SBA provides funding and assistance to individuals and businesses after disasters declared by either the President or SBA. Administered by SBA’s Office of Disaster Assistance (ODA), the Disaster Loan Program is the primary federal program for funding long-range recovery for nonfarm businesses that are victims of disasters and is the only form of SBA assistance not limited to small businesses. Disaster victims—including homeowners and renters, as well as businesses—initially register with the Federal Emergency Management Agency (FEMA) for assistance. FEMA automatically refers applicants whose income exceeds certain income thresholds to SBA’s Disaster Loan Program. SBA’s Disaster Preparedness and Recovery Plan (DPRP) outlines how the agency conducts operations in support of federal disaster response efforts. The plan is intended to ensure a broad scope of coordination, awareness, and support throughout the organization, and it describes how SBA conducts its disaster-related missions. The execution of SBA’s disaster-related mission, as set forth in the DPRP, involves both response and recovery—including the recovery functions performed by SBA’s Disaster Loan Program. The Small Business Act authorizes SBA to make available several types of disaster loans, including two types of direct loans: physical disaster loans and economic injury disaster loans. Physical disaster loans: These loans are for permanent rebuilding and replacement of uninsured or underinsured disaster-damaged property. They are available to homeowners, renters, businesses of all sizes, and nonprofit organizations. These loans are intended to repair or replace the disaster victims’ damaged property to its predisaster condition up to a certain capped amount (see table 1). Almost any business concern or charitable or other nonprofit entity whose property is damaged in a declared disaster area is eligible to apply for a physical disaster loan; however, businesses in agriculture-related industries—also known as agricultural enterprises—are not eligible. Economic injury disaster loans (EIDL): These loans provide small businesses that are not able to obtain credit elsewhere with necessary working capital until normal operations resume after a disaster declaration. The loans cover operating expenses the business could potentially have paid had the disaster not occurred. The Small Business Act restricts EIDLs to small businesses and private nonprofit organizations. protect property and the environment, and meet basic human needs after an incident has occurred. The Recovery framework refers to capabilities necessary to assist communities affected by an incident to recover effectively, including, but not limited to, rebuilding infrastructure systems; providing adequate interim and long-term housing for survivors; restoring health, social, and community services; promoting economic development; and restoring natural and cultural resources. Table 1 describes the characteristics of each of these two types of loans. Not all businesses are eligible for both types of loans. Businesses of all sizes may apply for physical disaster loans, but only small businesses are eligible for an EIDL.damage from a disaster cannot apply for a physical disaster business loan but may still apply for an EIDL, and any small business that applies Small businesses that did not sustain physical for a physical disaster business loan can also be considered for an EIDL. Such applicants may be approved for a physical disaster business loan but denied for an EIDL, or vice versa. Business owners may apply in person at a FEMA-established Disaster Recovery Center, at an SBA-established Disaster Loan Outreach Center or Business Recovery Center, by mail, or via SBA’s Electronic Loan Application system. SBA requires applicants seeking either type of business disaster loan to submit a variety of documents as part of their application package, including the most recent federal income tax return, a signed copy of the Internal Revenue Service (IRS) tax information authorization Form 8821, a schedule of liabilities, and a current (dated There within 90 days of the application) personal financial statement. are also additional filing requirements for applicants seeking an EIDL, such as monthly sales figures for the past 3 years and a request for a written explanation of the economic loss caused by the declared disaster. To fulfill SBA documentation requirements, each principal owning 20 percent or more of the applicant business and each general partner or managing member must also provide a signed personal financial statement and Form 8821. Further, each affiliate of the business must provide a signed Form 8821. Affiliates include, but are not limited to, business parents, subsidiaries, or other businesses with common ownership or management. For the complete list of required documents for a business disaster loan application, see SBA’s website, http://www.sba.gov/content/disaster-loan-paper-applications, accessed on September 4, 2014. of these states was granted four separate extensions for physical disaster business loans (though none for EIDLs), and the final application deadlines for New York and New Jersey were April 13, 2013, and May 1, 2013, respectively. SBA’s regulations contain underwriting criteria that require, among other things, reasonable assurance of repayment, satisfactory credit, and satisfactory character. The regulations state that SBA must have reasonable assurance that all disaster loan applicants can repay their loans based on SBA’s analysis of the applicants’ credit or personal or business cash flow. The regulations also state that SBA is prohibited from lending to businesses that are engaged in lending or speculation or engaged in any illegal activity. SBA disaster loan application processing involves several stages (see fig. 1): Application entry stage. During the application entry stage, SBA screens all incoming applications to determine if they are acceptable. Staff members at SBA’s Processing and Disbursement Center (PDC) enter any application information submitted in paper format into the Disaster Credit Management System (DCMS), and where necessary, coordinate and consolidate any supplemental documentation received into one application per applicant. SBA can also make automatic declines and pre-loss verification declines at this stage. Loss verification stage (physical disaster loans). After the application entry stage, physical disaster loan applications move to the loss verification stage, while EIDL applications proceed directly to the application processing stage. During the loss verification stage, loss verifiers conduct on-site damage inspections for physical disaster loan applications to estimate the cost of restoring damaged property to predisaster condition. The verified loss becomes the basis for the loan amount. Application processing stage. Once the loss verification is complete, an application moves to the application processing stage, where loan officers check for duplication of benefits and assess the applicant’s credit history and ability to obtain credit elsewhere. Loan officers also examine other applicant eligibility criteria, including compliance with child support obligations and history on other federal debt, such as student loans. Loan officers use a financial analysis tool within DCMS to determine if the applicant has the ability to repay the loan. Legal review stage. For secured loans, legal staff members review the draft loan authorization and agreement for sufficiency of collateral instruments and other legal concerns. They also create a loan- closing checklist—a list of the requirements necessary to generate the loan closing and other legal documents. Attorneys enter a legal concurrence into DCMS, which obligates the loan funds through an interface with SBA’s accounting system. Legal support staff members prepare closing documents