Small Business Administration: Leadership Attention Needed to Overcome Management Challenges
Published: 2015-09-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: SBA has provided billions of dollars in loans and guarantees to small businesses. As of March 31, 2015, SBA’s total loan portfolio was about $116.9 billion, including $110.3 billion in direct and guaranteed loans and $6.6 billion in disaster loans. GAO has previously reported on management challenges at SBA. GAO was asked to review SBA management, including whether those challenges were ongoing. This report discusses SBA’s efforts to address management challenges related to specific programs and internal controls. It also looks at challenges in strategic planning, human capital, organizational structure, enterprise risk, procedural guidance, and IT. To do this work, GAO reviewed SBA policies and compared them with federal requirements, key principles for human capital management, and internal control standards. GAO also interviewed officials at SBA headquarters, all 10 regional offices, and 10 of 68 district offices selected on the basis of location and size.
section_title: What GAO Found
paragraphs: The Small Business Administration (SBA) has not resolved many of its long-standing management challenges due to a lack of sustained priority attention over time. Frequent turnover of political leadership in the federal government, including at SBA, has often made sustaining attention to needed changes difficult (see figure below). Senior SBA leaders have not prioritized long-term organizational transformation in areas such as human capital and information technology (IT). For example, at a 2013 hearing on SBA's budget, the committee Chairman stated that SBA's proposed budget focused on the agency's priorities but ignored some long-standing management deficits. This raises questions about SBA's sustained commitment to addressing management challenges that could keep it from effectively assisting small businesses.
Many of the management challenges that GAO and the SBA Office of Inspector General (OIG) have identified over the years remain, including some related to program implementation and oversight, contracting, human capital, and IT (see figure below). SBA has generally agreed with prior GAO recommendations that were designed to address these issues and other challenges related to the lack of program evaluations. The agency has made limited progress in addressing most of these recommendations but has recently begun taking some steps. A senior SBA official told us that improving human capital management, IT, and the 8(a) program (a business development program) were priorities for the new administrator. For example, he stated that SBA was exploring creative ways to recruit staff and plans to expand SBA One—a database currently used to process loan applications—to include the 8(a) program. Also, SBA has begun addressing some internal control weaknesses that GAO and the SBA OIG identified as contributing to the agency's management challenges. SBA officials noted that the agency had begun to update its standard operating procedure (SOP) on internal controls and planned more revisions after the Office of Management and Budget (OMB) updated its Circular A-123, which is expected to include guidance on implementing GAO's 2014 revisions to federal internal control standards. OMB issued a draft of the revised circular in June 2015 and is reviewing comments it received.
section_title: What GAO Recommends
paragraphs: GAO makes eight new recommendations designed to improve SBA's program evaluations, strategic and workforce planning, training, organizational structure, ERM, procedural guidance, and oversight of IT investments. SBA generally agreed with these recommendations and provided additional context. In response, GAO clarified one of its recommendations. GAO also maintains that 69 recommendations it made in prior work have merit and should be fully implemented.

section_title: Letter
paragraphs: The U.S. Small Business Administration’s (SBA) mission is to help  Americans start, build, and grow businesses. Specifically, SBA oversees  a number of programs that are designed to provide small businesses with  resources and tools, including access to capital, help with federal  contracting opportunities, entrepreneurial counseling and training, and  disaster assistance. According to SBA, in fiscal year 2015 its programs  were to support more than $32.5 billion in small business financing and  nearly $4 billion in long-term investment capital and provide access to  over $80 billion in federal contracting, among other things. Through a  network of field offices and partnerships with public and private  organizations, SBA delivers its services to businesses throughout the  United States, Puerto Rico, the U. S. Virgin Islands, and Guam. For fiscal  year 2015, SBA’s appropriation was just under $888 million.
In recent years, we and SBA’s Office of Inspector General (OIG) have  identified a number of long-standing management challenges at SBA that  have resulted in inefficient program operations. For example, SBA has  not had effective human capital strategies and has not effectively  managed acquisition and information technology. In addition, we and the  OIG have found deficiencies across several SBA program areas. For  example, recent reports found that SBA needed to improve oversight of  its (1) contracting programs that are to help eligible economically  disadvantaged small businesses obtain federal contracts and (2)  lenders.
You asked us to conduct a comprehensive assessment of SBA’s  structure, processes, and systems, including its efforts to address its  management challenges. This report examines the extent to which SBA  (1) has addressed previously identified management challenges related  to specific programs, including those related to internal controls; (2) is  following federal requirements for strategic planning; (3) is following key  principles or internal controls for human capital management,  organizational structure, enterprise risk management, acquisition  management, and procedural guidance; and (4) is making progress in  implementing the Office of Management and Budget’s (OMB) high-priority  management practices for information technology (IT).
To address our objectives, we reviewed relevant federal laws and  regulations and interviewed SBA officials, including program officials, all  10 regional administrators, management and nonmanagement staff at 10  district offices, and union representatives. To assess the status of SBA’s  programmatic challenges, we reviewed prior GAO and SBA OIG reports  on SBA programs and interviewed SBA officials and reviewed  documentation to determine the status of any related recommendations.  To assess SBA’s strategic planning efforts, we reviewed relevant SBA  documents and compared SBA’s strategic planning and reporting  practices with requirements in the Government Performance and Results  Act of 1993 (GPRA), as updated by the GPRA Modernization Act of 2010  (GPRAMA).
To evaluate SBA’s human capital management practices, we reviewed  relevant SBA documents such as its most recent human capital and  training plans and SBA’s 2014 Federal Employee Viewpoint Survey  results. We then compared SBA’s human capital practices related to  workforce planning and training with key principles identified in our  previous work. To assess SBA’s organizational structure, we reviewed  documentation on changes to SBA’s organizational structure from fiscal  years 2005 through 2014 (the period after SBA’s last major reorganization  in 2004). We also reviewed SBA’s planned efforts to assess its  organizational structure and compared these efforts to federal internal  control standards related to organizational structure. To assess SBA’s  risk management, we compared SBA’s enterprise risk management  practices with federal internal control standards related to documentation  and criteria on elements of risk management. For acquisition  management, we reviewed data on SBA contracts awarded to small  businesses in fiscal years 2011 through 2013 to assess whether SBA met  contracting goals in the last 3 years; recent SBA OIG reports on SBA’s  acquisition management; and documentation on SBA’s efforts to improve  its acquisition management. We reviewed documentation on and  conducted testing of the data we used and determined they were  sufficiently reliable for the purpose of reporting on small business  contracting. For procedural guidance, we reviewed an inventory of SBA’s  current standard operating procedures (SOP) to determine when they  were last updated and documentation on SBA’s efforts to update its  SOPs and compared these documents to federal internal control  standards related to documentation.
To assess SBA’s progress in implementing high-priority management  practices for IT, we evaluated its progress on six OMB IT initiatives. We  used the relevant sections of recent work to report on SBA’s efforts on the  initiatives, interviewed SBA officials about recent steps that they have  taken to implement them, and analyzed SBA TechStat documentation to  determine when past TechStat reviews had been held and to identify the  outcomes of the reviews. We reviewed SBA’s ratings on the Federal IT  Dashboard to determine if SBA had held a TechStat for the at-risk  investments. To corroborate the data reliability of those ratings, we  interviewed SBA officials to determine their process for collecting,  updating, and maintaining the data and asked them to verify the data’s  completeness and accuracy. We determined that the data were  sufficiently reliable for the purposes of reporting on TechStat reviews of  at-risk investments. We analyzed SBA’s operational analyses to  determine if, within the past year, the agency had performed such  analyses on all of its major IT investments in the operations and  maintenance phase. (See app. I for a detailed description of our scope  and methodology.)
We conducted this performance audit from March 2014 through  September 2015 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Organizational Structure
paragraphs: SBA’s organizational structure comprises headquarters and both regional  and district field offices. At the headquarters level, SBA is divided into  several key functional areas that manage and set policy for the agency’s  programs. As shown in figure 1, 17 headquarters offices report to the  Office of the Administrator.
In fiscal year 2014, the agency employed 2,137 regular funded full-time  equivalent (FTE) staff (excluding staff in the Office of Advocacy, the  Office of Inspector General, and the Office of Disaster Assistance) to  carry out its mission of supporting small businesses. Four program  offices manage the agency’s programs that provide capital, contracting,  counseling, and disaster assistance services to small businesses:
The Office of Capital Access administers, among other things, the  7(a) loan program. The 7(a) program is SBA’s largest loan program  and guarantees a portion of loans for establishing new businesses,  operating or expanding existing businesses, or acquiring businesses.  The Office of Capital Access also administers the development  company (504) loan program, which provides businesses with long- term, fixed-rate financing for major assets such as real estate and  equipment. In fiscal year 2014, the office had 569 FTEs.
The Office of Government Contracting and Business Development  promotes small business participation in federal contracting through a  variety of programs such as the 8(a) business development,  Historically Underutilized Business Zone (HUBZone), and women- owned small business (WOSB) programs. In fiscal year 2014, the  office had 180 FTEs.
The Office of Entrepreneurial Development, which had 50 FTEs in  fiscal year 2014, oversees a nationwide network of public and private  “resource partners” that offer small business counseling and technical  assistance. These include small business development centers,  women’s business centers, and SCORE chapters.
The Office of Disaster Assistance, which had 991 FTEs in fiscal year  2014, makes loans to businesses and families to rebuild and recover  after a disaster.
SBA provides its services through a network of 10 regional offices and 68  district offices that are led by the Office of Field Operations. In fiscal  year 2014, there were 802 FTEs in the regional and district offices.  Regional offices, whose administrators are political appointees, oversee  the district offices and promote the President’s and SBA Administrator’s  messages throughout the region. Considered by officials as SBA’s “boots  on the ground,” district offices serve as the point of delivery for most SBA  programs and services. Some district office staff work directly with SBA  clients, including business opportunity, lender relations, and economic  development specialists. These employees provide counseling and  training services that aid in the formation, management, financing, or  operation of a small business enterprise. They also provide information  on and promote SBA products to lenders, the small business community,  and groups such as chambers of commerce and trade associations.  Additionally, district offices are charged with completing statutorily  mandated reviews, such as program participant reviews that ensure  participants continue to qualify and are meeting program requirements.
SBA’s field structure has been revised over the years. In response to  budget reductions, SBA streamlined its field structure during the 1990s by  downsizing regional and district offices and shifting oversight  responsibilities to headquarters. Since the early 2000s, SBA has further  restructured and centralized some key agency functions. For example,  from 2003 through 2006, SBA completed the centralization of its 7(a) loan  processing, servicing, and liquidation functions from 68 district offices to 1  loan processing center, 2 commercial loan servicing centers, and 1 loan  liquidation and guarantee purchase center.
Since fiscal year 2013, SBA’s annual budget appropriation has declined.  For fiscal year 2014, SBA’s appropriation was $928,975,000,  approximately $116 million less than in fiscal year 2013 (see fig. 2).  SBA’s fiscal year 2016 congressional budget request of $860,130,000  was approximately $27 million less than the amount enacted for fiscal  year 2015. (See app. II for more information on recent trends in SBA’s  budget obligations, outlays, and authority.)
section_title: SBA IT Spending
paragraphs: SBA’s spending on IT fluctuated from 2005 through 2008, as shown in  figure 3. The sharp rise in spending in 2006 is attributed to increased  amounts for IT investments for disaster credit management, loan and  lender monitoring, and IT infrastructure. Since fiscal year 2008, the  agency’s yearly IT spending has remained fairly stable at about $100  million.
For fiscal year 2015, SBA estimates that it will spend approximately $109  million for IT. Of that amount, $83 million (77 percent) is to be spent on  mission-critical systems to, among other things, support agency financial  operations and the disaster loan assistance program. In addition, it plans  to spend $21 million (19 percent) on developing, modernizing, and  enhancing IT investments, while the rest is to be spent on operations and  maintenance of existing systems.
Government-wide, federal agencies spend more than $80 billion annually  to meet their increasing demands for IT. In a 2014 report, we found that  duplicative, wasteful, and low-value investments had proliferated over the  years, highlighting the need for agencies to avoid such investments  whenever possible. OMB has made a similar observation in its  guidance. To help address their management of federal IT dollars, OMB  has implemented a series of initiatives for federal agencies to use to,  among other things, consolidate the growing number of federal data  centers, shift to increased use of cloud computing, and promote the use  of shared services. In a June 2014 report, we found that OMB’s IT  reform initiatives could help to improve the efficiency and effectiveness of  federal agencies and save billions of dollars.
section_title: SBA Has Not Resolved Many of Its Long-Standing Management Challenges
paragraphs: In the last 15 years, we and the SBA OIG have identified management  challenges at SBA, many of which are related to specific programs. In  accordance with the Reports Consolidation Act of 2000, the SBA OIG  issues annual reports in which it identifies SBA’s most serious  management challenges—programs or activities that it has determined  pose significant risks. These annual reports represent the SBA OIG’s  current assessment of SBA programs and activities that pose significant  risks, including those that are particularly vulnerable to fraud, waste,  error, mismanagement, or inefficiencies. The OIG’s most recent report for  fiscal year 2015 identified 11 such challenges, 7 of which are issues that  have persisted for 10 years or longer. These 7 long-standing challenge  areas are loan guarantee purchases, the 8(a) business development  program, IT security, loan agent fraud, human capital, lender oversight,  and small business contracting (see fig. 4). The other challenge areas  are: improper payments, the Loan Management and Accounting System,  and acquisition management.
Our past reports have identified some of the same long-standing  management challenges that SBA needs to address, particularly in the  areas of contracting, lender oversight, and the Loan Management and  Accounting System (and other IT management issues). We and the SBA  OIG have also identified problems in SBA’s disaster loan processing that,  while not long-standing, also pose risks to the agency. To address SBA’s  challenges, we and the SBA OIG have made various recommendations.  While SBA has made some progress in addressing these challenge  areas, many of our recommendations remain unimplemented. As of July  2015, 53 percent of the recommendations (32 of 60) we made to SBA  across all subject areas in fiscal years 2010 through 2013 had not been  fully addressed. See appendix III for a list of all 69 recommendations we  have made to SBA since fiscal year 2000 that remain open. We  maintain that these recommendations continue to have merit and should  be fully implemented.
Loan guarantee purchases. Loan guarantee purchases occur when  lenders request that SBA purchase the guarantee following loan  liquidation or delinquency. The SBA OIG has cited issues related to  loan guarantee purchases as a serious management challenge since  fiscal year 2000. For example, in its fiscal year 2011 management  challenges report, the OIG stated that its audits of defaulted loans and  SBA’s guarantee purchase and liquidation processes showed that  reviews performed by the agency’s loan centers did not consistently  detect lenders’ failures to administer loans in full compliance with SBA  requirements and prudent lending practices, resulting in improper  payments. In its fiscal year 2012 management challenges report, the  OIG stated that in the last decade, the agency had made significant  progress in improving deficiencies identified in SBA loan liquidation  and guarantee purchase processes but that a significant deficiency  continued to exist in the area of quality assurance. The report noted  that while SBA had developed a quality assurance program, additional  work remained before the agency could demonstrate that all elements  of the program had been completed and followed. In its fiscal year  2015 report on management challenges, the SBA OIG found that SBA  had made significant progress in developing and implementing a  quality control program for all of its loan centers to verify and  document compliance with the loan process, from origination to close- out, and to identify where material deficiencies might exist so that  remedial action could be taken. Further, the OIG stated that SBA  had (1) developed and documented quality program manuals and  review checklists for each center; (2) assessed center functions by  risk to prioritize required quality control reviews; (3) refined feedback,  training, and reporting processes; and (4) developed new systems to  improve the tracking of quality control deficiencies and corrective  actions. However, the SBA OIG noted that SBA would need to  continue monitoring the quality control program during fiscal year  2015 to verify that (1) required quality control reviews were being  completed, (2) quality control activities provided adequate coverage  over loan center operations, and (3) quality control reviews were  effective at identifying and correcting material deficiencies.
