disaster assistance in the future, we  recommend that the Administrator of SBA direct the Office of Disaster  Assistance to take the following four actions:  reassess DCMS’s maximum user capacity and related loan processing  resource needs based on such things as lessons learned from the Gulf  Coast hurricanes, a review of information available from catastrophe  risk modeling firms and disaster simulations, and related cost  considerations;  conduct complete stress testing to ensure that DCMS can function at  planned for maximum user capacity levels;   improve management controls over assessing contractor performance  through inspections of all equipment purchased or leased to support  DCMS; and  expedite plans to resume business process reengineering efforts to  analyze the disaster loan process and identify ways to more efficiently  process loan applications including an evaluation of the feasibility of  implementing a secure Internet-based application feature for home loan  applicants.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided SBA with a draft of this report for review and comment. The  Associate Administrator for Disaster Assistance provided written  comments that are presented in appendix III. In these comments, SBA  provided additional context regarding the magnitude of the disasters and  the impact on the Disaster Loan Program. SBA stated that it generally  agreed with our recommendations and intended to improve the delivery of  the Disaster Loan Program for events of all sizes. However, SBA disagreed  with the following four findings and conclusions in our draft.
First, SBA disagreed with our conclusions that it performed limited  planning and that it would have been better prepared to reduce the backlog  of applications through the use of catastrophe risk models rather than  relying primarily on the Northridge earthquake to establish its capacity  needs. As we noted in our report, SBA planned the maximum user capacity  for DCMS based on the volume of applications it received from victims of  the Northridge earthquake—the single largest disaster SBA had previously  faced—and did not anticipate the likelihood of a single disaster or series of  disasters of the magnitude of the Gulf Coast hurricanes. We continue to  believe that catastrophe risk modeling firms and disaster simulations  provide critical information, such as the likelihood and severity of damages  from potential catastrophes. Combined with other elements of a  comprehensive planning process, such information would have been useful  in planning the maximum user capacity of DCMS. If SBA had considered  this information, the agency may have concluded that the likelihood of  large scale disasters exceeding the magnitude of the Northridge earthquake  was significant enough to expand its maximum concurrent user requirement. This additional capacity would have better prepared SBA to  reduce the backlog of loan applications more rapidly because additional  staff in all phases of the loan application process would have been able to  access DCMS.
Second, SBA stated in its comments that our draft report does not include  an analysis of the difference between using DCMS and ALCS—SBA’s  previous system. SBA also highlighted in its comment letter many of the  benefits offered by DCMS. While it was not in the scope of our work to  conduct a comparative analysis of ALCS and DCMS, our report recognized  some of the benefits realized by adopting DCMS. For example, we noted  that ALCS tracked the movement of paper loan application files from one  stage of the loan process to another and required the movement and  storage of large volumes of paper. We also noted that DCMS helped SBA  move toward a paperless processing environment by automating many of  the functions staff members had performed manually using ALCS such as  obtaining FEMA referral data and credit bureau reports, as well as  completing and submitting loss verification reports from remote locations.
Third, SBA stated that the draft report does not indicate that the specific  computer components, which the hosting contractor incorrectly provided,  were processing chips that were embedded subcomponents of the  computer servers, which SBA personnel could only detect by opening and  dismantling the computer hardware. We agree that the hardware was  embedded in the computer servers and could have been verified by  physical inspection. SBA conducted such an inspection in September 2005.  However, alternative ways of verifying the computer hardware were  possible. For example, SBA staff could have used its system utilities to  view details of the hardware and operating system after the processors  were installed and may have detected the incorrect processors and taken  corrective actions in a more timely manner.
Finally, SBA took issue with our finding that it actually took longer to  process expedited approvals under a pilot program, compared with its  average processing time frames for all approvals. SBA stated that our  interpretation of the data was misleading because it did not adjust for the  length of time an application was in the loss verification inventory before  being assigned to the loan department for processing. We disagree that our  interpretation of the data was misleading because all physical disaster loan  applications had to go through loss verification before a decision was  made, regardless of whether the application was part of the expedited pilot  program. While the expedited approval pilot program may have reduced  the amount of time for loan officers to complete the underwriting decision,  our intent, consistent with our overall objective, was to show the total time  disaster victims waited for SBA to make a decision on their application.  This includes the time an application is in other stages of the disaster loan  process, such as application entry and loss verification. As we noted in our  report, SBA implemented the pilot program when the agency faced a  significant backlog of 115,000 applications in the loss verification stage,  and these applications had been in the queue for 39 days on average. SBA’s  data showed that the agency actually took longer to process expedited  approvals, about 104 days on average, compared with 94 days on average  for all approvals. We continue to believe that it is appropriate to consider  the total processing time frames when comparing applications approved  under the pilot program with all approved applications.