and mail them to the applicant or nearest Disaster Recovery Center. Closing and disbursement. For Hurricane Sandy loans, SBA could make a maximum initial disbursement, in the absence of collateral, of up to $14,000 for physical disaster business loans and $5,000 for EIDLs, once the agency received signed closing documents from the applicant. SBA could make a maximum initial disbursement of up to $50,000 for physical disaster loans and full disbursements for EIDLs, once all requirements were met. SBA generally makes subsequent disbursements on physical disaster loans based on the applicant’s needs and how they spent prior disbursements. SBA procedures also generally require small businesses to arrange for and obtain all loan funds within 6 months from the date of the loan authorization and agreement. Following Hurricane Sandy, SBA received disaster loan applications from 9 states and Puerto Rico, with the majority of the 15,745 business disaster loan applications generated by businesses in New Jersey and New York. See figure 2 below for a map of highly impacted counties in New Jersey and New York and information on business disaster loan applications from these counties. Congress enacted the Small Business Disaster Response and Loan Improvements Act of 2008 to expand steps taken by SBA after Hurricane Katrina and require new measures to help ensure that SBA would be prepared for future disasters. The act included three provisions requiring SBA to issue regulations to establish new guaranteed disaster programs using private sector lenders: Expedited Disaster Assistance Loan Program (EDALP). EDALP would provide small businesses with expedited access to short-term guaranteed loans of up to $150,000. Immediate Disaster Assistance Program (IDAP). IDAP would provide small businesses with interim guaranteed loans of up to $25,000 with a loan decision within 36 hours. Private Disaster Assistance Program (PDAP). PDAP would make guaranteed loans available to homeowners and small businesses in an amount up to $2 million. See table 2 for characteristics of these loan programs. Following Hurricane Sandy, SBA did not meet its timeliness goal of processing business loan applications from receipt to loan decision within 21 days for a number of reasons, and a backlog of applications developed rapidly. SBA officials said the agency was challenged by a large, unanticipated volume of applications early in its response to the disaster. In addition, SBA relied on inaccurate estimates of how quickly staff could process applications, which delayed its decision to increase the numbers of staff to process the applications. SBA also faced challenges related to its information system, among others. According to SBA, the agency is taking steps to address some of the challenges it faced after Hurricane Sandy. However, SBA has not revised its disaster planning to reflect the unanticipated volume of early applications it received. As a result, SBA risks continuing to be unprepared for a large number of disaster loan applications to be submitted at the beginning of a disaster response. Following Hurricane Sandy, SBA did not meet its goal to process business loan applications within 21 days from application receipt to loan decision. As shown in figure 3, SBA took an average of 45 days for physical disaster business loan applications and 38 days for EIDL applications. The average processing time for disaster business loans peaked in March 2013 (5 months after the storm); business loans for which SBA reached a decision in March 2013 had been in processing for an average of nearly 60 days. One year after the storm, SBA’s processing times for business loan applications still exceeded its goal of 21 days. Following Hurricane Sandy, SBA met its goal to provide first loan disbursements to 95 percent of borrowers within 5 days of loan closing. On average, SBA provided first disbursements to approved businesses within 5 days of closing. According to SBA officials, loan funds are generally provided within four disbursements over a period of time after closing. While there are no timeliness goals associated with closing a loan, borrowers who have been approved for a disaster loan have 60 calendar days from the date of the loan authorization agreement to close it. In order to close the loan, borrowers must sign and return all documents required for an initial disbursement, which is then reviewed by SBA’s Chief Legal Advisor. For Hurricane Sandy, it took on average an additional 66 days from approval to close a physical disaster business loan and an additional 43 days for an EIDL. A backlog of applications that were “in processing” (meaning those SBA had received but for which it had not yet made a loan decision) grew rapidly over the course of SBA’s response to the disaster. Figure 4 illustrates the backlog of applications that developed over the course of SBA’s response to Hurricane Sandy. As of January 2014, SBA officials noted that five home applications, five physical disaster loan applications, and two EIDL applications remained in processing. SBA said that in the aftermath of Hurricane Sandy, it was challenged by a high volume of loan applications submitted at a faster rate than it had experienced in previous disasters. SBA’s initial estimates of when it would receive applications differed from when it actually did receive them. To prepare for a disaster, SBA uses assumptions about the volume and timing of the applications it expects to receive based on historical data— known as the “application intake curve.” SBA inputs these assumptions into forecasting models that predict the staff levels necessary to meet processing needs. According to the application intake curve for Hurricane Sandy, SBA estimated that application submission would peak about 7 to 9 weeks after Hurricane Sandy. However, as shown in figure 5, SBA began receiving business applications earlier. According to SBA, the early spike in applications occurred because a majority of applications were submitted electronically rather than on paper, which resulted in a large volume of applications within a few days of the disaster. SBA stated that the earlier receipt of electronic submissions was caused by the convenience and speed of the Internet-based application as well as the elimination of postal handling time. While SBA created electronic loan applications to simplify and expedite the application process and continues to encourage submitting applications electronically, SBA noted that it did not anticipate receiving such a large volume of electronic loan applications early in its response following Hurricane Sandy. Based on its experience in fiscal year 2012, SBA initially estimated that it would receive between 11,000 and 21,600 business disaster loan applications after Hurricane Sandy and 36 percent of all disaster applications would be submitted electronically. Following Hurricane Sandy, SBA received 15,745 business disaster loan applications, and 55 percent of all disaster applications were submitted electronically. SBA also initially estimated that it would receive a certain percentage of each business loan type electronically, and these estimates were lower than the actual submissions (as shown in table 3). In addition, SBA was unprepared for the use of multiple entry points through which applications could be submitted electronically. According to SBA officials, applicants could submit application documents electronically in a piecemeal fashion via numerous portals, including computer stations set up at each Disaster Loan Outreach Center and personal computers. In contrast, SBA noted that paper applications would only be accepted if all forms and documentation were submitted to the Processing and Disbursement Center (PDC). Because of the various entry points for electronic applications, SBA officials said that the PDC experienced difficulties in consolidating the