8(a) business development program. The 8(a) business  development program is a business assistance program for small  disadvantaged businesses. The SBA OIG has identified issues  related to this program as a serious management challenge since  fiscal year 2000. For example, in its fiscal year 2003 report on  management challenges (and in every report since), the OIG noted  that SBA needed to modify the 8(a) business development program  so more firms received business development assistance, standards  for determining economic disadvantage were justifiable, and SBA  ensured that firms followed 8(a) regulations when completing  contracts. In a 2003 report on management challenges, we found  related problems with the 8(a) program. For instance, SBA had  begun to implement short- and long-term strategies to address  problems in the 8(a) program, but data suggested that only a few  firms continued to receive the bulk of 8(a) funding and that the volume  of federal procurement funding awarded to 8(a) firms had not  increased.
Further, in a March 2010 report on the 8(a) program, we found that  although SBA had implemented new procedures for the program,  there were inconsistencies and weaknesses in internal controls that  increased the potential for abuse by ineligible firms. Specifically, we  found that monitoring of district staff needed to be improved and  district staff needed better guidance, training, and criteria to follow the  required annual review procedures for determining continued  eligibility. We made six recommendations that individually and  collectively could improve procedures used in assessing and  monitoring the continuing eligibility of firms to participate in and benefit  from the 8(a) program. SBA agreed with the six recommendations  when the report was issued. As of July 2015, SBA had taken actions  responsive to four of the recommendations. Specifically, it had  assessed the workload of business development specialists, updated  its 8(a) regulations to include more specificity on the criteria for the  continuing eligibility reviews, developed a centralized process to  collect and maintain data on 8(a) firms participating in the Mentor- Protégé Program, and implemented a standard process for  documenting and analyzing complaint data. The two remaining  recommendations yet to be fully implemented as of July 2015 focus  on (1) procedures to ensure that appropriate actions are taken for  firms subject to early graduation from the program and (2) taking  actions against firms that fail to submit required documentation. In  its fiscal year 2015 report on management challenges, the SBA OIG  found that SBA had made progress towards addressing issues that  hindered its ability to deliver an effective 8(a) business development  program. For example, it found that SBA had expanded its ability to  provide assistance to program participants through its resource  partners. In addition, it noted that SBA had taken steps to ensure that  business opportunity specialists assessed program participants’  business development needs during site visits. The OIG also found  that SBA had revised its regulations, effective March 2011, to ensure  that companies deemed “business successes” graduated from the  program. However, for the second consecutive year the SBA OIG  noted that SBA had not finished updating the SOP for the 8(a)  business development program to reflect the March 2011 regulatory  changes. In addition, the OIG continued to maintain that SBA’s  standards for determining economic disadvantage were not justified or  objective based on the absence of economic analysis.
According to a senior SBA official, improving the 8(a) program is a  priority for the new Administrator. For example, he stated that the  agency was considering how to expand SBA One—an initiative  designed to create a single application for most SBA loans and allow  borrowers and lenders to populate forms from secure information  storage—to include the 8(a) program. He noted that the goal would be  to make it easier and less costly for small businesses to participate in  the program. In addition, he stated that the agency was considering  focusing its oversight on those 8(a) businesses that receive federal  contracts.
IT security. The SBA OIG has identified weaknesses in information  systems security controls as a serious management challenge since  fiscal year 2000. In its fiscal year 2015 management challenges  report, it noted that SBA’s computer security program operates in a  dynamic and highly decentralized environment and requires  management attention and resources as weaknesses are identified.  The OIG stated that SBA had shown progress in establishing an  entity-wide incident management and response program and had  improved network port security access controls, but found that SBA  still needed to address long-standing security weaknesses identified  in 35 open IT audit recommendations. In addition, the SBA OIG noted  that SBA’s Office of the Chief Information Officer, in conjunction with  SBA’s program offices, needed to implement tools and capabilities to  provide effective oversight and continuously monitor computer  security controls. According to a senior SBA official, the agency has  recently placed an even greater emphasis on improving its IT security  at the direction of the White House. He stated that one focus was  increasing the use of personal identification verification cards, which  are smart cards that govern access to federally controlled facilities  and information systems.
Loan agent fraud. A prospective borrower or a lender sometimes  pays a loan agent (e.g., a loan broker or packager) to prepare  documentation for an SBA loan application or find a lender. The SBA  OIG has identified loan agent fraud as a serious management  challenge since fiscal year 2000. Its fiscal year 2015 management  challenges report stated that for years its investigations had revealed  a pattern of fraud by loan packagers and other for-fee agents in the  7(a) loan program involving hundreds of millions of dollars. The  report noted that SBA’s oversight of loan agents had been limited,  putting taxpayer dollars at risk. It added that SBA could reduce this  risk by developing a database or equivalent means to track loan agent  activity, updating regulations on loan agent enforcement, issuing new  guidance for lenders on not doing business with loan agents subject  to enforcement actions, and implementing a loan agent registration  system (including the issuance of a unique identifying number for  each agent). Finally, the report noted that SBA had made substantial  progress on tracking loan agency data, limited progress on updating  its regulations and issuing new guidance to lenders, and had not yet  started on its recent recommendation to implement a registration  system.
Human capital. The SBA OIG has included human capital as one of  the most serious management challenges at SBA since fiscal year  2001, noting that SBA needs effective human capital strategies to  carry out its mission successfully and become a high-performing  organization. Problems that the SBA OIG cited in its management  challenges reports over the years included the lack of a  comprehensive human capital strategy that identified SBA’s current  and future human capital needs, including workforce capacity and skill  gaps; failure to clarify the role of or appropriately staff district offices  when key program functions were transferred to service centers; and  failure to adequately analyze priorities and allocate resources  consistent with them. In our 2003 report on SBA’s management  challenges, we also found that SBA needed to strengthen its human  capital management. For example, we stated that SBA’s  organizational structure had weaknesses that contributed to the  challenges it faced in delivering services to the small business  community. We discuss the status of SBA’s human capital  management and additional challenges we identified as part of our  current review later in this report.
Lender oversight. SBA’s major loan programs (7(a) and 504) require  effective lender oversight because the agency generally relies on the  lenders that make 7(a) loans and certified development companies  (CDC) that make 504 loans to process and service the loans and to  ensure that borrowers meet the programs’ eligibility requirements. The  SBA OIG has identified lender oversight as a serious management  challenge for SBA since fiscal year 2001. We also identified SBA’s  lender oversight as a challenge in our 2003 report on management  challenges. More recently, we and the OIG found the following  weaknesses in SBA’s lender oversight: In a July 2013 report, the SBA OIG found that SBA had not  implemented procedures and policies to monitor risk across its  loan portfolio and that SBA had not developed a process for  ensuring that identified risks were addressed. The SBA OIG  recommended that SBA implement a portfolio risk management  system, use data from that system to support risk-based decisions  in its loan programs, and implement additional controls to mitigate  identified risks where necessary. SBA agreed with the  recommendations. According to the SBA OIG, while SBA has  implemented a portfolio risk-management program in accordance  with its recommendations, it has not yet used data from the  program to support risk-based decisions in loan programs or  develop additional internal controls to manage identified risks.
In a September 2013 report, we found that internal controls over  lenders participating in the Patriot Express pilot program may not  have provided the agency with reasonable assurance that loans  were made only to eligible borrowers. For example, we found  that SBA had not developed procedures for lenders to provide  reasonable assurance that borrowers maintained their eligibility  after the loans were disbursed. We recommended, among other  things, that SBA enhance internal controls over borrower eligibility  requirements. SBA subsequently decided to allow the program to  expire in December 2013.
In a March 2014 report, we found that although SBA had initiated  actions to improve its reviews under the 504 loan program, its  guidance for conducting risk-based reviews of the CDCs that  make 504 loans did not require SBA staff to review supporting  documentation on the number of jobs created or retained, a key  requirement of the program. Among other things, we  recommended that SBA require examiners to review such  documentation. SBA generally agreed with our recommendation  and subsequently revised its review procedures. Specifically, the  agency incorporated steps in the worksheet examiners use to  review loan files during risk-based reviews that require the review  of documentation supporting the number of jobs created or  retained.
SBA has recently revised its procedures for conducting risk-based  reviews of lenders and CDCs. A senior SBA official stated that he  expected these changes to greatly improve SBA’s lender oversight.  Specifically, SBA developed a new risk measurement methodology to  assign risk ratings to both 7(a) lenders and CDCs and new lender  risk-based review protocols for using these ratings to determine the  scope of lender reviews. Those lenders with composite risk ratings  above an established threshold are to undergo a targeted review of  specific identified risks or a full review if risks are more pervasive. In  its fiscal year 2015 report on management challenges, the SBA OIG  noted that SBA also had improved its monitoring and verification of  corrective actions by lenders by (1) developing corrective action  assessment procedures, (2) finalizing a system to facilitate the  corrective action process, and (3) populating the system with lender  oversight results requiring corrective action. However, the OIG  stated that in order for SBA to fully resolve this management  challenge, the agency would need to demonstrate the effectiveness of  the process for monitoring and verifying lenders’ implementation of  corrective actions.
Small business contracting. SBA’s contracting programs help  eligible socially and economically disadvantaged small businesses  obtain federal contracts on a set-aside basis. The agency has several  such programs, including the HUBZone and WOSB contracting  programs. The SBA OIG has identified small business contracting as  a serious management challenge since fiscal year 2005. Its fiscal year  2015 management challenges report stated that SBA’s procurement  flaws allowed large firms to obtain small business awards and  agencies to count contracts performed by large firms toward their  small business goals. In a September 2014 report, the OIG  identified over $400 million in contract actions that were awarded to  ineligible 8(a) and HUBZone firms, which may have contributed to the  overstatement of small business goaling dollars reported to Congress  in fiscal year 2013.
In addition, we and the SBA OIG have identified internal control  weaknesses in individual contracting programs, as the following  examples illustrate.
In a June 2008 report, we found that many firms were in the  HUBZone program for more than 3 years without being recertified  as required, resulting in potentially ineligible firms participating in  the program. We recommended, among other things, that SBA  eliminate the backlog using either SBA or contract staff and take  the necessary steps to ensure that recertifications were completed  in a more timely fashion in the future. SBA agreed, and in a 2009  testimony we found that the agency had eliminated the backlog of  recertifications by hiring additional contract staff. However, we  found in a February 2015 report that SBA did not replace the  contract staff with FTE staff because, according to SBA, part of its  funding authority was rescinded in 2013. As a result, we found  that SBA once again had a backlog in recertifying firms.  Therefore, we recommended that SBA assess the recertification  process and implement additional controls, such as ensuring that  sufficient staff were dedicated to the effort so that a significant  backlog in recertifications did not recur. SBA agreed with the  recommendation. According to SBA, it has since completed an  evaluation of the current recertification procedures and plans to  implement improved processes by September 30, 2015.
In an October 2014 report on SBA’s WOSB program, we found  that SBA performed minimal oversight of third-party certifiers and  had not developed procedures to provide reasonable assurance  that only eligible businesses obtained WOSB set-aside  contracts. We recommended that SBA develop and implement  comprehensive procedures to monitor and assess the  performance of certifiers and enhance the examination of  businesses that registered to participate in the WOSB program.  SBA generally agreed with the recommendations and stated that  the agency was in the process of implementing many of them. In  June 2015, SBA officials told us that the agency was in the  process of publishing a proposed rulemaking on how to proceed  with certification in light of recent legislative changes to the  program and planned to update its procedures for examining firms  by the end of fiscal year 2015.
In a May 2015 report, the SBA OIG found that federal agencies’  contracting officers awarded 15 of 34 set-aside awards without  meeting the WOSB program’s set-aside requirements. These  firms received approximately $7.1 million of fiscal year 2014 set- aside awards that may have been improper. It also found that of  the 34 awards reviewed, only 25 had documentation of program  eligibility in the WOSB program repository. Of those, 13 did not  provide all of the required documentation, and 12 did not provide  sufficient documentation to prove that the firm was controlled by  women.
According to a senior SBA official, SBA plans to improve small  business contracting by extending SBA One to the 8(a) and HUBZone  programs and creating a more dynamic small business search engine  so that agencies can more readily identify small businesses that are  eligible for contracts.
Improper payments. The Improper Payments Information Act of  2002 requires agencies to review and identify those programs  susceptible to significant improper payments, report on the amount  and causes of improper payments, and develop plans for reducing  improper payments. The SBA OIG has identified improper payments  in SBA’s 7(a) and disaster loan programs as serious management  challenges since fiscal year 2010 and fiscal year 2012, respectively.  Its fiscal year 2015 report on management challenges stated that  previous OIG audits had determined that reported improper payment  rates for 7(a) loan approvals and purchases and disaster loans were  significantly understated because SBA had not adequately reviewed  loans, had used flawed sampling methodologies, and did not  accurately project review findings. The OIG noted that SBA had  taken actions to correct many of these deficiencies for the 7(a)  program, including formalizing its improper payment sampling and its  process for reviewing disputed cases and developing appropriate  corrective action plans for the program. However, the OIG stated that  SBA still needed to demonstrate that its process over disputed cases  was ensuring adequate and timely resolution, that it was adhering to  recovery time standards, and that corrective action plans for the 7(a)  loan program were effective in reducing improper payments. The OIG  also noted that SBA had implemented an improved corrective action  plan for the disaster loan program that if properly implemented, should  effectively reduce the improper payment rate in future years.
In a February 2015 report on improper payments related to Disaster  Relief Appropriations Act, 2013 funding, we found that SBA did not  have policies and procedures for estimating improper payments for  the Office of Entrepreneurial Development Grants program, one of its  two programs that received funding under the act. We also found  that SBA’s policies and procedures for its Disaster Assistance Loans  program, the other program that received funding, did not cover many  of the key requirements for estimating improper payments. For  example, they did not define improper payments consistent with OMB  guidance. SBA’s internal guidance defines an improper payment as a  loan approval that does not meet the eligibility requirements in its  SOP for the program. However, OMB guidance clarifies that improper  payments can include certain payments to eligible recipients, such as  payments that are for the incorrect amount and duplicate payments.  Such types of improper payments were not captured or addressed in  SBA’s policies and procedures. We recommended that SBA take  eight actions to develop policies and procedures for the Office of  Entrepreneurial Development Grants program and six actions to  revise its Disaster Assistance Loans program policies and procedures  for estimating improper payments. SBA did not explicitly concur with  our recommendations but stated that it would address them by  including a chapter on improper payments as it updates its SOP for  internal controls. In June 2015, SBA officials told us that they planned  to issue a policy notice containing additional guidance until the SOP  could be updated.
In a May 2015 report on SBA’s progress in complying with the  Improper Payments Elimination and Recovery Act of 2010, the SBA  OIG found that SBA continued to make progress in its efforts to  prevent and reduce improper payments. For example, the reported  improper payment rate for disaster assistance loan disbursements  had decreased from 18.4 percent in fiscal year 2013 to 12 percent in  fiscal year 2014, exceeding SBA’s goal of 15 percent. However, the  OIG also found that SBA needed to make some improvements to  effectively develop its improper payment controls and processes for  Hurricane Sandy disaster relief grants and 7(a) loan guarantee  purchases. Specifically, it found that the reported improper payment  rate for Hurricane Sandy disaster relief grants of 3 percent might have  been understated because reviewing personnel did not identify  payment errors and related opportunities for correcting those errors.  The OIG also noted that the reported improper payment rate of 1.33  percent for 7(a) loan guarantee purchases was slightly understated.  The OIG made six recommendations to improve the effectiveness of  improper payment controls over Hurricane Sandy technical assistance  grants and Section 7(a) loan guarantee purchases.