SBA also provided other technical corrections and comments, which have  been incorporated in this report, where appropriate.
We are sending copies of this report to appropriate congressional  committees, the Administrator of the Small Business Administration, and  other interested parties and will make copies available to others upon  request. In addition, the report will be available at no charge on the GAO  Web site at http://www.gao.gov.
If you or your staff have any questions regarding this report, please contact  me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Scope and Methodology
paragraphs: In this report, we evaluate: (1) what affected the Small Business  Administration’s (SBA) ability to provide timely disaster assistance and (2)  the actions SBA took after the disasters to improve its response to disaster  victims. This report focuses primarily on the Disaster Credit Management  System (DCMS) and the disaster loan process. We visited the Gulf Coast  region to observe conditions and meet with federal, state, and local  officials and victims of the disasters. We also interviewed officials from the  Office of Disaster Assistance at SBA’s headquarters and officials from the  Processing and Disbursement Center in Texas, Field Operations Centers  East and West in Georgia and California, Customer Service Center in New  York, DCMS Operations Center in Virginia, and Georgia District Office. We  reviewed SBA’s standard operating procedures for approving, declining,  and withdrawing disaster loans. In addition, we reviewed documents  related to the agency’s response to the Gulf Coast hurricanes,  congressional testimony, and other program documentation.
We reviewed documents related to SBA’s acquisition and implementation of  DCMS. In addition, we discussed the acquisition process with officials from  SBA’s DCMS Operations Center, which provides technical and program  management support for the system. We also reviewed SBA’s standards for  system development and compared the acquisition process for DCMS with  industry standards for effective information technology acquisition.  Further, we interviewed officials from SBA’s Office of Inspector General  and reviewed their reports related to the implementation of DCMS and  SBA’s Disaster Loan Program. We did not conduct a comparative analysis of  DCMS and ALCS—SBA’s previous system—as part of our work. To obtain  the perspectives of system users, we interviewed loan processing staff at  various SBA locations. We also obtained SBA’s total costs for planning,  acquiring, and implementing DCMS through April 2006. However, we did  not audit the reported costs and thus cannot attest to their accuracy or  completeness.
We obtained documents related to the performance of DCMS, including  system status reports, troubleshooting reports, and system change  requests. We reviewed these documents to assess the extent to which  system-related problems detailed in the documents affected SBA’s ability to  provide timely disaster assistance. In addition, we obtained various reports  on SBA’s disaster lending activity for victims of Hurricanes Katrina, Rita,  and Wilma. We used these reports to calculate descriptive statistics on the  number of applications mailed and received, the number and amount of  approved loans, the backlog of applications in various stages, and other  characteristics for applications processed through May 27, 2006. For  comparative purposes, we also obtained summary statistical reports  related to SBA’s disaster lending for past significant disasters. We also  obtained data extracts from DCMS of disaster loan applications SBA  received from victims of Hurricanes Katrina, Rita, and Wilma for various  dates. We used the extracts to calculate average time frames for various  stages of the disaster loan process.
In assessing the reliability of SBA’s data, we reviewed documents such as  the DCMS Privacy Act Assessment and met with appropriate SBA officials.  To increase our confidence in the reliability of SBA’s data, we compared  information from selected hard copy application files with the information  recorded in DCMS. We also performed various tests of the information in  the data extracts we obtained to ensure the completeness of the data. We  concluded that SBA’s data were sufficiently reliable for the purposes of our  report.
To evaluate actions SBA took after the disasters to improve its response to  disaster victims, we reviewed documents related to changes SBA made to  DCMS and changes SBA planned to make to the system. We discussed  these changes with officials from SBA’s DCMS Operations Center. In  addition, we obtained and reviewed documents related to changes SBA  made to the disaster loan process and other initiatives intended to improve  SBA’s response to disaster victims. We discussed these changes and  initiatives with the appropriate SBA officials and obtained data on the  impact of these efforts where available.
We reviewed documents related to the Federal Emergency Management  Agency’s (FEMA) Individuals and Households Program, which makes  assistance available to victims of major disasters. We also contacted FEMA  to obtain additional information regarding the agency’s process for  referring applicants to SBA’s Disaster Loan Program.