application documents, which caused delays in processing the electronic applications. According to SBA, the agency is taking steps to process electronic application submissions more effectively for future disasters based on its experience with Hurricane Sandy. Specifically, SBA officials noted that the agency is consolidating the number of entry points through which supporting documentation can be submitted electronically and is improving DCMS to allow documents from SBA follow-up requests to now be submitted electronically instead of in paper form. In addition, SBA officials noted that the agency expects to build an electronic portal where applicants can check the status of their applications and whether documents have been received. SBA officials noted that these efforts began in October 2013 and said they will be monitoring their effectiveness as they continue to automate and streamline the consolidation process. Although SBA is making technological improvements, it has not updated its key disaster planning documents—namely the DPRP and ODA Playbook—to reflect the early volume of application submissions received after Hurricane Sandy and the potential impact that a similar experience could have on staffing, resources, and forecasting models for future disasters. Federal internal control standards state that management should identify risk and that risk identification methods may include, among others, forecasting and strategic planning. Once risks have been identified, they should be analyzed for their possible effect. Risk analysis generally includes estimating the risk’s significance, assessing the likelihood of its occurrence, and deciding how to manage the risk and what actions should be taken.primary goals of forecasting and modeling are to predict as accurately as possible the application volume that will result from a disaster and the timing of when applications will be received. Without taking its experience with early application submissions after Hurricane Sandy into account in its plans, SBA risks continuing to be unprepared for a larger number of disaster applications to be submitted at the beginning of a future disaster response, potentially resulting in delays in receipt of loan funds for disaster victims. One factor that affected the timeliness of SBA’s disaster assistance was inaccurate expectations for the rate at which SBA staff could process loan applications, which caused SBA to delay its decision to increase staff levels. ODA officials said that the PDC communicated inaccurate production estimates to ODA headquarters, which led to delays in increasing staff levels to respond to the early influx of applications. According to ODA officials, management at PDC and ODA participated in daily conference calls during Hurricane Sandy to discuss, among other things, production levels of loan officers and any need to increase staff. ODA officials said that PDC management projected an average productivity level of 3 home loan applications a day per loan officer and 1.5 business loan applications a day per loan officer, for a combined average of 2.25 disaster loan applications a day. However, this productivity expectation was not met over the course of the response. According to ODA officials, the PDC loan officers were actually completing a combined average of 1.5 loan applications a day per loan officer, yet continued to maintain in communications with ODA that they could meet their initial productivity expectations. Because these estimates were based on production benchmarks established after Hurricane Katrina, ODA officials noted that they relied on the PDC’s production estimates and delayed their decision to increase staff. However, ODA officials said they later recognized that the past disaster production rate was not an appropriate indicator of production following Hurricane Sandy due to, among other things, differences in the types of businesses impacted and the larger number of approved applications. As shown in figure 6, although the number of business applications received peaked in December 2012, ODA ultimately added loan officers at its Sacramento loan center in mid-December 2012 and its Buffalo center in the beginning of March 2013, past the peak months of business application receipt. Per the DPRP, SBA has the flexibility to incrementally add pre-identified staff to its workforce in order to tailor its response to the size of the disaster and number of loan applications expected. According to SBA, during the peak of staffing in March 2013, about a fifth of the loan processing staff belonged to its core or permanent staff; the remaining 80 percent were either pre-identified processing staff or new hires. Further, ODA officials noted that most of the additional processing staff members, particularly those in the Sacramento center, were new hires because it was more cost-effective to hire loan officers from the area than to incur costs of transporting pre-identified staff from various locations. As a result, SBA’s decision to increase its workforce to respond to the growing backlog was further delayed. Based on its experience with Hurricane Sandy, ODA told us that several changes have been made with regard to communication with the PDC and staffing increases. The PDC is now required to produce a new series of daily reports for ODA headquarters to increase transparency and improve communication during future disasters. Specifically, these reports include more detailed information on the PDC’s production rates, number of applications submitted, and size of the application backlog. ODA has also created a standard template for centers to request and justify additional staff to ensure that they provide consistent information about, among other things, current and expected performance. Further, SBA is determining if adding permanent loan processing staff in centers other than the PDC, such as those in Sacramento and Buffalo, is needed to respond to disasters. To address challenges with providing timely assistance following Hurricane Sandy, SBA made various changes to its loan processing approach, DCMS, and loan officer training. However, because SBA has not received a large volume of applications since Hurricane Sandy, it is too early to determine whether these changes will improve the timeliness of SBA’s response for future disasters similar to Hurricane Sandy’s magnitude. Loan Processing Approach: Following Hurricane Sandy, SBA processed loans in the order in which they were received, regardless of whether the applicant was a business or homeowner—referred to as a “first-in, first-out” approach. After Hurricane Sandy, SBA received over four times as many home loan applications as business applications, and these home loan applications were received earlier. As a result, business owners could have faced delays due to the large number of home loan applications submitted ahead of them. In August 2013, the Hurricane Sandy Rebuilding Task Force recommended that SBA create two separate application tracks for home and business disaster loans, which SBA implemented in October 2013. According to SBA officials, the agency had processed approximately 2,166 business disaster applications using the separate application tracks in an average of 12 days as of June 2014. DCMS Challenges: Over the course of its response, SBA encountered various challenges with DCMS, including server hardware crashes and periods of system latency (periods of slowness and freezing), which added to some delays faced by business owners in receiving disaster assistance. According to SBA, the agency is taking several steps to improve DCMS for future disasters. For example, SBA planned to institute a process for updating system equipment based on a consistent life-cycle by, among other things, conducting a baseline inventory and implementing a plan to replace outdated hardware. According to SBA officials, the inventory has