A senior SBA official noted that SBA’s improper payment rates were  decreasing and that SBA One would help decrease them further  because it included editing features designed to reduce the number of  technical errors.
Loan Management and Accounting System (and other aspects of  IT management). SBA’s Loan Management and Accounting System  (LMAS) is one in a series of attempts by SBA during the past several  years to upgrade existing financial software and application modules  and remove them from the mainframe environment. The SBA OIG has  identified this project as a serious management challenge since fiscal  year 2010 on the basis of reviews that we and it conducted, as the  following examples show.
In a 2012 report, we found inconsistencies in SBA’s application of  IT management practices (including IT risk management) resulting  in part from inadequate executive oversight of the LMAS  modernization project. For example, we found that SBA had not  fully prioritized risks related to one project or developed plans to  mitigate them. Consequently, this modernization effort was  severely delayed, and costs were well above initial estimates. We  recommended that SBA ensure that appropriate IT management  practices were applied to LMAS projects and that the executive  bodies responsible for project oversight provide appropriate and  ongoing reviews. SBA generally concurred with the  recommendations and has taken some actions to address them  as discussed below.
In a series of reports in 2010, 2013, and 2014 on the LMAS  project, the SBA OIG found that SBA did not follow federal  regulations and internal guidance on IT acquisitions, leading to  delays and weaknesses in project oversight. For example, in  2014 the OIG found that SBA did not identify a plan for full user  acceptance testing according to the requirements outlined in its  own SOPs for IT system development. The OIG also noted that  SBA had made some progress but recommended that the agency  adhere to internal guidelines in performing project oversight,  approve and revise project baselines, and affirm the viability of  project milestones. SBA agreed with the findings and  recommendations and has taken actions to address them.
SBA has recently completed its LMAS projects. In response to our  2012 recommendation, SBA told us that it had instituted changes to  provide consistent project management, including appropriate  oversight of requirements, the engagement of an independent  contractor, and the establishment of risk management processes. As  of March 2015, SBA reported that development activities for these  projects had been successfully completed and all projects had  entered the operations and maintenance phase.
The SBA OIG has identified problems with other aspects of SBA’s IT  management. In a February 2014 report, the OIG found that SBA had  not followed federal regulations and guidance in the acquisition of the  OneTrack system, a system that the Office of Government  Contracting and Business Development planned to use to track 8(a)  and HUBZone program participants. The SBA OIG reported that  SBA had failed to perform market research or use a modular  contracting strategy intended to reduce acquisition risks. As a result,  SBA did not receive a system with the full capabilities originally  designed. The OIG recommended, among other things, that SBA  conduct a requirements analysis and cost assessment of the system  and ensure that all appropriate provisions of internal guidance on IT  system development were met prior to placing OneTrack into  production. SBA concurred with the recommendations, but according  to the SBA OIG, the agency did not deploy the OneTrack system.  Instead, as noted previously, a senior SBA official told us that the  agency planned to use SBA One for the 8(a) and HUBZone programs  as well as its loan programs. He further noted that improving IT was a  priority for the Administrator and that she was devoting additional  resources to IT to meet deferred needs.
Acquisition management. The SBA OIG has identified SBA’s  acquisition management as a serious management challenge since  fiscal year 2013. Although SBA had taken steps to improve its  acquisition process—such as realigning its acquisition program within  the organization, hiring new staff, and providing additional training to  its acquisition personnel, the SBA OIG noted in its 2015 report on  SBA’s management challenges that challenges remained. These  challenges included (1) poorly defined requirements, (2) internal  control deficiencies, (3) inadequate oversight of contractor  performance, and (4) an incomplete acquisition SOP. We discuss  SBA’s efforts to address these challenges and the results of a  contractor review that found additional areas in need of improvement  later in this report.
Disaster loan processing. Both we and the OIG have reported that  SBA needs to further strengthen planning for and controls over its  disaster loan program to improve its ability to respond effectively to  future disasters. SBA provides funding and assistance to individuals  and businesses after disasters declared by either the President or  SBA. SBA’s disaster loan program is the primary federal program for  funding long-range recovery for nonfarm businesses that are victims  of disasters and is the only form of SBA assistance not limited to small  businesses. After the 2005 Gulf Coast hurricanes (Katrina, Rita, and  Wilma), SBA faced an unprecedented demand for disaster loans,  while also being confronted with a significant backlog of applications.  As a result, hundreds of thousands of loans were not dispersed in a  timely way. In June 2008, Congress enacted the Small Business  Disaster Response and Loan Improvements Act of 2008 (2008 Act),  which placed new requirements on SBA to help ensure that it is  prepared to respond to catastrophic disasters. Since Hurricane  Katrina, SBA has implemented reforms intended to improve disaster  loan processing by increasing the capacity of the electronic loan  processing platform and addressing requirements in the 2008 Act.  However, continued attention on efforts to strengthen internal controls  in the disaster loan program is needed, as the following examples  illustrate.
In a September 2014 report, we found that SBA did not  adequately respond to the higher volume of physical business  disaster loans and economic injury loans early in its response to  Hurricane Sandy and as a result did not meet its timeliness goal  for processing applications. We further found that the agency did  not revise its disaster planning documents—the Disaster  Preparedness and Recovery Plan and the Disaster Playbook—to  reflect the effects that loan application volume and timing could  have on staffing, resources, and forecasting models for future  disasters. We concluded that without accounting for its recent  experience in its planning documents, SBA may be unprepared for  future disasters. We recommended that SBA revise its disaster  planning documents. SBA generally agreed with the  recommendation and provided us in June 2015 with an updated  Disaster Playbook—one of its two key disaster planning  documents—that includes explicit recognition of the effects that  high volumes of loan applications early in the response period  could have on staffing and loan processing.
Also in our September 2014 report on disaster assistance, we  found that SBA had not developed an implementation plan for  addressing the 2008 Act’s requirements, as GAO recommended  in 2009. This plan was to include, among other things,  challenges the agency faces in implementing the 2008 Act’s  requirements, including those to implement three new guaranteed  disaster programs using private sector lenders. SBA had made a  decision to focus attention first on implementing a pilot program  for one of the requirements, the Immediate Disaster Assistance  Program (IDAP). We found that SBA had not conducted a formal  documented evaluation of lenders’ feedback or taken other  actions needed to establish the basis for proposed changes to  requirements for Congress to consider. In order to provide  Congress with reliable information on challenges SBA has faced  in implementing IDAP, we recommended that SBA (1) conduct a  formal documented evaluation of lenders’ feedback that can  inform SBA and Congress about statutory changes that may be  necessary to encourage lenders’ participation in IDAP and (2)  report to Congress on the challenges SBA has faced in  implementing IDAP and on statutory changes that may be  necessary to facilitate SBA’s implementation of the program. SBA  generally agreed with the recommendations. While SBA has  solicited some lender feedback, it has not adopted a plan for the  steps the agency will take to implement IDAP (and by implication,  the other two loan programs) or to reach a determination on  whether IDAP or the other loan programs should be implemented.
In a February 2015 report, the SBA OIG found that loan officers  did not have guidance for performing the financial analysis to  determine whether Hurricane Sandy business loan applicants had  repayment ability. It noted that because there was no guidance,  loan officers used inconsistent methodologies when evaluating  Hurricane Sandy business loans for repayment ability. The OIG  estimated that SBA approved at least 537 Hurricane Sandy  disaster business loans, totaling at least $17.9 million, without  sufficiently considering principals’ living expenses when  determining repayment ability and that as a result, these loans  were at a higher risk of default.
As this discussion of SBA’s management challenges indicates, we and  the SBA OIG have identified a number of internal control weaknesses that  have contributed to programmatic challenges. We have made a number  of related recommendations, many of which SBA has begun to address.  SBA also has a process in place to help ensure that internal controls are  in place for financial reporting, an effort that is overseen by a Senior  Assessment Team. Among other things, this team is responsible for  determining the scope of the assessment; monitoring the assessment to  confirm that it is carried out in a thorough, effective, and timely manner;  and analyzing the results of the assessment. SBA’s Office of Internal  Controls within the Office of the Chief Financial Officer carries out each  year’s assessment of internal controls over financial reporting. These  efforts are guided by federal internal control standards, which we updated  in September 2014. The new standards are effective beginning with  fiscal year 2016. To prepare for the implementation of these new  standards, the Office of Internal Controls presented the new guidelines at  a Senior Assessment Team meeting in fiscal year 2013 and at fiscal year  2014 FMFIA training provided to senior managers. SBA officials said that  the agency had also begun to update its SOP on internal control and  plans additional revisions after OMB has updated its Circular A-123,  which is expected to include guidance on implementing the new  standards.
SBA has not resolved many of these long-standing management  challenges due to a lack of sustained priority attention over time. In a  September 2008 report, we noted that frequent turnover of political  leadership in the federal government, including at SBA, often made it  difficult to sustain and inspire attention to needed changes. SBA has  undergone turnover in its leadership positions (see fig. 5). Senior SBA  leaders have not prioritized long-term organizational transformation in  management challenge areas such as human capital and information  technology. For example, since 2008 SBA has published three strategic  plans, each signed by a different Administrator. The overview from the  Administrator in SBA’s 2008-2013 strategic plan acknowledged some of  the internal management challenges the agency faced and noted that the  plan reflected SBA’s efforts to address them. However, the overviews  from the Administrators in the two subsequent plans did not do so.  Furthermore, in an April 2013 House committee hearing on SBA’s  proposed fiscal year 2014 budget, the committee Chairman stated that  SBA’s proposed budget focused on the agency’s priorities but ignored  some long-standing management deficits. For example, the Chairman  noted that SBA included initiatives in the budget to increase the  availability of loans to small businesses, but reduced resources that  would be devoted to LMAS. These examples raise questions about  SBA’s sustained commitment to addressing management challenges that  could keep it from effectively assisting small businesses.
section_title: SBA Met Most Statutory Requirements for Strategic Planning but Did Not Use Program Evaluations
paragraphs: As well as examining long-standing management challenges, we  reviewed SBA’s strategic plan for fiscal years 2014 to 2018 to determine  whether it met federal requirements. We found that the plan met all the  requirements for planning and all but one of the content requirements. It  partly met the content requirement that it describe how program  evaluations were used in developing the plan and that it include a  schedule of evaluations planned for the next 4 years (see table 1).  Strategic planning at federal agencies, including SBA, is subject to a  variety of statutory requirements. First, in 1993 Congress passed GPRA,  which established strategic planning, performance planning, and  performance reporting as the components of a framework for agencies to  communicate progress in achieving their missions. Next, GPRAMA  made some important changes to existing requirements by placing a  heightened emphasis on priority setting, cross-organizational  collaboration to achieve shared goals, and the use and analysis of goals  and measures to improve outcomes. GPRAMA enhanced agency-level  planning and reporting requirements and required agencies to increase  leadership involvement and accountability. OMB has published guidance  for federal agencies on the implementation of GPRAMA, including  guidance on strategic planning. The statutes and guidance describe the  elements agencies must include in their strategic plans and the planning  process they must follow when developing them.
Planning process. SBA’s process for developing its fiscal years  2014-2018 strategic plan met all federal requirements, such as  gathering input from stakeholders. For example, officials from SBA’s  Office of Performance Management, which took the lead in  developing the strategic plan, told us that they had met with the  Associate Administrator and Deputy Associate Administrator from  each program office as well as with senior staff to discuss the  strategic objectives, the strategies the offices planned to use to  achieve the objectives, and metrics for the objectives. This office  also met with the Associate Administrator of the Office of Field  Operations to obtain input and published a notice in the SBA Daily, a  daily e-mail communication sent to all SBA employees, to inform SBA  employees that the draft strategic plan had been posted on SBA’s  website and to encourage them to review the plan and provide  comments.
Externally, SBA officials met with relevant authorizing and oversight  committees early on in the planning process to discuss a high-level  outline of the plan. According to SBA officials, these meetings  allowed SBA to obtain some congressional input before it committed  to specific strategic goals and objectives. SBA also consulted with  OMB, which provided comments on SBA’s priority goals and the  structure and framing of its strategic plan, requested input from  numerous stakeholder groups, and sought public comments by  posting a notice in the Federal Register and making a draft strategic  plan publicly available on its website.
Contents of strategic plan. As shown in table 1, SBA’s fiscal years  2014-2018 strategic plan met all but one of the content requirements,  partly meeting the requirement on program evaluations. For example,  the plan has a comprehensive mission statement that covers the  agency’s major functions and includes outcome-oriented, long-term  strategic goals and objectives that reflect the results SBA is trying to  achieve. It also contains specific strategies to achieve the agency’s  goals and objectives. In addition, SBA’s strategic plan includes a list  of external parties that have evaluated SBA’s programs, describes  SBA’s efforts to build its capacity to conduct more program  evaluations, and discusses two evaluations it plans to conduct in  2015. But it does not describe how program evaluations were used  in developing the strategic goals and objectives or include a schedule  of evaluations planned for the full 4 years. According to OMB,  program evaluation is among the most important analytical tools for  agency decision making. It can help agency managers, such as those  at SBA, determine how best to spend taxpayer dollars effectively and  efficiently, identify appropriate goals, and address questions about the  effectiveness of strategies. Per OMB guidance, a strategic plan  should describe how information from program evaluations and  research was used to develop the strategic plan, including in  establishing or revising the agency’s strategic objectives and  identifying evidence-based approaches to meeting objectives. The  plan should also (1) describe efforts to support high-quality  evaluations, (2) discuss efforts to increase capacity for conducting  them and using their findings, and (3) include a schedule of  evaluations planned for the next 4 years. SBA officials stated that  SBA did not use program evaluations to develop or revise its strategic  objectives because the agency had conducted a limited number of  them. SBA officials also told us that the agency had limited financial  resources available for independent program evaluations but was  working on three and considering some in other areas. SBA officials  said that it thought the information included in the plan would be  sufficient to meet GPRAMA’s requirements on program evaluations.
Because SBA has not routinely conducted program evaluations, we  have questions about whether the agency will have program  evaluations on which to rely when developing its next strategic plan.  GPRAMA aims to ensure that agencies use performance information  in decision making and holds them accountable for achieving results  and improving government performance. OMB has also encouraged  agencies to improve government effectiveness by increasing their use  of evidence and rigorous program evaluation in making budget,  management, and policy decisions. In addition, in a June 2013 report  we concluded that evaluations helped in assessing program  effectiveness or value, explaining program results, implementing  changes to improve program management or performance,  developing or revising performance goals, designing or supporting  program reforms, and sharing what works with others. We and the  SBA OIG have in the past found instances in which SBA did not  evaluate the effectiveness of new or existing programs, and the  agency has not yet fully addressed our recommendations in this area,  as the following examples show.
In an August 2010 report, the SBA OIG found that SBA had not  assessed the Community Express pilot loan program’s  effectiveness. The OIG recommended, among other things, that  SBA not extend the program after its expiration in December 2010  but instead evaluate the need for it. Rather than evaluate the  program, SBA ended it in April 2011 and replaced it with the new  Small Loan Advantage and Community Advantage  programs. SBA officials told us that while the agency annually  publishes loan program measures that incorporate initiatives such  as these, it had not evaluated the initiatives.
In an August 2012 report, we found that SBA lacked program  evaluations for 10 of the 19 entrepreneurial assistance programs  we reviewed. We recommended that SBA conduct more  program evaluations to better understand the reasons the  programs were not meeting their performance goals and to  determine the programs’ overall effectiveness. SBA did not say  whether it agreed or disagreed with the recommendation but did  take some steps to begin to address it. For example, SBA has  begun meeting monthly with other agencies as part of an OMB-led  interagency working group that shares best practices in program  evaluation and has started pilot programs to test evaluation  methods. However, we are unsure of SBA’s commitment to  conducting more program evaluations because as of May 2015,  the agency had not completed evaluations of any of the programs  covered by our recommendation. Therefore, we continue to  maintain that our recommendation has merit and should be fully  implemented.