We performed our work in Atlanta, Ga.; Buffalo, N.Y.; Fort Worth, Tex.; New  Orleans and Metarie, La.; Sacramento, Calif.; Bay St. Louis, Biloxi, Gulfport,  and Waveland, Miss.; Herndon, Va.; and Washington, D.C. We conducted  our work between November 2005 and July 2006 in accordance with  generally accepted government auditing standards.
section_title: SBA’s Acquisition and Implementation of the Disaster Credit Management System
paragraphs: Since the early 1990s, SBA utilized its Automated Loan Control System to  track the movement of paper application files from each stage of the  process until it made a decision on the application, disbursed funds for  approved applications, and transferred the application file to servicing.  SBA also obtained data manually from external data sources, including  FEMA, the Internal Revenue Service (IRS), and the credit reporting  agencies. In December 1998, after using a significant number of resources  in response to victims of Hurricane Georges, which struck Puerto Rico that  previous September, SBA began an effort to modernize its manual and  paper-based disaster loan process.
SBA intended for its new disaster loan system to support: (1) a “paperless”  electronic loan application and loan process, (2) loan processing from any  location where the system is implemented, (3) multiple interaction  methods between loan applicants and the Office of Disaster Assistance  (e.g., by Internet or telephone), and (4) access to external data sources.  The modernization effort entailed the following actions:  documenting SBA’s current loan process and proposed future loan   performing requirements analysis, conducting a commercial-off-the- shelf (COTS) market survey, and developing a business case; and  acquiring, customizing, and implementing the system.
In March 1999, SBA completed a business process reengineering study to  document the current process and proposed future process. In August  2000, SBA completed the initial development of the new system  requirements. Subsequently, SBA contracted for a COTS survey of products  meeting its requirements and leveraging its other information technology  resources. The survey identified two products that met a significant  number of SBA’s requirements, with some customization and integration of  additional products needed to meet all requirements.
After the contractor completed the survey, SBA’s information technology  investment review board required the agency to complete a business case  analysis for the proposed disaster loan system. SBA’s analysis involved  researching the existing requirements, evaluating potential alternatives,  and providing a recommendation. In March 2001, SBA completed the  analysis, which evaluated three alternatives: (1) develop a custom solution,  (2) acquire a COTS product, or (3) stay with the current environment. SBA  determined that the COTS product represented the best solution after  considering the costs and time frames associated with each alternative.
In June 2002, a SBA contractor developed more specific requirements for  the project because a considerable amount of time had passed since the  first survey and because of the uniqueness of certain aspects of the disaster  loan process, such as loss verification and a check for duplication of  benefits. Later that year, SBA contracted for a separate COTS survey that  utilized the Carnegie Mellon University’s Software Engineering Institute  process for evaluating COTS products. SBA evaluated products from 10  different vendors, and after narrowing the selection to two products,  received vendor demonstrations in January 2003. In March 2003, the  contractor recommended a COTS product for SBA to use as the foundation  for the Disaster Credit Management System (DCMS).
In September 2003, SBA completed an analysis of the DCMS design to  identify potential gaps between the recommended COTS product and the  requirements for the system. For example, SBA recognized that the COTS  product did not have the functionality to perform loss verification  activities; therefore, SBA decided to implement a custom loss verification  application and link the application to the core system. This ensured that  loss verification data would automatically synchronize with DCMS.
In 2003, SBA also began to test various aspects of its new system. In  November 2003, the agency began testing the core application, interfaces,  and additional components (loss verification, scanning, etc.). User  validation readiness testing was conducted between December 2003 and  March 2004. In October 2004, SBA contracted for an Independent  Verification and Validation (IV&V) of an initial release of DCMS. An IV&V  can help provide reasonable assurance that a system satisfies its intended  use and user needs, and its use is recognized as an industry best practice.  The IV&V conducted for DCMS found that the system was supported by  strong requirements, test plans, test cases, and other supporting  documentation. In addition, the IV&V found that DCMS was developed with  a high level of user involvement. However, the IV&V did not evaluate  performance testing, including tests to help ensure that the system could  function at its maximum user capacity, because these tests were not  completed until December 2004 after the agency had begun  implementation. This performance testing was conducted with only up to  120 concurrent users due to problems with the hardware associated with  the testing environment. If the testing environment had functioned as  planned, it was estimated the system could accommodate approximately  600 concurrent users.
SBA used a phased approach for implementing DCMS. In November 2004,  SBA first implemented DCMS in its Niagara Falls, New York, Disaster Area  Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas,  and Sacramento, California DAO. SBA also began using DCMS to process  applications for all new disaster declarations. As figure 6 illustrates, SBA’s  process of moving from its former manual, paper-based disaster loan  process to a more automated process using DCMS took about 6 years.  SBA’s costs for planning, acquiring, implementing, and operating DCMS  totaled about $32 million through April 2006.
section_title: Comments from the Small Business Administration
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Daniel Blair, Assistant Director;  Barbara Oliver, Assistant Director; Bernice Benta; Tania Calhoun; Marshall  Hamlett; Marc Molino; David Pittman; Jennifer Popovic; Rhonda Rose; and  Eric Trout made key contributions to this report.