been validated by center directors and the plan has been completed. In addition, SBA officials said that the agency has made improvements to its DCMS Help Desk, which responds to loan officers who experience system issues. These improvements include implementing a tiered approach to addressing system issues and better ensuring that the Help Desk is used by all centers in a standardized way. Loan Officer Training: As mentioned previously, most of the additional processing staff, particularly those at the Sacramento center, were new hires, but SBA found that these new loan officers were not effectively trained to quickly respond to the backlog of business applications. According to SBA, loan processing production was not fully realized immediately following the increase in staff because it took new loan officers longer than expected to fully learn how to process loan applications. In addition, loan officers were not converted into business loan officers until they demonstrated proficiency in processing home loans. Further, these loan officers required additional specialized training to learn how to process a business loan within DCMS. According to SBA, this strategy was ineffective because it was implemented at the peak of receiving and processing applications. SBA has taken steps to revise its loan officer training for future disasters to be more production-oriented rather than focusing on DCMS use. According to SBA officials, the PDC developed a revised training course for processing business loans in May 2014 that is required for all loan officers. As of July 2014, three classes of approximately 18 loan officers each have completed the training. Additionally, SBA officials noted that it has reorganized its loan officers into two groups that specialize in processing home and business loans based on the previously mentioned changes made to its loan processing approach. Select Small Business Development Centers and local business organizations in New York and New Jersey that we met with identified two main challenges that affected the timeliness of SBA’s assistance from the perspective of small businesses applying for loans: time-consuming loan documentation requirements and lack of SBA follow-up. According to SBA officials, the agency is taking actions to address these two challenges for future disasters. Nearly all 14 SBDCs and local business organizations we met with noted that meeting the application’s documentation requirements was time- consuming and onerous to business owners. For example, 11 of the 14 entities we met with told us that gathering the necessary documentation to complete an application was difficult given the physical damage caused by Hurricane Sandy. Further, 6 of the 14 entities noted that follow-up requests for additional or updated documentation by SBA prolonged the application process and loan decision. As discussed previously, SBA requires business applicants to submit a variety of documents in order to make a loan decision, including the most recent federal income tax returns, a signed copy of the IRS tax information authorization Form 8821, a current (dated within 90 days of the application) personal financial statement, and a schedule of liabilities, among others. According to SBA, additional requests for documentation usually occur when either information needed to make a decision is missing or information provided was not sufficient. For example, many business owners submit their most recent federal income tax returns, but do not include this information for their affiliates, which is required to make a loan decision. In addition, tax returns are often requested—in addition to the IRS Form 8821, which provides SBA access to an applicant’s previous tax transcripts—because they provide loan officers with more detailed information that may be needed to make a loan decision. SBA officials said that the agency is taking several steps to streamline the documentation requirements for applicants and improve the process to submit additional information. Specifically, SBA has examined the entire loan application process in order to identify and eliminate documents that do not help loan officers make a decision on an application. According to SBA officials, the proposed changes to the required documentation have been drafted and will be incorporated in the next iteration of SBA’s disaster loan program standard operating procedures by the end of 2014. Also, as previously mentioned, SBA officials told us that the agency plans to consolidate entry points through which electronic loan applications can be submitted and improve DCMS so that applicants can submit certain documents from follow-up requests electronically rather than sending paper copies in the mail. Further, SBA took steps to reduce documentation requirements for applicants with strong credit scores by amending regulations to allow the agency to rely on credit scoring rather than cash flow when determining Under these new regulations, SBA has an applicant’s ability to repay.the option to base its repayment ability determination on either the applicant’s cash flow or credit score. According to SBA, by removing the requirement to analyze cash flow for applicants with strong credit scores in order to determine ability to repay, the agency can process these applications more expeditiously. Further, SBA stated that applicants with strong credit scores will not be required to submit further information documenting their personal and business cash flows to SBA. Finally, SBA noted that credit scoring can help SBA dedicate staff to applicants that do not have strong credit and reduce the overall processing time for loan applications. SBA pursued these legal changes to determining repayment ability in response to recommendations made by the Hurricane Sandy Rebuilding Task Force as well as its experience with the Sandy Alternative Processing Program (SAPP), in which selected home loan applications were processed in a similar manner after Hurricane Sandy. Over half of the entities we met with said that business owners noted that there was a lack of SBA contact after submitting their applications, and many owners were unaware of the status of their application throughout the process, including whether or not it had been received at the PDC. Additionally, five of the entities noted that there was a lack of continuity with loan officers or case managers over the course of the application process. experienced up to eight different loan officers or case managers during the process. In addition, these five entities reported that submitted documentation and information were lost when loan officers and case managers changed. According to SBA, a loan officer is responsible for making loan application decisions and a case manager is responsible for closing and disbursing the loan. required to supervise newer staff. In this case, the PDC will notify the applicant of the change in loan officer or case manager as soon as possible.SBA officials told us that some documents can be misplaced during the application process due to the multiple ways applicants can submit information to the PDC. In addition, some documents may not be misplaced; rather, they may not yet have been entered into DCMS and may not be available for loan officers to view. According to SBA officials, efforts to process electronic application submissions more effectively will address these issues. As part of this project, as previously mentioned, officials said SBA expects to create an electronic portal that will share information with applicants on the status of their applications and documents received, which should increase transparency and communication during the loan application process. SBA’s overall approval rate for Hurricane Sandy business loan applications was 42 percent, which was lower than those for Hurricanes Katrina, Rita, and Wilma, higher than that for Hurricane