In a September 2013 report, we found that SBA lacked an  evaluation plan to assess the performance of the Patriot Express  pilot loan program. As a result, we concluded that SBA was  unable to determine if the program was achieving its intended  goals. We recommended, among other things, that SBA design an  evaluation plan for pilot programs prior to implementation and  consider the results of such an evaluation before extending any  pilot. SBA responded to the report by stating that the agency  would consider our findings as it determined whether to extend the  program. Subsequently, SBA did not conduct a performance  evaluation of the program and instead decided to terminate the  program by allowing it to expire in December 2013. SBA replaced  the Patriot Express program with the Veterans Advantage initiative  in 2014. Although SBA officials told us the agency tracks  performance measures for its loan programs and keeps raw data  for each of the loan types (including veterans fee relief), the  agency had not evaluated the initiative as of May 2015 and had no  plans to do so.
In April 2014, the House Committee on Small Business held a  hearing on initiatives that SBA had created. The hearing explored  the committee’s concerns that SBA had requested funding for  potentially duplicative new programs while lacking adequate  performance metrics to measure their success or failure. While  they did not specifically address the lack of performance metrics  for all the programs discussed during the hearing, two SBA  witnesses cited the agency’s legislative authority for the new  initiatives. Our August 2012 report on entrepreneurial assistance  raised similar concerns about overlap in programs and stressed  the importance of program evaluations.
A senior SBA official acknowledged the agency’s challenges in  conducting program evaluations and stated that it was developing a  more systematic approach to conducting them, including determining  how to collect needed data. While he identified two ongoing studies,  he did not provide detailed information on the systematic approach,  an expected completion date, or whether the agency would prioritize  additional resources to conduct evaluations.
Without prioritizing resources to conduct more evaluations of its programs  and incorporating the results into its strategic planning process, SBA  lacks a critical source of information for ensuring the validity and  effectiveness of its goals, objectives, and strategies. In addition, SBA  lacks pertinent information that would help in determining the  effectiveness of both new and existing programs.
section_title: SBA Planning and Oversight Are Limited in Several Management Areas
paragraphs: SBA needs better planning and oversight in several key management  areas. We reviewed SBA’s management of its (1) human capital, (2)  organizational structure, (3) enterprise risk, (4) acquisition, and (5)  procedural guidance. We found that SBA continued to face long-standing  human capital challenges and had not completed development of a  workforce plan or training goals to help address them. We also found that  SBA faced a skill gap resulting from a 2004 reorganization, and as of  June 2015 SBA officials told us the agency had not completed an  assessment of its organizational structure. Further, SBA initiated in 2009  efforts to implement enterprise risk management but had only recently  begun assessing agency-wide risks and lacked adequate documentation  of its progress and future plans. In the area of acquisition management,  SBA hired a contractor to assess its acquisition operations and, as of May  2015, was in the process of finalizing its action plan in response to the  contractor’s findings. Finally, we found that SBA had not updated many of  its guidance documents that it had identified as outdated.
subsections: section_title: SBA Has Not Completed Its Workforce Plan or Developed Training Goals
paragraphs: As previously noted, SBA’s OIG has identified SBA’s need for effective  human capital strategies—the programs, policies, and processes that  agencies use to build and manage their workforces—as one of the most  significant management challenges facing the agency since 2001. We  have also identified challenges to SBA’s human capital management. For  example, in our January 2003 report on SBA’s management challenges,  we found that SBA needed to strengthen its human capital management  by, among other things, getting properly trained people into the right  places, identifying the knowledge and skills requirements of its  employees, and providing professional development opportunities as  needed.
According to SBA documents, the agency faces programmatic,  demographic, and budgetary challenges that have had an effect on its  workforce. To begin to address these challenges, SBA requested  Voluntary Early Retirement Authority and Voluntary Separation Incentive  Payments (VERA/VSIP) programs for fiscal years 2012 and 2014.  Agency officials said that the VERA/VSIP programs were intended to  allow SBA to begin reshaping its workforce to meet its ongoing needs in  light of its evolving mission. In its applications for these programs, SBA  identified the following challenges it faced.
Programmatic. SBA stated that its workforce faced an ongoing skill  gap resulting from the 2004 centralization of its loan processing  function. SBA noted that this organizational change resulted in a  gap between the competency mix of employees who had been hired  for one mission and the competency mix needed to accomplish a new  mission. Specifically, after loan processing was moved from the  district offices to loan processing centers, the district offices were  given new responsibilities, including business development and  outreach. These new responsibilities created a skill gap because  employees who were originally required to have a financial  background for loan processing were now required to have different  skills, such as a marketing background and interpersonal skills. SBA  stated that the skill gap was particularly pronounced among 885  employees in two job series—GS-1101 and GS-1102. These  employees include business opportunity specialists, economic  development specialists, and procurement staff. According to SBA,  despite its efforts during the last several years to address this skills  imbalance through training and the fiscal year 2012 VERA/VSIP,  among other things, the competency gap remains. SBA also noted  that the skill gap had been compounded by recent changes in job  requirements and new initiatives that required new skill sets for its  employees.
Demographic. SBA has stated that it has a high number of  employees who will retire or will become eligible to retire in the next 5  years. As of June 24, 2014, about 25 percent of SBA employees were  eligible to retire, and 50 percent will be eligible in 2019. According to  SBA, its aging workforce presents two issues. First, 43 percent of  those fully eligible to retire work in two mission-critical job series—GS- 1101 and GS-1102—that have a significant competency gap, but SBA  noted that using attrition to obtain a better competency mix in the GS- 1101 job series would be slow. SBA thought that offering VERA/VSIP  programs would give it an opportunity to more quickly reshape its  workforce to obtain the needed competencies and skill set. Second,  SBA stated that the high number of retirement-eligible employees  meant that the agency needed a pipeline of new leaders. Creating this  pipeline could mean increasing the number of employees who were at  the early stages of their careers.
Budgetary. SBA has also stated that current economic challenges  mean that the agency cannot afford to retain staff with skills that do  not support its mission. SBA noted that the fiscal years 2012 and  2014 VERA/VSIP programs kept the agency from having to  implement a reduction in force in order to meet budgetary constraints,  which would have exacerbated the skills imbalance. Specifically, SBA  stated that under reduction-in-force procedures, the agency would  lose the types of employees it had recently been recruiting—those  with the needed mix of competencies to better ensure SBA’s mission  success.
SBA has recently developed goals and objectives for its strategic human  capital plan and has developed an accountability policy, steps that should  help improve its human capital management. It also obtained authority for  the two VERA/VSIP programs that it believed would help reshape its  workforce.
Strategic human capital plan. OPM requires agencies to have  documented evidence of a current agency human capital plan that  includes human capital goals, objectives, and performance  measures. Additionally, in our 2003 report on strategic workforce  planning we concluded that periodic measurement of an agency’s  progress toward human capital goals provided information for  effective oversight by identifying performance shortfalls and  appropriate corrective actions. SBA’s fiscal years 2013-2016  strategic human capital plan incorporates these practices. For  example, the plan identifies human capital goals and objectives, such  as building strategic partnerships and incorporating human capital  flexibilities, and is designed to support SBA’s agency-wide strategic  plan, particularly SBA’s strategic objective to invest in its employees.  The plan also includes action items and performance measures that  SBA tracks annually and demographic information about SBA’s  workforce.
Human capital accountability policy. OPM requires agencies to  have documented evidence of a human capital accountability system  that provides for an annual assessment of agency human capital  management progress and results. SBA has developed a human  capital accountability policy that outlines SBA’s processes for  evaluating its human capital systems and a multiyear schedule for  conducting human resource program assessments.
VERA/VSIP programs. As discussed previously, SBA requested  VERA/VSIP authority for fiscal years 2012 and 2014 in hopes that  these initiatives would enable the agency to begin reshaping its  workforce to meet its ongoing needs. In both years, OPM authorized  SBA to offer this authority to 300 employees.
subsections: section_title: Workforce Planning
paragraphs: SBA has taken several other steps to begin addressing its human capital  management challenges, including working toward a workforce plan and  identifying mission-critical competencies. According to federal internal  control standards, workforce planning is a key internal control that allows  agency management to ensure that skill needs are continually assessed  and that the organization is able to obtain and maintain a workforce with  the skills necessary to achieve organizational goals. Although agencies  may take various approaches to workforce planning, in a December 2003  report we identified key principles they should address. SBA has taken  some recent actions to incorporate these principles but has not completed  a formal workforce plan that fully incorporates them (see table 2).
Workforce plan. SBA indicated in its fiscal years 2013-2016 strategic  human capital plan that it was working on a separate workforce plan.  SBA officials said that they had taken steps to develop the plan but as  of May 2015 had not completed it. SBA officials told us that they  had been unable to complete the workforce plan because a current  agency-wide competency and skill gap assessment was necessary to  develop it. As discussed in more detail later, they have not yet  completed this assessment because of a delay in deploying the  system needed to conduct it. As stated earlier, SBA has faced a long- standing skills imbalance resulting from organizational changes dating  to 2004.
Critical skills and competencies. SBA has taken steps to identify  competencies for its mission-critical occupations. For example, in  2011 SBA conducted competency assessments for its human  resources staff and its managers and supervisors. In addition, in  fiscal year 2013 SBA’s Office of Human Resources Solutions  reviewed 31 of SBA’s mission-critical position descriptions, developed  competency lists, and requested that program offices review and  make adjustments to those lists. SBA’s Office of Disaster Assistance  has also taken steps to identify competencies for its employees by  developing a baseline competency framework based on OPM- recommended competencies, current position descriptions,  performance goals, and organizational strategic goals.
However, SBA has not completed an agency-wide competency and  skill gap assessment since 2006, and an up-to-date assessment is  critical for determining whether there are additional skill gaps in its  current workforce. In 2012, SBA began using an electronic system  called the Talent Management Center to manage employee training  and performance. The system consists of two components—a  learning management module and a performance management  module. The learning management module is a software application  that provides SBA employees with access to online training courses  and allows employees to track their training. The performance  management module allows employees to track their performance  goals and evaluations. According to SBA officials, the contractor that  implemented the Talent Management Center was also going to  implement a tool as part of the learning management module that  would allow SBA to conduct a competency and skill gap assessment.  However, SBA was unable to conduct the assessment because the  contractor did not deploy the tool on time as planned. SBA officials  told us the agency had contracted with another vendor to conduct the  assessment during fiscal year 2015 and had held several meetings  with the vendor to discuss the methodology and process for the  assessment as of June 2015.
Gap-closure strategies. As discussed earlier, SBA has taken initial  steps aimed at addressing the skills imbalance in its workforce that  resulted from its 2004 organizational change. SBA’s VERA/VSIP  programs in fiscal years 2012 and 2014 were intended to provide the  agency needed flexibility to address this skills imbalance by creating  vacancies that would allow it to strategically recruit new employees  who have the needed competencies and skills. Under the VERA/VSIP  programs, a total of 327 employees left the agency, but this number  was lower than SBA expected. In addition, SBA has developed a  Leadership Succession Plan. The purpose of the plan is to strengthen  current and future agency leadership capacity by creating leadership  readiness programs and adopting a succession planning model to  develop pools of potential leaders. The plan also outlines other  succession strategies, such as job rotations to broaden employees’  understanding across different functional areas of the agency and a  mentoring program to help employees clarify career goals and  analyze strengths and developmental needs. In addition, a senior  SBA official stated that improving human capital management was a  priority for the Administrator and that SBA was focused on developing  different ways to recruit a younger and more diverse workforce. For  example, SBA has revised its Presidential Management Fellows  program with the goal of improving retention and is working with the  Peace Corps to identify returning volunteers who may be interested in  a career in public service.
Despite these steps, SBA does not have a current agency-wide  competency and skill gap assessment and as a result cannot develop  and document an effective long-term strategy to fully address its  previously identified skill gaps and any additional skill gaps that may  exist. SBA officials told us they had not developed a long-term plan  because they were relying in part on their VERA/VSIP programs to  help reshape SBA’s workforce to address its long-standing skills  imbalance. SBA developed guidance outlining how vacancies were to  be filled after the fiscal year 2014 VERA/VSIP program, and SBA  officials stated that options for restructuring and related hiring  following this program were still being considered as of May 2015.  However, because both the fiscal year 2012 and fiscal year 2014  VERA/VSIP programs resulted in a smaller-than-expected number of  retirees, whether these efforts will ultimately allow SBA to reshape its  workforce to achieve its needed skill mix is unclear.
Support capacity. Although SBA has policies in place that enable the  use of human capital flexibilities to support its workforce, such as a  recruitment and retention incentives policy, the use of these  flexibilities is not directly tied to a workforce plan.
Evaluation. SBA has taken steps to monitor and evaluate its progress  toward its human capital goals through its human capital  accountability policy and tracking progress of the measures in its  strategic human capital plan. However, because SBA has not  established a strategic workforce plan, the agency has not monitored  and evaluated the results of its workforce planning efforts.
Without a workforce plan that fully addresses key principles, including a  current agency-wide competency and skill gap assessment and a long- term strategy to close skill gaps, SBA cannot provide reasonable  assurance that its workforce has the skills needed to meet the agency’s  mission. For example, having a current assessment and completed  workforce plan prior to its early retirement programs would have helped  SBA target its hiring and retention efforts. Without having first taken these  steps, SBA risked compromising its efforts to reshape the agency.
section_title: Training and Development
paragraphs: In a 2004 report, we concluded that effective training and development  programs are an integral part of a learning environment that can enhance  an agency’s ability to attract and retain employees with the skills and  competencies needed to achieve results. We also noted that training  and development programs help an agency achieve its mission and meet  its goals by improving individual and ultimately organizational  performance.
In the same 2004 report, we identified key principles that could help  federal agencies produce a strategic approach to their training and  development efforts. SBA has taken steps to incorporate these principles  but has only partly incorporated them (see table 3).
Planning. SBA officials told us that SBA had conducted a training  needs assessment in the summer of 2014, which helped the agency  identify a list of top training courses for its employees. SBA also  developed a fiscal years 2014-2015 training plan that outlines SBA’s  major training programs and activities. However, the plan does not  fully establish a strategic approach to training that would help achieve  agency results. First, it does not establish training goals and related  performance measures to help SBA determine whether its training  and development programs are achieving their intended results.
SBA officials told us that they had not developed these goals and  measures because the employees developing the plan had left the  agency, but that they planned to develop them for the next iteration of  the training plan. However, as of June 2015, SBA did not have an  expected completion date for the revised plan. Second, as previously  discussed, SBA has not conducted a competency and skill gap  assessment since 2006. Third, SBA officials told us that the training  plan incorporated input from supervisors but did not directly  incorporate employee development goals because the agency was  not required to have individual development plans for its staff.  However, while SBA is not required to have individual development  plans, it could choose to require them or to obtain employee  development goals through other means.
Design and development. SBA has also taken steps to identify  specific training and development initiatives. For example, as  discussed earlier SBA recently began using an electronic system  called the Talent Management Center which, among other things,  allows employees to take certain training courses online. SBA officials  stated that SBA is currently developing the curriculum for its online  courses in consultation with program office management, supervisors,  and hiring managers. SBA officials told us that they decided to use  this system due to its cost-effectiveness and flexibility. The training  plan also identifies a number of other training initiatives, such as a  leadership development program. However, whether these training  and development initiatives are directly connected to improving  individual and agency performance is unclear. For example, although  SBA launched an electronic learning module and is developing a  curriculum for it, the lack of a completed competency assessment  makes it difficult to specifically design the curriculum to improve  individual performance. Furthermore, while SBA offers a mix of  centralized and decentralized training programs, a recent training  assessment it conducted found that the decentralized training that  program offices provide receives no review or oversight to detect  duplicative offerings or identify opportunities to provide training more  effectively and efficiently. According to SBA officials, its new electronic  learning module will enable the agency to track and monitor both  decentralized and centralized training. In addition, a senior SBA  official stated that SBA was considering ways to offer more systematic  training and mentorship programs.
Implementation. SBA officials told us that they had taken steps to  communicate information about training efforts to employees by, for  example, publishing notices about upcoming training opportunities in  the SBA Daily. SBA officials also told us that they had provided  employees with training on how to use SBA’s new electronic learning  module and training for each staff member on their positions as part of  their professional development. However, whether SBA has taken  actions to foster an environment conducive to effective training and  development is unclear. For example, results from SBA’s 2014  Federal Employee Viewpoint Survey (FEVS) showed that just over  one-third of employees felt that their training needs had been  assessed. Specifically, in response to a question asking whether  their training needs were assessed, 39.22 percent (537 employees)  agreed or strongly agreed, 24.82 percent (341 employees) neither  agreed nor disagreed, and 35.96 percent (489 employees) disagreed  or strongly disagreed. In addition, about 40 percent indicated that  they were satisfied with the training they had received. Specifically, in  response to a question asking whether they were satisfied with the  training they had received for their present job, 39.93 percent (533  employees) were satisfied or very satisfied, 25.48 percent (343  employees) were neither satisfied nor dissatisfied, and 34.59 percent  (457 employees) were dissatisfied or very dissatisfied. The SBA  district office employees we interviewed also expressed mixed views  about the training provided by SBA. For example, three employees  stated that they received helpful training related to their positions.
However, 15 employees described difficulties obtaining the training  they needed. For example, 9 of these employees—including 4  lender relations specialists, 2 economic development specialists, and  1 business opportunity specialist—stated that they did not receive any  formal training related to their positions. Two employees stated that  they had multiple job responsibilities but did not receive the training  needed to perform them all. The other 4 employees stated that the  training they did receive was not helpful or relevant to meeting their  job responsibilities.
Evaluation. In fiscal year 2012, SBA’s Office of Human Resources  Solutions established an accountability function in its Strategy, Policy,  and Accountability Division with responsibility for conducting internal  assessments. The program assessment schedule calls for reviewing  SBA’s training programs annually, and SBA conducted its first  assessment of the centralized training program under this schedule in  2013. SBA found significant weaknesses and areas of  noncompliance with regulatory requirements, including not having  evaluated its training programs on a regular basis, not maintaining  records of training and expenditures, and not addressing federally  mandated training requirements in written policies. The assessment  contained 14 required actions designed to strengthen SBA’s training  and development programs and ensure regulatory compliance. In  April 2015, SBA completed its fiscal year 2014 assessment of its  training program to determine the agency’s progress on correcting  these deficiencies and found that 10 of the 14 required actions  remained incomplete. SBA stated that it planned to assess its  training program again at the end of fiscal year 2015.
Without a more strategic approach to its training and development  programs, including incorporating training goals and measures and input  on employee development goals in its training plan, it will be difficult for  SBA to effectively establish priorities in its training initiatives or address  skill gaps.
section_title: Employee Performance Management
paragraphs: In our 2003 report on results-oriented cultures, we identified key  principles in employee performance management. We concluded that  an effective employee performance management system can be a  strategic tool to drive internal change and achieve desired results.  Specifically, we concluded that employee performance management  systems must show how team, unit, and individual performance can  contribute to overall organizational results and that the system serves as  the basis for setting employee expectations and for evaluating individual  performance.
In 2011, SBA updated critical elements and performance standards for its  employees in the field, and in 2012 began using a new electronic system  to manage performance (the Talent Management Center). But it did not  update its March 15, 2000, SOP before the new system and standards  were implemented. According to a recent SBA assessment of its  performance appraisal program, the existing SOP does not reflect the  agency’s current practices. SBA officials stated that as of August 2015  they had revised the SOP, it had been signed by the Administrator, and it  was in the process of being published. Prior to finalizing its SOP, SBA  officials stated that the agency had provided employees with guidance on  using the new electronic system and on new performance standards for  the field.
Our review of a set of critical elements and performance standards that  we received from SBA indicated that field office employees are primarily  evaluated on the basis of quantitative measures. For example,  business opportunity specialists are evaluated in part on their  participation in outreach events and procurement visits to assigned  entities. In order to receive the highest rating of five for these activities,  these specialists must conduct or participate in more than 65 events  annually. According to the elements and standards, supervisors are  responsible for monitoring the quality of employee activities. The  elements and standards do not describe what criteria supervisors should  apply to make that determination, but SBA officials stated that SBA  provides program offices with guidance on incorporating qualitative  measures.
Some of the 58 SBA managers and employees we spoke with in SBA’s  regional and district offices expressed mixed views about SBA’s new  employee performance management system. For example, 11 (10  managers and 1 nonmanager) said the system clearly laid out employee  performance expectations. However, some managers and employees  criticized certain aspects of SBA’s employee performance management  system. Specifically, 5 (2 managers and 3 nonmanagers) said the  performance appraisal elements and standards focused primarily on  quantitative measures and did not account for quality. As discussed  earlier, our review of a set of critical elements and performance standards  also indicated a lack of qualitative measures. In addition, 6 (3 managers  and 3 nonmanagers) stated that there were problems with technical  aspects of the electronic performance system. For example, 4 (1  manager and 3 nonmanagers) said that they had to track their  performance activities in separate systems that did not communicate with  one another. Employees responding to SBA’s 2014 FEVS also expressed  mixed views about SBA’s employee performance management system.  For example, in response to a question asking whether SBA employees  understood what they had to do to be rated at different performance  levels, 71.87 percent (986 employees) agreed or strongly agreed, 11.20  percent (158 employees) neither agreed nor disagreed, and 16.92  percent (229 employees) either disagreed or strongly disagreed. In  response to another question asking employees whether they believed  their performance appraisal was a fair reflection of their performance,  68.06 percent (938 employees) agreed or strongly agreed, 13.03 percent  (180 employees) neither agreed nor disagreed, and 18.91 percent (254  employees) either disagreed or strongly disagreed. However, in  response to a question asking whether differences in performance were  recognized in a meaningful way, 36.09 percent (472 employees) agreed  or strongly agreed, 24.90 percent (324 employees) neither agreed nor  disagreed, and 39.01 percent (509 employees) disagreed or strongly  disagreed. SBA officials told us that a committee of district directors  was working with the Office of Human Resources Solutions to bring  qualitative components back into the performance appraisal elements and  standards for the field offices and resolving technical problems with the  system. SBA officials stated that these efforts were ongoing, but the  agency does not have an expected completion date.
section_title: SBA Also Faces Ongoing Organizational Challenges
paragraphs: Despite long-standing organizational challenges affecting program  oversight and human capital management, SBA officials told us that as of  June 2015, SBA had not completed an assessment of its structure or  made any needed changes to determine how to address the challenges.
In a January 2003 report on SBA’s management challenges, we found  that the agency’s organizational structure created complex overlapping  relationships among offices that contributed to challenges in delivering  services to small businesses. In 2004, SBA centralized its loan  functions by moving responsibilities from district offices to loan processing  centers. However, some of the complex overlapping relationships we  identified in 2003 still exist (see fig. 6). Specifically, SBA’s  organizational structure often results in working relationships between  headquarters and field offices that differ from reporting relationships,  potentially posing programmatic challenges. District officials work with  program offices at SBA’s headquarters to implement the agency’s  programs, but these officials report to regional administrators, who  themselves report to the Office of Field Operations. For example, the  lender relations specialists in the district offices work with the Office of  Capital Access at SBA headquarters to deliver programs but report to  district office management. Similarly, the business opportunity specialists  in the district offices work with the Office of Government Contracting and  Business Development at SBA headquarters to assist small businesses  with securing government contracts but report to district office  management. Further, some officials have the same duties. The public  affairs specialists at the district offices and the regional communications  directors both handle media relations. In addition, district directors and  regional administrators both are to conduct outreach to maintain  partnerships with small business stakeholders such as chambers of  commerce; lending institutions; economic development organizations;  and federal, state, regional, and local governments. They also participate  in media activities and speak at public events.
In later reports, we and others—including SBA itself—identified  organizational challenges that affected SBA’s program oversight and  human capital management.
In a March 2010 report on the 8(a) business development program,  we found a breakdown in communication between SBA district offices  and headquarters (due in part to the agency’s organizational  structure) that resulted in inconsistencies in the way district offices  delivered the program. For example, in about half of the 8(a) files  we reviewed, we found that district staff did not follow the required  annual review procedures for determining continued eligibility for the  program. This was due in part to the lack of clear guidance from  headquarters. In addition, we found that confusion over roles and  responsibilities led to district staff being unaware of the types and  frequency of complaints across the agency on the eligibility of firms  participating in the 8(a) program. As a result, district staff lacked  information that could be used to help identify issues relating to  program integrity. As discussed earlier, we made six  recommendations, including that SBA provide more guidance to help  ensure staff more consistently follow procedures, and SBA agreed  with them. As of July 2015, SBA had taken actions responsive to four  of the recommendations.
In addition, in 2013 the SBA OIG found that communication from a  headquarters program office to field offices about conducting  examinations for a specific program had been limited. The report  noted that this lack of communication could have not only inhibited the  sharing of crucial information but also caused inconsistencies in the  examinations across field offices. It concluded that these weaknesses  in the examination process had diminished the agency’s ability to  identify regulator violations and other noncompliance issues in the  operation of the program. The OIG recommended that SBA create  and execute a plan to improve the internal operations of the  examination function, including a plan for better communication.  Although SBA disagreed with the recommendation, the agency issued  examination guidelines that the OIG in 2015 deemed satisfactory to  close the recommendation.
In documentation requesting fiscal years 2012 and 2014 VERA/VISP  programs, SBA said that long-standing skill gaps, primarily in field  offices, which had resulted from the 2004 reorganization and  centralization of the loan processing function, still existed. SBA  determined that its organizational changes had resulted in a  programmatic challenge because employees hired for a former  mission did not have the skills to meet the new mission. Specifically,  before the centralization effort field offices had primarily needed staff  with a financial background to process individual loans. But the new  mission required staff who could develop socially and economically  disadvantaged businesses and conduct annual financial reviews of  them, engage with lenders, and conduct outreach to small  businesses.
Despite the organizational and managerial challenges it has faced, SBA’s  changes to its organizational structure since fiscal year 2005 have been  incremental (piecemeal), as the following examples illustrate:  In 2007, SBA reorganized five program offices and four administrative  support functions in order to clearly delineate reporting levels, among  other things. The agency also eliminated the Chief Operating  Officer as a separate office and integrated its functions into the Office  of the Administrator.
In 2008, the Office of Equal Employment Opportunity and Civil Rights  Compliance began reporting directly to the Associate Administrator for  Management and Administration to facilitate better oversight,  planning, coordination, and budgeting for all of the agency’s  administrative management operations.
In 2010, SBA consolidated financial management by moving its  procurement function to the Office of the Chief Financial Officer and  transferring day-to-day procurement operations from headquarters to  the agency’s Denver Finance Center. This change was intended to  improve the efficiency and effectiveness of SBA’s acquisition  programs.
In 2011, SBA restructured the Office of Human Capital Management  in response to significant turnover that had a serious effect on the  level and scope of services. The reorganization streamlined the office,  which was renamed the Office of Human Resources Solutions, by  reducing the number of branches and divisions.
In 2012, new offices were created in the Office of Capital Access to  respond to, among other things, growth in small business lending  programs and increased servicing and oversight responsibilities  following the 2007-2009 financial crisis. The changes sought to  help the agency become a better partner with lending institutions and  nonprofit financial organizations to increase access to capital for small  businesses.
In 2012, SBA established a headquarters unit within the Office of  Government Contracting and Business Development and made it  responsible for processing the continued eligibility portion of the  annual review required for participants in the 8(a) program. Prior to  this change, district officials, who are also responsible for providing  business development assistance to 8(a) firms, were tasked with  conducting exams of continued eligibility. While district officials have  continued to perform other components of the annual review, shifting  the responsibility for processing continued eligibility to headquarters  was designed to eliminate the conflict of interest for district officials  associated with performing both assistance and oversight roles.
In 2012, the Office of Field Operations revamped field office  operations following a 2010 review of all position descriptions to  ensure that they aligned with SBA’s strategic plan and district office  strategic plans. Many position descriptions were rewritten, although  there were no changes in grade or series. Before the review, district  offices had two principal program delivery positions—lender relations  specialist and business development specialist. As a result of the  review, descriptions for both positions were rewritten, and the  business development specialist position became two—economic  development specialist and business opportunity specialist. The skills  and competencies for the new position descriptions focused on the  change in the district offices’ function from loan processing to  compliance and community outreach in an effort to address skill gaps.  As a result, staff were retrained for the rewritten positions.
In 2013, SBA reestablished the Office of the Chief Operating Officer  (formerly the Office of Management and Administration) to improve  operating efficiency. Among other things, this change transferred  Office of Management and Administration staff to the reestablished  office, along with the Office of the Chief Information Officer and the  Office of Disaster Planning, which saw its mission expanded to  include enterprise risk management.
While SBA has made incremental changes, SBA officials told us that as  of June 2015, the agency had not completed an evaluation of its  organizational structure and made changes as necessary in response to  changing conditions. According to federal internal control standards,  organizational structure affects the agency’s control environment by  providing management’s framework for planning, directing, and  controlling operations to achieve agency objectives. A good internal  control environment requires that the agency’s organizational structure  clearly define key areas of authority and responsibility and establish  appropriate lines of reporting. Further, internal control guidance suggests  that management periodically evaluate the organizational structure and  make changes as necessary in response to changing conditions. Since  its last major reorganization in 2004, SBA has seen significant changes,  including decreases in budget and an increase in the number of  employees eligible to retire.
In 2012, the agency committed to assessing and revising its  organizational structure to meet current and future SBA mission  objectives. However, the contractor that SBA hired to assess its  organizational structure did not begin its assessment until November  2014. SBA officials told us that the effort was delayed because in  February 2013 SBA’s Administrator announced she was leaving the  agency and the position was vacant from August 2013 until April 2014. In  August 2015, SBA told us that after the new administrator reviewed  business delivery models and became acclimated to the agency, the  agency procured a contractor and work began on the organizational  assessment in November 2014. According to the statement of work, the  contractor was to assist the chief human capital officer by making  recommendations regarding an agency-wide realignment to improve  service delivery models, modernize systems and processes, and realign  personnel, among other things. During the course of our review, SBA  officials told us the contractor completed its assessment in March 2015,  but SBA had not finished analyzing the results and determining what  organizational changes, if any, to make. In its August 2015 comments on  a draft of this report, SBA noted that the agency had recently completed  that review and determined that major restructuring was not warranted at  the time. However, SBA did not provide us with any documentation that  shows when the assessment was completed or that supports its  conclusions that major changes were not warranted. Until SBA  documents its assessment, it will not have an institutional record of its  actions.
Instead of conducting its planned assessment and subsequent  reorganization when initially scheduled, SBA used two VERA/VSIP  programs to attempt to address workforce challenges resulting from the  2004 reorganization. SBA’s plans in the aftermath of the fiscal year 2014  VERA/VSIP program include restructuring. Specifically, an October 2014  guidance memorandum on staffing the agency-wide vacancies after the  fiscal year 2014 VERA/VSIP stated that an Administrator’s Executive  Steering Committee for SBA’s Restructuring would make decisions about  restructuring. The memorandum also stated that the Chief Human  Capital Officer had been tasked with identifying vacant FTEs for new  positions that would support any new functions or initiatives envisioned by  the Administrator’s restructuring efforts. For example, the memorandum  noted that 82 of the 147 new vacancies from the VERA/VISP would be  used to support the Administrator’s restructuring. The memorandum  added that the remaining 65 vacancies would remain in their respective  program offices and that the position descriptions would be modified or  positions relocated to meet internal needs. According to SBA, options for  restructuring and related hiring were still being considered as of May  2015.