Ike, and comparable to the approval rate for Hurricane Irene. For Hurricane Sandy and each of the five previous disasters we examined, lack of repayment ability and unsatisfactory credit history were the two primary reasons why SBA declined business loan applications. Application withdrawal rates and loan cancellation rates were both higher for Hurricane Sandy than for the five previous disasters we examined. In comparison to the five previous disasters we selected, the overall approval rate for business loan applications for Hurricane Sandy was lower than those for Hurricanes Katrina, Rita, and Wilma, higher than that for Hurricane Ike, and comparable to the approval rate for Hurricane Irene. The overall approval rate for Hurricane Sandy business loan applications, including both physical disaster loans and EIDLs, was 42 percent. The approval rate for physical disaster loan applications was 45 percent, while the approval rate for EIDLs was 28 percent. For physical disaster loan applications specifically, the approval rate for Hurricane Sandy was lower than those for Hurricanes Katrina and Wilma, but higher than those for Hurricanes Ike and Irene, and comparable to that for Hurricane Rita. The approval rate for EIDL applications resulting from Hurricane Sandy was lower than those for Hurricanes Katrina, Rita, Wilma, and Irene, but higher than the rate for Ike (see fig. 7). Hurricane Sandy resulted in the highest total approval rate of disaster loan applications in comparison to the five previous disasters we examined. The total approval rate for disaster loan applications includes home loan applications combined with physical disaster loan and EIDL applications. For Hurricane Sandy, the total approval rate was 53 percent. Lack of repayment ability and unsatisfactory credit history were the two primary reasons why SBA declined business loan applications following Hurricane Sandy and in each of the five previous disasters we examined. Following Hurricane Sandy, SBA received 14,938 business loan applications (excluding reconsiderations and appeals), and declined 5,663 applications as of January 31, 2014. Of these declined applications, lack of repayment ability was at least one of the reasons SBA cited on 2,644 applications (47 percent), while unsatisfactory credit history was at least one of the reasons SBA cited on 2,317 applications (41 percent). See figure 8 below for more information on the leading decline codes for Hurricane Sandy and previous disasters. Other reasons that Hurricane Sandy business loan applications were declined include unsatisfactory history on an existing or previous SBA loan or other federal obligation, unsatisfactory debt payment history, a finding that the business was not eligible due to recoveries from other sources, and availability of credit elsewhere, among others. SBA can cite more than one reason for declining a loan application. Of the 5,663 Hurricane Sandy applications that SBA denied, 1,020 (18 percent) had two or more decline codes applied. Of the 14,558 original Hurricane Sandy business loan applications that had reached a decision status by January 31, 2014, 4,715 (approximately 32 percent) were withdrawn by either SBA or the applicant—a withdrawal rate higher than those of the previous disasters we examined.withdrawal rates for these previous disasters ranged from approximately 18 percent (for Hurricane Ike) to approximately 23 percent (for Hurricanes Katrina and Wilma), as shown in figure 9. The According to SBA, factors affecting the withdrawal and cancellation rates for Hurricane Sandy include the footprint of the disaster area and the availability of alternative sources of recovery (e.g., insurance coverage and grants). The Hurricane Sandy footprint covered areas with higher rates of insurance coverage compared to previous disasters. Additionally, officials told us that the rollout of programs funded by the Department of Housing and Urban Development’s Community Development Block Grant program (CDBG) began earlier than in past disasters, and that state grantees—specifically New Jersey and New York—obtained CDBG funds and accepted applications for their respective state grant programs shortly after the disaster struck. More than 6 years after Congress passed the Small Business Disaster Response and Loan Improvements Act of 2008, SBA has not piloted nor implemented three guaranteed disaster loan programs, which were therefore unavailable in response to Hurricane Sandy. Therefore, the potential effectiveness of these programs remains unclear. As previously discussed, the act mandated the creation of the Immediate Disaster Assistance Program (IDAP), the Expedited Disaster Assistance Loan Program (EDALP), and the Private Disaster Assistance Program (PDAP). According to SBA officials, the agency opted to implement IDAP first, because the loan limit is lower than that of EDALP and PDAP and funds were appropriated to pilot this program. A majority of entities with whom we spoke said that a program like IDAP (i.e., a loan up to $25,000 with a 36-hour application approval time) would be useful, as it could provide business owners with a short-term infusion of capital to complete tasks such as debris removal, repairing physical damage, and purchasing inventory. As previously discussed, on average, it took SBA 45 and 38 days to process physical business disaster loan and EIDL applications resulting from Hurricane Sandy, respectively (from application receipt to loan decision). As such, it took additional time for funds to be disbursed to an applicant approved for a direct disaster loan—time that could impact whether a business seeks other financing options or remain in operation. In a July 2009 report, GAO reported that SBA was planning to implement pilot programs for IDAP and EDALP to test applicable program requirements and to see how private lenders would administer the programs. GAO also reported that SBA requested funding to carry out the requirements for these two programs in the President’s budget for fiscal year 2010. SBA received subsidy and administrative cost funding totaling $3 million in the 2010 appropriation, which would allow the agency to pilot test about 600 loans under IDAP The agency also issued regulations for IDAP in October 2010. In May 2010, SBA also told GAO that its goal was to have the pilot for IDAP in place by September 2010. In addition, a SBA report noted in June 2012 that IDAP would be ready to be put into operation by the end of that year. However, as of August 2014, the pilot program for IDAP had not been conducted. According to SBA officials, the program has not been implemented for two primary reasons: (1) information technology challenges and (2) feedback from lenders indicating that program requirements may hinder lender participation in the program. First, the electronic systems that would be used to process IDAP applications did not interface smoothly with one another. According to SBA officials, IDAP’s readiness was, in part based on the ability of E-Tran (the 7(a) program’s electronic loan processing system) to interface with DCMS (the Disaster Loan Program’s Officials said that a new information electronic loan processing system). technology system is being developed—SBA One—and that it is more efficient to make DCMS interoperable with the new system to process IDAP applications than to make enhancements to E-Tran.anticipates that SBA One will be operational by early 2015. Second, SBA told us that they received feedback from lenders indicating challenges that may discourage lenders from participating in the program, although SBA’s documentation of this feedback is limited. In March 2010, SBA organized a forum with 11 lenders in the Gulf Coast to obtain their views on IDAP. Lenders stated that the program had to have simple eligibility determination, as well as confirmation that a potential IDAP borrower had applied for an