Although SBA told us that it has recently completed an assessment of its  organizational structure, it had not documented this effort as of August  2015. Until it documents its efforts to examine its structure and any  findings, it will be difficult for SBA to provide reasonable assurance, or for  a third party to validate, that SBA’s current organizational structure is  contributing effectively to its mission objectives and programmatic goals.
section_title: SBA Lacks Documentation on and Has Made Limited Progress in Implementing an Effective Enterprise Risk Management Process
paragraphs: Given the range of programs SBA manages and oversees, having a  robust enterprise risk management system is critical to effectively  managing risks. SBA initiated efforts to implement enterprise risk  management in 2009, noting the importance of managing the range of  cross-agency risks it faces. However, it could not provide us with  adequate documentation on the progress of these efforts or on any future  plans and had only recently begun assessing agency-wide risks. SBA  began its enterprise risk management efforts in 2009 with the designation  of an unofficial chief risk officer but considers itself to be in the “early  stages” of implementation. In 2013, SBA established an Office of  Enterprise Risk Management under the chief operating officer and  developed a process to guide its approach. SBA officials told us that they  had developed this process based in part on recommendations made by  Deloitte & Touche as part of that organization’s review of the risk  management practices within SBA’s Office of Capital Access. In the  course of our work, SBA provided a graphic depicting the five phases of  its enterprise risk management process: (1) identify risk; (2) assess risk;  (3) strategize response; (4) implement; and (5) monitor and report (see  fig. 7). The agency also provided a brief summary of the progress it  had made in implementing these phases. However, the agency could not  elaborate on and did not provide any other documentation of its process,  including on the goals it hoped to achieve or the specific actions it  planned to take during each phase. Federal internal control standards  require that significant actions be clearly documented in, for example,  management directives, administrative policies, or operating manuals.
Although SBA’s enterprise risk management plans and efforts to date are  not fully documented, we used available information to compare SBA’s  process to our risk management framework (see table 4). GAO’s risk  management framework calls for the following five phases and lays out  key elements for each: (1) defining strategic goals, objectives, and  constraints: (2) assessing risk; (3) evaluating alternatives; (4) selecting  responses; and (5) implementing and monitoring. As table 4 shows,  SBA has partially implemented two phases of its risk management  process and those phases partially align with one phase of our  framework. Specifically, SBA has begun to identify and assess risks,  which partially aligns with our risk assessment phase. However, we rated  SBA as not following the other four phases of our framework, as it had not  yet made progress on implementing the remaining phases of its process.
Strategic goals, objectives, and constraints. Our risk assessment  framework calls for fully documenting strategic goals and objectives,  which should be clearly articulated and measurable, as well as any  limitations or constraints that may limit effective risk management. In  October 2014, the SBA Administrator approved the formation of an  Enterprise Risk Management Board to ensure that the greatest risks  to the agency are regularly identified, assessed, and monitored. The  Administrator approved the membership of the board on April 24,  2015. According to officials, the board plans to develop a charter by  September 2015. However, because the board met for the first time  on April 30, 2015, SBA had not yet documented the strategic goals  and objectives it is attempting to achieve, the steps needed to attain  these results, or the constraints under which the agency operates, as  of May 2015.
Risk assessment. Our framework calls for identifying potential events  that can adversely affect the agency and evaluating them based on  the likelihood of occurrence and impact. SBA officials told us that as  of November 2014, officials in SBA’s risk management office had  interviewed program office leaders and reviewed agency processes to  draft an inventory of risks and complete an initial assessment. The  officials explained that they needed to further refine this assessment  and that the Enterprise Risk Management Board would determine  additional steps. However, because the board was still reviewing the  draft risks as of May 2015, SBA has not completed the risk inventory  or developed procedures to identify and evaluate the potential risks to  the agency’s ability to achieve its goals and objectives.
Alternatives evaluation. Our framework calls for identifying  alternative ways the agency can prevent or manage an identified risk  while taking into consideration the costs and benefits of the  alternatives. However, to date, SBA has not been able to consider  managing risks because it has not completed the risk assessment  process. According to SBA, risk responses will be guided by the
Management selection. Our framework requires management to  select and document responses to potential risks and provide a  rationale for its selections. To date, SBA has not proceeded to this  step. As noted earlier, SBA told us that the Enterprise Risk  Management Board would guide risk responses.
Implementation and monitoring. Our framework includes  implementing management’s selected alternatives to address risks  and periodically assessing the efficiency and effectiveness of the  entire risk management program. Because it has not identified risks  and possible responses to them, SBA cannot proceed to this step.  According to SBA officials, the Office of Risk Management will  maintain records of the Enterprise Risk Management Board’s  decisions and follow up with the chief risk officer to ensure that the  steps the board decides on are implemented.
According to a senior SBA official, the Enterprise Risk Management  Board will be assessing SBA’s risks in the near future, and he plans to  ask the Board to consider our risk management framework at that time.
Given the long-standing management challenges related to specific SBA  programs discussed earlier, it may be challenging for SBA to establish an  agency-wide system. However, until SBA identifies and fully documents  the steps that it plans to take to implement its enterprise risk management  process and incorporates the elements of our risk management  framework, it will not be able to provide reasonable assurance that its  enterprise risk management efforts effectively identify, assess, and  manage risks before they can adversely affect SBA’s ability to achieve its  mission.
section_title: SBA Has Met Its Contracting Goals and Taken Steps to Address Acquisition Management Challenges
paragraphs: SBA has met its small business contracting goals and taken steps to  address acquisition management challenges. Contracting represents a  small portion of SBA’s obligations. SBA’s total contract obligations for  fiscal year 2014 were approximately $116.6 million, compared with total  obligations for fiscal year 2014 of about $845.8 million. But the agency in  recent years has exceeded its primary goals for awarding contracts to  small businesses. By statute, federal agencies are to award 23 percent  of their prime contract funds to small businesses. To help meet this  government-wide goal, each agency has its own individual goal. In fiscal  year 2013, of approximately $106.7 million in total small business-eligible  contracting dollars, SBA awarded $76.8 million to small businesses,  exceeding the agency’s goal of 67 percent (see table 5).
Despite these successes, over the last several years the SBA OIG has  identified deficiencies in several areas of SBA’s acquisition management,  including  lack of compliance with laws and regulations, such as the Improper  Payments Information Act requirements for planning, execution, and  reporting of improper payments for its contracting activities; inadequate application of funding principles, including obligating funds  by issuing contract modifications without identifying specific  requirements for IT hardware and software; and turnover in key contracting staff, resulting in a workforce insufficient to  effectively award, administer, and oversee contracts.
SBA has taken steps to address some of these deficiencies. In October  2010, SBA realigned its acquisition program by transferring its  procurement function and operations to the Office of the Chief Financial  Officer’s Denver Finance Center and rebranding it the Acquisition  Division. This redesign was intended to improve the efficiency and  effectiveness of the acquisition program by integrating acquisition and  procurement activities. Since this realignment, SBA has taken further  steps to improve the acquisition process, including hiring new staff and  providing training to its acquisition personnel. Specifically, according to its  fiscal year 2014 Acquisition Human Capital Plan, in fiscal year 2011 SBA  hired 17 new employees in the acquisition office. Each employee was  given a plan with measureable outcomes and over 50 hours of individual  job-specific training. In addition, in fiscal year 2011 SBA reinstituted its  Contract Review Board, giving greater oversight to high-risk contracts.  Members of the board include the chief acquisition officer, senior  procurement executive, and director of procurement law.
However, in its most recent report on SBA’s management challenges, the  SBA OIG noted that while SBA had made some progress in its acquisition  program, the program continued to face challenges, including (1) poorly  defined requirements, (2) internal control deficiencies, (3) inadequate  oversight of contractor performance, and (4) an incomplete acquisition  SOP. Specifically, the fiscal year 2015 report noted that SBA, among  other things, had inadequately monitored contract performance and did not provide  assurance that products and services were delivered according to  contract requirements; updated its acquisition SOP but did not include elements such as the  use of interagency acquisitions or define postaward contract  administration requirements, among other things; and did not complete the acquisition assessment required in OMB’s  Memorandum for Chief Acquisition Officers: Conducting Acquisition  Assessments under OMB Circular A-123.
The OIG made recommendations to SBA to address these issues,  including (1) completing an assessment of the agency’s acquisition  activities using OMB guidance; and (2) creating and implementing a  comprehensive improvement plan—based on the results of the  acquisition function assessment—that has measurable goals, objectives,  prioritized actions, and time frames to address any identified deficiencies.  In response to these recommendations, SBA awarded a contract for an  assessment of its acquisition function. This assessment—completed at  the end of March 2015—included a functional assessment of SBA  acquisition operations using OMB Circular A-123, Appendix 1,  “Guidelines for Assessing the Acquisition Function,” which describes the  four cornerstones of acquisition management: organizational alignment  and leadership, policies and processes, human capital, and information  management and stewardship. In its final report, the contractor noted  that SBA’s decision to realign acquisition and procurement functions  under the direction of the chief financial officer was consistent with the  practices of many of the Chief Financial Officers Act agencies and other  small independent agencies. However, the contractor found several  shortcomings with the agency’s internal controls in each of the four  cornerstones. For example, the contractor noted a lack of clarity on the  roles and responsibilities of the various stakeholders in the acquisition  process. While most people understood their general role in the  acquisition lifecycle, their specific responsibilities were not clearly defined.  The contractor noted that this lack of clarity lead to gaps and  inconsistencies in the acquisition process. Similarly, while the contractor  found that SBA had SOP documents for its acquisition process, for the  most part they restated the Federal Acquisition Regulation guidelines and  did not describe the processes as they exist or should exist at SBA. As  such, these SOPs had limited value in creating operational consistency  and did not serve as useful training tools for new members of the  acquisition team. Further, the contractor noted that performance  standards, while incorporated into all procurements, were generic and  lacked the specificity to guide desired outcomes. The contractor made  several recommendations to SBA to support the establishment,  assessment, and correction of internal controls in these four areas.
Using the findings and recommendations identified from the functional  assessment, the contractor was to develop a formal plan that addressed  each cornerstone and would serve as an action plan to implement the  contractor’s recommendations for SBA’s acquisition operations.  According to SBA officials, the contractor had delivered this plan to SBA  as of May 2015, but the Office of the Chief Financial Officer had not  finalized its plan and had no time frame for doing so.
section_title: Many Guidance Documents Were Outdated
paragraphs: We found that SBA’s inventory of SOPs—guidance for its staff and  external parties—included outdated SOPs that did not align with current  program requirements as well as SOPs that the agency had previously  canceled. Federal internal control standards state that documentation— which helps managers control their processes and is essential for  evaluating and analyzing operations—must be properly managed and  maintained to ensure proper stewardship of and accountability for  government resources and effective and efficient program results.
Based on our review of an inventory of 153 internal and external SOPs,  we found that nearly half (71) had not been updated in the last 10  years. Furthermore, 36 of these 71 had not been updated since the  1990s, and 19 had not been updated since the 1980s. These SOPs  covered a number of programs and organizational processes. While not  all SOPs may need to be updated on a regular basis, federal internal  control standards state that internal controls and all transactions and  other significant events need to be clearly documented and that all  documentation and records should be properly managed and  maintained.
We and the SBA OIG have found that some of the SOPs that SBA  updated in the last few years did not align with current program  requirements. For example, we found in a February 2015 report that SBA  had updated its SOP for the HUBZone program in 2007 but that the  program subsequently underwent significant changes that the updated  document did not reflect. Similarly, as noted earlier, SBA overhauled its  employee performance standards in 2011 but did not update its  Performance Management and Appraisal System SOP from 2000.
Finally, in a March 2011 report the SBA OIG found that the disaster loan  servicing centers lacked a clearly defined records management and  documentation process and therefore did not consistently make and  preserve records containing adequate and proper documentation.   Records that should have been preserved because they contained  evidence of agency activities or information of value to the agency were  not systematically maintained. As a result, the SBA OIG recommended  that SBA make and preserve records containing adequate and proper  documentation of procedures for its oversight of its loan servicing  programs, including incorporating these procedures into the relevant  SOPs. As of February 2015, SBA had not implemented the SBA OIG’s  2011 recommendations on updating the SOPs for its loan servicing  procedures.
In fiscal year 2014, SBA’s Office of the Chief Operating Officer, Office of  Administrative Services began a review of the status of all SOPs, working  with the program offices to determine whether any updates were needed.  Specifically, SBA issued a notice requiring all office heads to certify in  writing the status of their SOPs. For each SOP, the cognizant office was  to note whether (1) it did not require any revision, (2) it was under review,  (3) it was being revised, or (4) it was being canceled. If an SOP was  deemed to fall within one of the last three categories, the office was to  provide the date by which the action would be completed. As a result of  that review, SBA created a spreadsheet that flagged some SOPs as  outdated and some for cancelation. Of the 165 SOPs reviewed as of  March 2015, SBA determined that 74 needed to be revised, 31 needed to  be canceled, and 60 required no revision. SBA also determined that it  needed to issue an additional 9 new SOPs (see app. IV for a list of all  SOPs and their status). However, many of these outdated and canceled  SOPs were still on SBA’s internal website in March 2015 when we  requested an updated list, raising questions as to whether SBA staff and  partners may be using outdated or canceled SOPs. Further, in most  cases SBA’s spreadsheet did not include projected completion dates for  revising or canceling old SOPs or creating new ones. SBA officials told us  that they lacked resources to update their SOP inventory but were in the  process of revising those that had been flagged for revision. They also  told us that they planned to revise the SOP for the entire Records  Management Program and send it to the administrator for approval in  fiscal year 2015. In addition, a senior SBA official noted that several  SOPs had been updated and were undergoing final review. Without  setting time frames to help ensure that SOPs are properly maintained and  periodically updated, it will be difficult for SBA to hold staff accountable for  updating the SOPs as intended and to illustrate its progress in doing so.  Moreover, without updated SOPs, agency staff and their partners may not  have clear guidance on how to most effectively deliver program services  in accordance with laws and regulations.
section_title: SBA Has Partially Implemented Several IT Management Initiatives
paragraphs: In a February 2015 report, we identified the management of information  technology acquisitions and operations as an area that presents a high  risk to the federal government. We reported that too frequently agency  IT efforts failed or incurred cost overruns and schedule slippages and did  not meet mission goals due to challenges in managing the investments.  The federal government has undertaken several initiatives to better  manage its IT investments, with the goal of increasing efficiency and  reducing costs. However, agencies continue to have poorly performing  projects, such as SBA’s LMAS project, which we discussed earlier. While  SBA has taken steps to implement six IT initiatives set out by OMB, it has  not fully completed all of them.
TechStat reviews. As part of the Federal Chief Information Officer’s  (CIO) 25 Point Implementation Plan, in December 2010, OMB  empowered agency CIOs to hold agency-level TechStat accountability  reviews for investments that are at risk. According to OMB’s  instructions, agency CIOs are to report the status of risk of their  investments on the Federal IT Dashboard. Using the ratings (high,  medium, or low risk), agencies determine whether or not to hold a  TechStat review of an investment and decide, based on the evidence  presented, whether to intervene to turnaround, halt, or terminate a  project. OMB also required federal agencies to hold at least one  TechStat review by March 2011. Based on the success of the  TechStat initiative, OMB issued a requirement in August 2011 that  agency CIOs continue holding such reviews.
From December 2010 through February 2015, SBA reported three  investments on the Federal IT Dashboard that exhibited moderately  high risk. In March 2011, SBA held a TechStat session for one of  those investments—the Homeland Security Presidential Directive  (HSPD)-12, a system to implement a new government-wide standard  for secure and reliable forms of identification for employees and  contractors who access government-controlled facilities and  information systems. As of February 2015, SBA’s HSPD-12 system  was still considered to be at moderately high risk. SBA officials stated  that this investment was rated moderately high risk because they had  not yet implemented the requirements that would allow the  identification card readers to work properly in the field.
SBA did not hold a TechStat for the second investment rated  moderately high risk—the Loan Accounting System—from July 2011  through February 2012. SBA changed the investment’s rating several  times, from medium to low risk, and it has been rated low risk since  June 2014. SBA officials attributed the low risk rating to the  completion of associated projects in November 2014 that previously  had not performed as expected. They added that the investments  were being continually reviewed by SBA’s CIO and the Executive  Steering Committee.
The third investment rated moderately high risk from September 2014  through February 2015 was the Office of the CIO IT Infrastructure  investment. SBA officials said that the moderately high-risk rating of  this investment was due to a delay in data center consolidation efforts  that resulted from a lack of funding. SBA officials stated that they had  not conducted any additional TechStat reviews since the one held in  2011, explaining that under the previous CIO’s management, it had  been decided that the agency would leverage other oversight and  governance efforts for all of its IT investments. These efforts included  discussing the overall performance of investments and prescribing  action items when warranted to help ensure investments were on  schedule, within budget, and meeting defined metrics. SBA said that  as warranted, it would hold formal TechStat sessions in the future for  underperforming IT investments.
Operational analysis of IT investments. OMB guidance calls for  agencies to develop a policy for examining the ongoing performance  of existing IT investments to measure, among other things, whether  the investment is continuing to meet business and customer needs  and is contributing to meeting the agency’s strategic goals. The  policy is to require annual operational analyses of the agency’s  investments that address costs, schedules, customer satisfaction,  strategic and business results, financial goals, and innovation.
SBA officials said that operational analysis reports had not been  prepared but that the CIO reviewed the investments in SBA’s portfolio  every month. They added that the agency had focused on ensuring  that investments were up-to-date and providing the accurate risk  status, schedule, cost, and performance metrics for each. Although  SBA officials told us that the agency’s operational investments were  reviewed periodically, the 2014 reviews were not documented  according to OMB guidance. As a result, we could not evaluate the  extent to which the reviews followed OMB guidance for operational  analyses. Agency officials also said that they planned to conduct an  analysis on each investment in fiscal year 2015. However, as of July  2015, no such analyses had been documented. Until SBA ensures  that all its existing investments are fully assessed and that all reviews  are appropriately documented, it will not be able to determine whether  its IT investments are meeting their intended objectives, increasing  the risk of inefficient spending.
Federal data center consolidation. In February 2010, the Federal  CIO established the Federal Data Center Consolidation Initiative to  address the growing number of federal data centers. This initiative’s  four high-level goals were to reduce the overall energy consumption  and real estate footprint of government data centers; reduce the cost  of data center hardware, software, and operations; increase the  overall IT security posture of the government; and shift IT investments  to more efficient computing platforms and technologies. OMB  guidance requires SBA and other federal agencies to submit an  updated data center inventory that includes 4 elements and a  consolidation plan with 13 elements.
In July 2011 and July 2012 reports, we found that SBA had developed  plans to consolidate its large data centers from four to two by  December 2015 but that its inventory and plans for its data centers did  not address all the elements required by OMB guidance.  Furthermore, OMB guidance required agencies to describe year-by- year investments and cost savings in their 2010 and 2011  consolidation plans. Beginning in August 2013, agencies were to  identify and report all cost savings and avoidances related to data  center consolidation, among other areas, as part of a quarterly data  collection process. In the 2012 report, we found that SBA’s June  2011 update to its inventory and plans included some inventory  elements that had been completed and others that had not.  Specifically, the update included 2 completed inventory elements (of  4) and 6 plan elements (of 13); 2 partially completed inventory  elements and 2 plan elements, and 5 plan elements with no  information. SBA officials stated that several missing elements, such  as performance metrics, a schedule, and a risk management strategy,  had been developed after the plan’s completion. We emphasized the  importance of fully implementing the recommendation from our 2011  report that SBA complete the missing elements from its inventories  and plans. SBA neither agreed nor disagreed with our  recommendation, but has since taken the steps necessary to  implement it.
PortfolioStat. In March 2012, OMB launched the PortfolioStat  initiative, which requires SBA and other federal agencies to conduct  an annual agency-wide portfolio review of all their IT investments to,  among other things, reduce commodity IT spending and demonstrate  how IT investments align with the agency missions and business  functions. PortfolioStat is designed to assist agencies in assessing  the current maturity of their IT portfolio management process, making  decisions on eliminating duplication, and moving to shared services in  order to maximize the return on IT investments across the portfolio.  OMB established several requirements for agencies in implementing  PortfolioStat, including reporting estimated savings and cost  avoidances associated with consolidation and shared services  initiatives through fiscal year 2015 and completing a final action plan  that addressed additional elements.
In a November 2013 report on the progress SBA and other agencies  had made in conducting PortfolioStat reviews, we found that SBA had  held a PortfolioStat review for some IT investments but completed  only some of the OMB requirements for conducting the reviews.  Specifically, SBA had designated a PortfolioStat lead, completed an  IT portfolio survey, held a PortfolioStat meeting, completed two  migration efforts, and reported lessons learned. The agency reported  that it had identified six PortfolioStat initiatives, of which four had  resulted in cost savings of about $800,000. However, SBA had not  completed its commodity IT baseline because it had not identified a  process for ensuring the completeness of the baseline information.  Additionally, SBA had not completed an action plan with all the  required elements. Specifically, while its plan fully addressed four  elements, it partially addressed three, and did not address one. We  recommended that the agency take two actions: (1) develop a  complete commodity IT baseline and (2) fully describe the required  PortfolioStat action plan elements in future reporting to OMB. SBA did  not agree nor disagree with our recommendations, but SBA officials  told us that as of May 2015, they had begun to take steps to address  them. For example, SBA officials told us that the agency had procured  tools that would help it develop its commodity IT baseline and that it  was reporting to OMB quarterly on the status of its implementation of  action plan elements.
Cloud computing strategy. In order to accelerate the adoption of  cloud computing services across the government, OMB’s 25 Point  Plan included a “Cloud First” policy. This policy requires each agency  CIO to fully migrate three services by June 2012 to an Internet-based  cloud service providing computing services and resources, and  implement cloud services whenever a secure, reliable, and cost- effective cloud option is available. Building on this requirement, in  February 2011, OMB issued the Federal Cloud Computing Strategy,  which provided definitions of cloud computing services; benefits of the  services, such as accelerating data center consolidations; case  studies to support agencies’ migration to cloud computing; and roles  and responsibilities for federal agencies.
In a July 2012 report, we found that SBA had implemented one cloud- based computing service by OMB’s deadline of June 2012, and an  additional two by the end of 2012, but that the agency’s plans for  doing so lacked estimated costs and performance goals. In  addition, the agency had not developed any plans for additional cloud- based services. We recommended that SBA establish estimated cost  and performance goals for additional cloud-based services and that it  develop, at a minimum, estimated costs, milestones, performance  goals, and plans for retiring legacy systems, as applicable, for  additional cloud-based services. SBA officials responded that the  agency would work to implement the recommendations. In May 2015,  SBA officials told us that they were continuing to implement the  agency’s cloud computing strategy and that they were in the early  stages of implementing a cloud e-mail solution to replace the agency’s  legacy e-mail system.
In addition, in September 2014, we evaluated SBA’s progress in  implementing cloud services and the extent to which it had  experienced cost savings in light of OMB guidance that called for  agencies to assess all IT services for migration to a cloud service  irrespective of the investment’s age. SBA had not assessed a  majority of its IT investments for cloud computing services. We  recommended that SBA direct its CIO to ensure that all IT  investments be assessed for suitability for migration to a cloud  computing service and establish evaluation dates for each investment.  SBA officials concurred. In June 2015, SBA officials told us that they  had revised their SOP in response to the recommendation and that  they discussed cloud computing options at each investment review.  However, SBA did not document these discussions, so it is not clear  the extent to which they addressed the factors required by OMB.
Software licensing management. Two executive orders address the  effective management of agency software licenses. Executive  Order 13103 requires that federal agencies adopt policies and  procedures to ensure that only computer software not in violation of  copyright laws is being used. In addition, Executive Order 13589  promotes efficient spending at federal agencies to include  assessments of inventories of current devices and their usage and the  establishment of controls to ensure that agencies are not paying for  unused or underused IT equipment, installed software, or services.
In our May 2014 report on the management of software licenses  across the federal government, including the extent to which SBA and  other federal agencies had developed appropriate policies on  software management licensing and were adequately managing  licenses for their software, we found that SBA had not addressed all  of the seven elements of a comprehensive license policy and had not  implemented all five of the leading initiatives for managing software  licenses. Specifically, SBA did not have any SOPs or a general  policy to manage all software licenses agency-wide and had only  partially addressed two out of the five leading initiatives for managing  software licenses. We recommended that SBA implement six  actions to ensure the effective management of its software licenses.  SBA neither agreed nor disagreed with our recommendations, but  SBA officials told us that as of June 2015, they had started taking  actions to address some of them. For example, SBA officials told us  that they had drafted a software licensing policy that was under review  and were working on a software license inventory. While these are  positive initial steps, until SBA fully implements our recommendations  on software management, it lacks assurance that it can cost- effectively manage its software.
section_title: Conclusions
paragraphs: SBA is a relatively small agency with a large mission—to help Americans  start, build, and grow small businesses by overseeing programs that  provide tens of billions of dollars in support to these enterprises. To fulfill  this important role, it is essential that SBA better plan and oversee  several of its key management areas across the agency. For example,  SBA has developed an agency-wide strategic plan that meets all  GPRAMA requirements on the process used to develop the plan and all  but one requirement on the contents of the plan. SBA’s plan only partially  meets the requirement that the agency describe how it used program  evaluations in setting strategic goals and include a schedule of  evaluations planned. In addition, although GPRAMA aims to ensure that  agencies use performance information in decision making and OMB has  encouraged agencies to improve government effectiveness by increasing  their use of evidence and rigorous program evaluation in making budget,  management, and policy decisions, SBA has a poor track record of  conducting program evaluations and told us it has limited resources to  conduct them. However, conducting more program evaluations could help  SBA assess program effectiveness and learn how to improve program  performance. In addition, relying on program evaluations to help set  strategic objectives could better enable SBA to assess the  appropriateness and reasonableness of its goals and objectives and the  effectiveness of the strategies used to meet them.
Further, SBA faces ongoing challenges in several key management  areas, including workforce planning and training and development. SBA  currently does not have a workforce plan that fully addresses key  principles—including conducting and acting upon a competency and skill  gap assessment and developing a long-term strategy to address its skills  imbalance. As a result, it cannot provide reasonable assurance that its  workforce has the skills needed to effectively administer the agency’s  programs and meet the agency’s mission and strategic goals. Similarly,  SBA lacks a strategic approach to its training and development programs,  such as incorporating goals and measures and input on employee  development goals in its training plan. Without such an approach, SBA  cannot establish priorities in its training initiatives or address skill gaps to  help ensure that employees can effectively deliver programs and meet  SBA’s strategic objectives.
Changes to SBA’s organizational structure have contributed to the  agency’s skill gaps and, in some cases, have affected program oversight.  Federal internal control standards state that an agency’s organizational  structure should clearly define key areas of authority and responsibility  and establish appropriate lines of reporting. SBA committed in 2012 to  revising its organizational structure and planned some workforce  restructuring related to its most recent voluntary retirement program.  However, SBA had not documented efforts to assess its organizational  structure as of August 2015 or completed its workforce restructuring as of  June 2015. Until it documents its examination of its structure and any  findings, SBA will not have an institutional record of its actions. Thus, it  will be difficult for SBA to provide reasonable assurance, or for a third  party to validate, that SBA’s current organizational structure contributes  effectively to its mission objectives and programmatic goals.
SBA has initiated efforts to identify and manage risks facing the agency at  an enterprise level. However, SBA lacks documentation on its progress  and future plans required by federal internal control standards and has  not incorporated elements of our risk management framework, such as  including goals or specific actions. Without identifying and documenting  the steps that it plans to take to implement its risk management process  and incorporating the elements of our framework, SBA cannot provide  reasonable assurance that its efforts effectively identify, assess, and  manage risks before they adversely affect SBA’s ability to achieve its  mission.
SBA also faces challenges in managing and maintaining adequate  records. We found that many of its SOPs were outdated and did not  reflect program and operating changes. The lack of up-to-date guidance  can affect program delivery. Internal control activities, such as  establishing the policies, procedures, and techniques for SBA programs  and maintaining them through periodic updates, are essential  mechanisms that help ensure that management’s directives are carried  out. Without setting time frames to help ensure that SOPs are properly  maintained and periodically updated, it will be difficult for SBA to hold  managers accountable for completing them as intended and to  demonstrate progress in doing so. Moreover, without updated SOPs,  agency staff may lack clear guidance and therefore may not effectively  deliver program services in accordance with laws and regulations.
Finally, SBA has taken steps to implement aspects of several key IT  management initiatives. However, the agency has not developed a policy  for conducting regular operational analyses of all of its investments. SBA  officials told us that all IT investments were reviewed regularly but could  not provide documentation of recent assessments. Without these  analyses, SBA cannot provide reasonable assurance that it is effectively  managing its IT investments so that they meet the agency’s mission and  goals, increasing the risk of inefficient spending on IT investments. In  addition, as SBA begins to implement new systems intended to improve  agency operations such as SBA One, fully applying accepted IT  management initiatives to its efforts will be important. Otherwise, SBA  risks them not meeting cost, schedule, or capability goals.
section_title: Recommendations for Executive Action
paragraphs: We make the following eight recommendations to improve management  of the Small Business Administration.  1.  To ensure that SBA assesses the effectiveness of its programs, we  recommend that the SBA Administrator prioritize resources to conduct  additional program evaluations.  2.  To ensure that SBA fully meets GPRAMA requirements, we  recommend that the SBA Administrator use the results of additional  evaluations it conducts in its strategic planning process and ensure  the agency’s next strategic plan includes required information on  program evaluations, including a schedule of future evaluations.  3.  To improve SBA’s human capital management, we recommend that  the SBA Administrator complete a workforce plan that includes key  principles such as a competency and skill gap assessment and long- term strategies to address its skill imbalances.  4.  To improve SBA’s human capital management, we recommend that  the SBA Administrator incorporate into its next training plan key  principles such as goals and measures for its training programs and  input on employee development goals.  5.  To ensure that SBA’s organizational structure helps the agency meet  its mission, we recommend that the SBA Administrator document the  assessment of the agency’s organizational structure, including any  necessary changes to, for example, better ensure areas of authority,  responsibility, and lines of reporting are clear and defined.  6.  To ensure that SBA can effectively identify, assess, and manage  risks, we recommend that the SBA Administrator develop its  enterprise risk management consistent with GAO’s risk management  framework and document the specific steps that the agency plans to  take to implement its enterprise risk management process.  7.  To improve SBA’s program and management guidance, we  recommend that the SBA Administrator set time frames for  periodically reviewing and updating its SOPs as appropriate.  8.  To help ensure that SBA’s IT operations and maintenance  investments are continuing to meet business and customer needs and  the agency’s strategic goals, we recommend that the SBA  Administrator direct the appropriate officials to perform an annual  operational analysis on all SBA investments in accordance with OMB  guidance.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments from SBA on a draft of this report, and the  agency provided written comments that are presented in appendix V.  SBA stated that overall it generally agreed with our recommendations.