SBA disaster loan before the lender would approve an IDAP loan. Lenders also expressed concerns about the possibility of guarantee denials if an applicant did not take out an SBA disaster loan. In addition, according to SBA, in 2010 the agency also consulted with Iowa lenders in flood-prone regions within the state via conference calls and lenders expressed similar concerns about IDAP. However, both the Gulf Coast forum and the conference calls with Iowa lenders were not documented at the time the lender outreach was conducted. As such, SBA officials must rely on the memory of staff who were present for the discussions. In response to our request for information on SBA’s outreach to these lenders, in July 2014, SBA provided a one-page summary on the outreach to both the Gulf Coast and Iowa lenders. The summary included a list of the Gulf Coast lenders that participated but not the Iowa lenders, and the discussion of lenders’ concerns was limited. If an applicant receives an IDAP loan before being declined for a direct disaster loan (through the Disaster Loan Program), the applicant is required to repay the loan not earlier than 10 years after the date of final disbursement 15 U.S.C. § 657n(d)(2). SBA regulations state that the maturity of an SBA IDAP loan must be at least 10 years from the date of final disbursement, but no more than 25 years. 13 C.F.R. § 123.703(d)(2). the one-time fee may not exceed $250 and an IDAP lender generally may not charge a borrower any additional fees. According to SBA officials, they also did not document lender feedback from this outreach effort. SBA officials told us that feedback on IDAP requirements was obtained from three banks, although officials could recall the identity of only one bank. In July 2014, SBA officials told us that the agency is still trying to conduct the IDAP pilot by attempting to identify solutions to increase lender participation. However, officials also noted that the lenders they met with were not willing to participate in IDAP (or an IDAP pilot) without changes to the statutory servicing term and the SBA regulatory program fee. Based on lender feedback, SBA officials said that the current statutory requirements, such as the 10-year loan term, make a product like IDAP undesirable and that lenders are not likely to participate in IDAP unless the loan term is decreased—for example, to between 5 and 7 years. However, revising statutory program requirements requires congressional action. SBA officials said that they have not discussed the feedback received from lenders with Congress. As a result, Congress does not have this information about SBA’s challenges with and plans to pilot and implement IDAP. Further, SBA officials told us that the agency plans to use IDAP as a guide to develop EDALP and PDAP, and until challenges with IDAP are resolved, SBA does not plan to implement these two programs. In addition, federal internal control standards state that all transactions and other significant events should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. Documentation should also be readily available for Although SBA obtained feedback from lenders on their examination.willingness to participate in IDAP, documentation of these discussions was limited and SBA has not conducted a formal documented evaluation of lenders’ feedback that would establish the basis for proposed changes to requirements for Congress to consider. Without an appropriately documented evaluation of its outreach to lenders, SBA may not have complete and reliable information on which to base its reporting to Congress about its challenges with implementing the programs required by the act. More generally, we previously recommended that SBA develop an implementation plan and report to Congress on the agency’s progress in addressing all requirements within the act and include milestone dates for completing implementation and any major program, resource, or other challenges the agency faces as it continues efforts to address requirements in the act. As of September 2014, the agency had not implemented this recommendation. Not having an implementation plan in place for addressing the remaining requirements and not reporting to Congress on related challenges can lead to a lack of transparency about the agency’s progress toward implementing these programs and its ability to adequately prepare for and respond to disasters. Following Hurricane Sandy, SBA did not meet its application processing goal for a number of reasons. SBA said it was challenged by a high volume of loan applications early in its response to the disaster primarily due to the use of electronic applications, as well as technological and other issues. Although electronic loan applications were created to simplify and expedite the application process and SBA has continued to encourage submitting applications electronically, SBA did not anticipate receiving such a large volume of electronic loan applications early in its response following Hurricane Sandy and was unprepared to process them. While SBA officials told us the agency has taken steps to respond to these challenges, it has not revised its disaster planning documents— including the Disaster Preparedness and Recovery Plan and ODA Playbook—to reflect the unexpected volume of early applications and its potential impact on staffing, resources, and forecasting models. Federal internal control standards state that management should identify risks and take action to manage them. Without taking the large volume of applications it received shortly after Hurricane Sandy into account in its disaster planning documents and analyzing the risk that trend may pose for timely disaster response, SBA risks being unprepared for a similar experience following future disasters, which may result in delays in providing loan funds to disaster victims. Due to lender feedback and technology challenges, SBA has yet to pilot IDAP and has not implemented IDAP, EDALP, and PDAP as required by Congress in the Small Business Disaster Response and Loan Improvements Act of 2008. SBA has also not developed an implementation plan for addressing the act’s requirements, as GAO recommended in 2009. This plan was to include, among other things, challenges the agency faces in implementing the act’s requirements. Private sector lenders have given SBA feedback on barriers to their willingness to participate in IDAP, such as statutory program requirements that could make the make the loans undesirable for lenders. However SBA has not conducted a formal documented evaluation of lenders’ feedback that would establish the basis for proposed changes to requirements for Congress to consider. In addition, SBA has not provided lenders’ feedback and its evaluation of that feedback to Congress—the entity that could remove potential barriers to SBA’s implementation of the program. As a result, SBA may lack reliable information to share with Congress about what program requirements should be revised to encourage lender participation. Such information could, for example, be obtained by conducting further outreach to lenders and documenting this outreach in accordance with federal internal control standards. Without sharing information with Congress on challenges to implementing IDAP, SBA may continue to face difficulties in implementing programs intended to provide assistance to disaster victims. In order to address potential risk to SBA’s ability to provide timely disaster assistance in the future, based on the agency’s experience from Hurricane Sandy, we recommend that the Administrator of SBA direct the Office of Disaster Assistance to take the following action: Revise SBA’s disaster planning documents to anticipate the potential impact of early application submissions on staffing and resources for future disasters, as well as the risk this impact may pose for SBA’s timely disaster response. In order to provide