In response to our recommendation that the SBA administrator complete  the assessment of the agency's organizational structure and make any  necessary changes, SBA concurred but noted that the agency had  initiated a full review of its organizational structure shortly after the current  administrator was confirmed in April 2014. SBA noted that the agency  had recently completed that review and determined that major  restructuring was not warranted at the time. However, SBA has not  provided us with any documentation of its assessment, either during the  course of our review or when it provided comments on a draft of this  report. Therefore, we revised the recommendation to clarify that SBA  document its assessment, including the results and any changes.
In response to our two recommendations that SBA conduct additional  program evaluations and use the results in its strategic planning process,  SBA generally agreed with our recommendations but noted that it would  face challenges in implementing them. Specifically, SBA stated that it was  currently restricted from collecting data on small businesses from some  resource partners. Further, SBA said that it did not have adequate  information collection systems for some programs that could house and  assess the data needed for evaluations. SBA also noted that independent  evaluation studies consistent with OMB and GAO preferred  methodologies would be costly. As a result, SBA said its ability to satisfy  the recommendations would depend, at least in part, on the agency's  ability to receive funding for them or find other viable evaluation methods.  SBA stated that in prior years the agency had requested additional  funding to conduct independent evaluations but had not received it.
The agency agreed with our two recommendations related to SBA’s  human capital management, adding that a workforce plan was under  development that would address the need for competency and skills gap  analysis and that contained strategies to address skill imbalances through  recruitment and training. SBA also noted that its projected analyses would  include goals and measures for training and development. SBA added  that it had procured a contractor to perform a competency gap analysis  and that additional contractor support would allow for a final draft of a  workforce plan in early fiscal year 2016.
SBA agreed with our recommendation regarding the agency’s enterprise  risk management process. SBA said that the agency was working to  document its process, which is to include aspects of various available  frameworks, including those published by GAO, the Committee of  Sponsoring Organizations of the Treadway Commission, and the  International Organization for Standardization. Further, SBA agreed with  our recommendation on updating SOPs. In its comment letter, SBA noted  that the agency was conducting annual reviews of SOPs and working to  streamline the clearance process for the publication of new and updated  SOPs. However, as we stated in the report, SBA’s most recent effort to  review its SOPs began in fiscal year 2014, and in most cases the results  did not include projected completion dates for revising or canceling old  SOPs or creating new ones. SBA also concurred with our  recommendation on performing an annual operational analysis on all SBA  IT investments in accordance with OMB guidance.
SBA also provided several technical comments, which we incorporated as  appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to SBA and  appropriate congressional committees. This report also will be available  at no charge on our website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines the extent to which the U.S. Small Business  Administration (SBA) (1) has addressed previously identified  management challenges related to specific programs, including those  related to internal controls; (2) is following federal requirements for  strategic planning; (3) is following key principles or internal controls for  human capital management, organizational structure, enterprise risk  management, acquisition management, and procedural guidance; and (4)  is making progress in implementing the Office of Management and  Budget’s (OMB) high-priority management practices for information  technology.
For the background, we analyzed data on staffing levels at headquarters,  regional, and district offices in fiscal year 2014. To assess the reliability of  these data, we interviewed SBA officials from the Office of Human  Resources Solutions to gather information on the completeness and  accuracy of the full-time equivalent database and examined the data for  logical inconsistencies and completeness. We determined that the data  were sufficiently reliable for the purposes of reporting on staffing levels.
To address our objectives, we reviewed relevant federal laws and  regulations and interviewed SBA officials, including headquarters officials,  all 10 regional administrators, management and nonmanagement staff at  10 district offices, and union representatives. We interviewed  headquarters officials within the following SBA offices: Capital Access,  Entrepreneurial Development, Government Contracting and Business  Development, Disaster Assistance, Performance Management and Chief  Financial Officer, Field Operations, and Human Resources Solutions. To  obtain perspectives from SBA district office officials on our objectives, we  selected a purposive sample of 10 of the 68 district offices, 1 from each  SBA region to provide national coverage. We randomly selected 7 of the  10 district offices from those offices located within the continental United  States. We selected the Washington, D.C., and Georgia district offices to  pre-test our interview questions because of proximity to GAO offices. We  selected the New York district office to include an additional large office to  ensure a variety of offices with both a larger and smaller number of  employees. During our on-site meetings at the 10 district offices, we  interviewed managers such as district directors and deputy district  directors at each location. For our interviews with nonmanagement staff  at the 10 district offices, district office management invited any interested  nonmanagement staff to meet with us. However, SBA required the  presence of district counsel during these interviews. Participation by  nonmanagement staff members in the interviews was limited. Specifically,  out of approximately 120 nonmanagement employees in the 10 district  offices that were invited to speak with us, a total of 28 employees  attended the interviews. To allow any nonmanagement staff who did not  participate in our on-site interviews an additional opportunity to share their  thoughts on our objectives, we sent an e-mail to all nonmanagement staff  at those 10 district offices, inviting them to share their thoughts on specific  topics with us by sending an e-mail to a specified GAO e-mail address.  Nine staff members responded to our e-mail and provided us with  information. The results of our interactions with the 10 district offices  cannot be generalized to other SBA district offices. The union  representatives we interviewed were from headquarters and the field.
To assess the status of SBA’s management challenges related to specific  programs, we reviewed annual SBA Office of the Inspector General (OIG)  reports on SBA management challenges for fiscal years 2000 through  2015 (the years for which reports were available on the SBA OIG’s  website). We reviewed the challenges noted in the fiscal year 2015  report, including the fiscal year in which each challenge was first reported  by the OIG. We also reviewed GAO reports issued during this time frame  to identify those which dealt with SBA management challenges. Finally,  we reviewed information from GAO’s system for tracking agency  recommendations to determine which recommendations made to SBA in  fiscal years 2010 through 2013 remained open.
To evaluate SBA’s strategic planning efforts, we reviewed relevant SBA  documents such as its Strategic Plan Fiscal Years 2014-2018 and Fiscal  Year 2016 Congressional Budget Justification and Fiscal Year 2014  Annual Performance Report. We compared SBA’s strategic planning and  reporting practices with requirements in the Government Performance  and Results Act of 1993 (GPRA), as updated by the GPRA Modernization  Act of 2010 (GPRAMA). Specifically, we first identified GPRA and  GPRAMA requirements related to the elements that must be included in a  federal agency’s strategic plan, such as a mission statement and goals  and objectives, and requirements related to the strategic planning  process, such as obtaining stakeholder input. We then reviewed SBA’s  strategic plan to determine whether it included the required elements and  interviewed SBA officials to determine the process SBA used to develop  the strategic plan. We assessed the extent to which SBA met each  requirement using three categories. “Met” indicates that, in our judgment,  SBA met all or mostly all aspects of the requirement. “Partially met”  indicates that it met some but not all or mostly all aspects of the  requirement. “Not met” indicates that it did not meet the requirement.  Specifically, one GAO analyst identified the strategic planning  requirements, reviewed SBA’s practices, and made the initial assessment  for each requirement reviewed. A second analyst then verified each of  these steps to ensure consistent results.
To assess SBA’s human capital management practices, we reviewed  SBA documents such as its Strategic Human Capital Plan Fiscal Years  2013-2016, Annual Training Plan (Talent Development Initiative) Fiscal  Year 2014-2015, two assessments of its training programs, and standard  operating procedures (SOP). We also reviewed SBA’s 2014 Federal  Employee Viewpoint Survey results on training and employee  performance management. To assess the reliability of these data, we  reviewed the methodology used to conduct the survey and SBA’s  response rate. We determined that the data we used were sufficiently  reliable for the purposes of reporting on employees’ perspectives on  training offered by SBA and on SBA’s employee performance  management system. In addition, we reviewed a list of individuals who  had served in senior-level positions at SBA from calendar years 2005  through 2015 (the years for which information on all these positions was  available) and determined the number of individuals who served in each  position during this time frame. We also compared SBA’s human capital  practices in the areas of workforce planning and training with key  principles identified in our previous work. Specifically, we reviewed  SBA’s human capital documents and interviewed SBA officials to  determine SBA’s workforce planning and training practices. We then  assessed the extent to which SBA followed each key principle, again  using three categories. “Follows” indicates that, in our judgment, SBA was  following all or mostly all aspects of the principle. “Partially follows”  indicates that it was following some but not all or mostly all of the aspects  of the principle. “Does not follow” indicates that it was not following any  aspects of the principle. Specifically, one GAO analyst reviewed SBA’s  policies and practices and made the initial assessment. A second analyst  then verified these steps to ensure consistent results.
Because SBA was in the process of updating the SOP on its employee  performance management system, we were unable to conduct an  assessment of SBA’s employee performance management system to  determine whether it was consistent with key principles in employee  performance management that we identified in a 2003 report. Instead we  reviewed a set of critical elements and performance standards used to  evaluate employee performance. Specifically, we reviewed critical  elements and performance standards for the following managers and  employees in the field: regional administrators, district directors, deputy  district directors, economic development specialists, business opportunity  specialists, and lender relations specialists. We requested these because  they are the elements and standards for the staff whom we interviewed  during our site visits. In addition, we reviewed one set of generic critical  elements and performance standards for SBA employees and one set for  SBA managers. SBA officials stated that they could not provide data on  the total number of critical elements because the elements are tracked on  an individual basis and not across the agency.
To review SBA’s organizational structure, we reviewed prior GAO and  SBA OIG reports that discussed, among other things, the effect of the  agency’s structure on its human capital management and program  oversight. We also examined documentation on changes to SBA’s  organizational structure from fiscal year 2005 to 2014 (the period after  SBA’s last major reorganization in 2004). Specifically, we requested and  reviewed all of the forms that SBA used to document organizational  changes that were approved during this period. We also reviewed  documentation on SBA’s planned efforts to assess its organizational  structure—including its Strategic Human Capital Plan Fiscal Years 2013- 2016, guidance implementing its fiscal year 2014 Voluntary Early  Retirement Authority (VERA) and Voluntary Separation Incentive  Payments (VSIP) programs, and the statement of work for a contractor’s  assessment of organizational structure—and compared these plans to  federal internal control standards and guidance related to organizational  structure.
To evaluate SBA’s risk management, we compared SBA’s enterprise risk  management practices with GAO’s Standards for Internal Control in the  Federal Government and risk management criteria on elements of risk  management. Specifically, we reviewed SBA’s limited documentation on  its enterprise risk management process and implementation plans for  each step of the process and then assessed the extent to which SBA’s  process was consistent with the stages of our risk management  framework, again using three categories. “Follows” indicates that, in our  judgment, SBA was following all or mostly all aspects of the practice.  “Partially follows” indicates that it was following some but not all or mostly  all of the aspects of the practice. “Does not follow” indicates that it was  not following any aspects of the practice.
For acquisition management, we reviewed (1) data on SBA contracts  awarded to small businesses from Small Business Goaling Reports for  fiscal years 2011-2013 to assess whether SBA met contracting goals in  the last 3 years and (2) SBA contract obligations for fiscal year 2014 as  reported in the Federal Procurement Data System-Next Generation to  determine types of spending. To assess the reliability of these data, we  reviewed documentation on the data and assessed them for consistency  and completeness. We determined that the data were sufficiently reliable  for the purposes of reporting on SBA’s contracting efforts. We also  reviewed recent SBA OIG reports on SBA’s acquisition management  (including whether the agency’s practices align with guidelines developed  by OMB). In addition, we examined SBA’s efforts to improve its  acquisition management, including reviewing documentation of its 2014  contract with an outside entity to conduct an assessment of SBA’s  acquisition function to determine the scope and methodology of that  review. We also reviewed documentation of the results of that  assessment.
For procedural guidance, we asked SBA to provide us with an inventory  of all current SOPs, including the dates of the most recent revisions. In  July 2014, SBA provided a list of SOPs maintained on the agency’s  internal website. We also reviewed the agency’s external website and  found additional SOPs, identifying a total inventory of 153 internal and  external SOPs. We reviewed this inventory of SBA’s SOPs to determine  when they were last updated and compared SBA’s guidance to federal  internal control standards to determine if it met the standards for  documentation. We also reviewed documentation related to SBA’s fiscal  year 2014 efforts to conduct an assessment of the status of all SOPs  across the agency. In fiscal year 2014, SBA’s Office of the Chief  Operating Officer, Office of Administrative Services began a review of the  status of all SOPs, working with the program offices to determine whether  any updates were needed. SBA issued a notice requiring all office heads  to certify in writing the status of their SOPs. For each SOP, the cognizant  office was to note whether (1) it did not require any revision, (2) it was  under review, (3) it was being revised, or (4) it was being canceled. If an  SOP was deemed to fall within one of the last three categories, the office  was to provide the date by which the action would be completed. As a  result of that review, SBA created a spreadsheet that flagged some SOPs  as outdated and some for cancelation. We reviewed SBA’s spreadsheet  to determine the number of SOPs that needed to be revised, canceled, or  required no revision.
To assess SBA’s progress in implementing high-priority management  practices for information technology (IT), we evaluated SBA’s progress on  six OMB IT initiatives. We used the relevant sections of recent GAO  reports to report on SBA’s efforts on the initiatives, interviewed SBA  officials about recent steps that they have taken to implement them, and  analyzed SBA TechStat documentation to determine when past TechStat  sessions were held and to identify the outcomes of the reviews. We  reviewed SBA’s ratings on the IT Dashboard to determine if SBA had held  a TechStat for the at-risk investments. To corroborate the data reliability  of those ratings, we interviewed SBA officials to determine their process  for collecting, updating, and maintaining the data and asked them to verify  the data’s completeness and accuracy. We determined that the data were  sufficiently reliable for the purposes of reporting on TechStat reviews of  at-risk investments. We analyzed SBA’s operational analyses to  determine if, within the past year, the agency had performed such  analyses on all of its major IT investments in the operations and  maintenance phase.
We conducted this performance audit from March 2014 through  September 2015 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: Additional Information on SBA’s Recent Budget Obligations, Outlays, and Authority
paragraphs: In this appendix, we provide additional information on the Small Business  Administration’s (SBA) budget from fiscal year 2004 through fiscal year  2016 (requested). Specifically, table 6 provides information on total  obligations, net outlays, and gross budget authority agency-wide. In  addition, table 7 breaks down these amounts according to Office of  Management and Budget (OMB) accounts. Finally, figure 8 compares the  gross budget authority amounts by OMB account to the total gross budget  authority for each of these fiscal years.
section_title: Appendix III: Open GAO Recommendations for the Small Business Administration, as of July 2015
paragraphs: As of July 2015, 69 of the recommendations that we have made to the  Small Business Administration (SBA) were open. See table 8 for a list of  these open recommendations by subject area.
section_title: Appendix IV: Results of the Small Business Administration’s Internal Review of Its Standard Operating Procedures, as of March 2015
paragraphs: In fiscal year 2014, the Small Business Administration’s (SBA) Office of  the Chief Operating Officer, Office of Administrative Services began a  review of the status of all standard operating procedures (SOP), working  with the program offices to determine whether any updates were needed.  Specifically, SBA issued a notice requiring all office heads to certify in  writing the status of their SOPs. For each SOP, the cognizant office was  to note if it (1) did not require any revision, (2) was under review, (3) was  being revised, or (4) was being canceled. As a result of this review, SBA  determined that 74 SOPs needed to be revised (see table 9); 31 needed  to be canceled (see table 10); and 60 required no revision (see table 11).  SBA also determined that it needed to issue an additional 9 new SOPs  (see table 12).
section_title: Appendix V: Comments from the Small Business Administration
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, David Powner (Director), A.  Paige Smith (Assistant Director), James Sweetman, Jr. (Assistant  Director), Deena Richart (Analyst-in-Charge), Gerard Aflague, Emily  Chalmers, Elizabeth Curda, Pamela Davidson, Nancy Glover, Meredith  Graves, Kaelin Kuhn, John McGrail, Marc Molino, Erika Navarro,  Meredith Raymond, William Reinsberg, and Gloria Ross made key  contributions to this report.