Congress with reliable information on challenges SBA has faced in implementing IDAP, we recommend that the Administrator of SBA direct the Office of Capital Access to take the following two actions: Conduct a formal documented evaluation of lenders’ feedback that can inform SBA and Congress about statutory changes that may be necessary to encourage lenders’ participation in IDAP. Report to Congress on the challenges SBA has faced in implementing IDAP and on statutory changes that may be necessary to facilitate SBA’s implementation of the program. We provided a draft of this report to SBA for review and comment. SBA provided written comments, which are described below and reprinted in appendix IV. SBA generally agreed with all recommendations presented in this report. In response to SBA’s comments addressing our first recommendation, we added information to the report on the role of electronic application submissions in the unanticipated large volume of applications SBA received early in its response to Hurricane Sandy. In response to our recommendation that SBA revise its disaster planning documents to anticipate the potential impact of early application submissions on staffing and resources for future disasters, SBA agreed with the importance of incorporating this information into its planning documents. In addition, SBA stated that it has already taken steps to document and address the early volume of application submissions. For example, SBA noted that the most recent Disaster Planning and Recovery Plan (DPRP) released in June 2014 addresses the increased usage of the electronic application and the resulting impact of early application submissions on staffing and resources due to both the convenience and speed of the Internet-based application and to the elimination of postal handling time. SBA further stated that it believes the agency has already met this recommendation. While SBA has acknowledged the impact of early application submissions on staffing and resources, SBA has not yet developed details of how it will incorporate its experience with Hurricane Sandy throughout its disaster planning to better address resource and staffing needs resulting from early application submissions. Thus, we maintain that SBA should take additional action to fully address this recommendation. SBA stated that it plans to go further and incorporate the early application submissions in the next update of the ODA Playbook and in other ODA planning documents. It will be important for SBA to follow through on these plans in order to reduce the risk that increased early application submissions pose to SBA’s ability to deliver timely disaster assistance. In response to our recommendations that SBA conduct a formal documented evaluation of lenders’ feedback on IDAP, and report to Congress on challenges to implementing the program, SBA agreed that its Office of Capital Access (OCA) has not performed a formal documented evaluation of IDAP. SBA further stated that OCA intends to conduct such an evaluation that will include feedback from a variety of lenders and will use the information to identify potential changes to the statute, current regulations, procedures, and forms for IDAP. SBA acknowledged that the focus of our report was on its assistance to small businesses following Hurricane Sandy; however, SBA noted that its mission to provide disaster loan assistance is not limited to small businesses but also extends to businesses of all sizes, private nonprofit organizations, homeowners, and renters. Specifically, SBA noted that about 83 percent of loan applications received after Hurricane Sandy were for home disaster loans, which caused a significant impact on the agency’s overall response. In our report, which specifically reviewed SBA’s assistance to small businesses following Hurricane Sandy, we acknowledge that SBA disaster assistance is not limited to small businesses and home loan applications comprised about 80 percent of all Hurricane Sandy disaster applications. Our report also notes that business owners could have faced delays due to the large number of home loan applications submitted ahead of them and that one process improvement SBA made after Hurricane Sandy was to revise its loan processing approach to create two separate tracks for home and business disaster loan applications. Finally, consistent with information provided in the report, SBA summarized various other process improvements that the agency has implemented to mitigate the challenges faced during Hurricane Sandy and for future disasters. The draft report that we sent to SBA for comment also described many of these changes. For example, we note in our report that SBA is taking several steps to streamline the documentation requirements for applicants and improve the process to submit additional information. However, as stated in our report, because SBA has not received a large volume of loan applications since Hurricane Sandy, it is too early to determine the extent to which these changes will improve the timeliness of SBA’s response to future disasters with a magnitude similar to that of Hurricane Sandy. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to SBA and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. Our objectives were to examine (1) the timeliness of the Small Business Administration’s (SBA) disaster assistance to small businesses following Hurricane Sandy and the factors that affected SBA’s timeliness, (2) the loan approval rates for small businesses and reasons for decline following Hurricane Sandy, in comparison with those of previous disasters, and (3) the extent to which SBA has implemented loan programs mandated by the Small Business Disaster Response and Loan Improvements Act of 2008. To evaluate the timeliness of disaster assistance to small businesses, we obtained and analyzed data from SBA’s Disaster Credit Management System (DCMS) on the average number of days it took SBA to process Hurricane Sandy business loans. Specifically, we analyzed the number of days from application receipt to loan decision, loan approval to closing, and closing to first loan disbursement. For analyses on the timeliness of disaster assistance, we used information on all loan application decisions, including information on reconsidered and appealed applications. To assess whether SBA met its timeliness goal of processing applications, we reviewed key documents, such as SBA’s Disaster Preparedness and Recovery Plan (DPRP), to identify any timeliness goals SBA has established and compared the DCMS data with such goals. Further, we reviewed work conducted by the SBA Office of Inspector General (OIG) to assess any changes SBA has made to setting and communicating goals related to timely disaster-loan processing. To identify factors that affected SBA’s timeliness of disaster assistance following Hurricane Sandy, we reviewed an internal assessment of SBA’s response to Hurricane Sandy as well as key SBA documents that outline agency roles and responsibilities for responding to a disaster, including the Disaster Assistance Program Standard Operating Procedures, DPRP, and Office of Disaster Assistance (ODA) Playbook. We also obtained and analyzed DCMS data on the number of business loan applications received after Hurricane Sandy by type of submission method (electronic or paper) and in processing from October 2012 to January 2014 to assess the extent to which identified factors affected SBA’s timeliness. Further, we interviewed SBA officials from the ODA, Processing and Disbursement Center, and Office of Disaster Planning to obtain their perspectives on challenges that SBA faced in providing disaster assistance and efforts taken to respond to those challenges. To obtain information on the factors that affected the timeliness of SBA’s assistance from the perspective of small businesses applying for loans, we spoke with selected Small Business Development Centers (SBDC) and other local organizations, such as chambers of commerce in New York and New Jersey, the states most heavily impacted by Hurricane Sandy. These selected entities were located in the counties that (1) were highly impacted based on assessments and reports by the Federal Emergency Management Agency (FEMA) and Department of Housing and Urban Development and (2) generated the most SBA business loan applications after Hurricane Sandy. We attempted to contact at least one SBDC and one local organization in each selected county. However, one SBDC and the local business organizations contacted in one county declined to be interviewed. Therefore, we spoke to a total of 14 entities (6 SBDCs and 8 local business organizations). While the results of these interviews could not be generalized to all counties and states affected by Hurricane Sandy, they provided insight into challenges SBA faced in providing timely assistance to small businesses. To calculate the loan approval rates for small businesses following Hurricane Sandy, we obtained and analyzed DCMS data on approvals and declines. Specifically, we divided the number of approved applications by the total number of approved and declined applications.Because physical disaster loans are not restricted to small businesses, we were not able to determine the physical disaster loan approval rate for small businesses. To evaluate the reasons why business loan applications were declined or withdrawn following Hurricane Sandy, we obtained DCMS data on the codes applied to declined and withdrawn applications and identified the most prevalent codes. To identify the reasons why approved business loans were cancelled following Hurricane Sandy, we obtained DCMS data on the codes applied to cancelled loans and identified the most prevalent cancellation codes. To compare the application approval and withdrawal rates, the reasons for decline, and the loan cancellation rates following Hurricane Sandy with those of previous disasters, we selected the five largest disasters since 2005 based on disaster loan application volume and performed the same analyses of the relevant DCMS data. The five disasters we selected were Hurricanes Katrina, Rita, Wilma, Ike, and Irene. We interviewed SBA officials to confirm that the Disaster Loan Program’s procedures for how data elements are defined, entered, and maintained remained substantially unchanged during this time period. To assess the reliability of DCMS data, we (1) performed comparisons across the data SBA provided to identify any obvious errors in accuracy and completeness; (2) reviewed related documentation such as the DCMS data dictionary and data verification documentation; and (3) worked with appropriate agency officials to identify any data problems. When we found discrepancies, such as unpopulated fields or data entry errors, we notified agency officials and worked with these officials to correct the discrepancies before conducting our analysis. We determined that the data were sufficiently reliable for the purposes of our report. To examine the extent to which SBA has implemented loan programs mandated by the Small Business Disaster Response and Loan Improvements Act of 2008, we reviewed the act, other relevant legislation, and draft guidance for the Immediate Disaster Assistance Program. Further, we interviewed SBA officials from ODA and the Office of Capital Access to obtain their perspectives on SBA’s efforts to implement the Immediate Disaster Assistance Program (IDAP) and related challenges because IDAP is the only one of the three mandated guaranteed loan programs for which SBA has issued regulations. We conducted this performance audit from August 2013 through September 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: New Jersey and New York Hurricane Sandy Business Disaster Loan Applications Received and Approved and Dollar Amounts (as of January 2014) The table below outlines the number of Hurricane Sandy business disaster loans that were received and approved and the dollar amounts of approved loans for highly impacted counties in New York and New Jersey. This table does not include all counties that were impacted by Hurricane Sandy and all counties that received SBA business disaster loans. The following tables include decline, withdrawal, and cancellation codes—as described in SBA’s Standard Operating Procedures, Appendixes 3, 4, and 9—that are used for physical disaster loan applications (both home and business), and Economic Injury Disaster Loan applications. In addition to the contact named above, Marshall Hamlett (Assistant Director), Shamiah T. Kerney (Analyst-In-Charge), Vaughn Baltzly, John McGrail, Marc Molino, Christine Ramos, Jennifer Schwartz, and Andrew Stavisky made key contributions to this report.

Summary: On October 29, 2012, Hurricane Sandy made landfall, causing an estimated $65 billion in damage. SBA administers the Disaster Loan Program, which provides physical disaster loans (used to rebuild or replace damaged property) and economic injury disaster loans (used for working capital until normal operations resume) to help businesses and individual homeowners recover from disasters. In the aftermath of Hurricane Sandy, Congress passed the Disaster Relief Appropriations Act of 2013, which appropriated $779 million to SBA for disaster loans and administrative expenses. GAO was asked to review SBA's assistance to small businesses following Hurricane Sandy. This report examines (1) the timeliness of SBA's disaster assistance to small businesses; (2) the loan approval rates for small businesses and reasons for decline for Hurricane Sandy and previous disasters; and (3) the extent to which SBA has implemented programs mandated by the Small Business Disaster Response and Loan Improvements Act of 2008. GAO analyzed SBA data on application processing; reviewed documentation related to SBA's planning, relevant legislation, and regulations; and interviewed SBA officials. Following Hurricane Sandy, the Small Business Administration (SBA) did not meet its timeliness goal for processing business loan applications. From application receipt to loan decision, SBA took an average of 45 days to process physical business disaster loans and 38 days for economic injury loans, both of which exceed SBA's 21-day application processing goal. SBA said it was challenged by an unexpectedly high volume of loan applications that it received early in its response to the disaster, in addition to other challenges, such as technological issues. SBA estimated that application submissions would peak about 7 to 9 weeks after Hurricane Sandy, but it received a larger volume of applications than were expected prior to that period. While SBA officials told GAO that the agency has taken steps to respond to some challenges, it has not revised its disaster planning documents—including the Disaster Preparedness and Recovery Plan—to reflect the early volume of application submissions received after Hurricane Sandy and the potential impact a similar experience could have on staffing, resources, and forecasting models for future disasters. Federal internal control standards state that management should identify risks and take action to manage them. Without taking its experience with early application submissions after Hurricane Sandy into account in its disaster planning documents and analyzing the potential risk early submissions may pose for timely disaster response, SBA may be unprepared for a large volume of applications to be submitted quickly following future disasters, which may result in delays in loan funds for disaster victims. SBA approved 42 percent of business loan applications following Hurricane Sandy. This rate was lower than those of Hurricanes Katrina, Rita, and Wilma, higher than that of Ike, and comparable to that of Irene (the five disasters that generated the most SBA disaster loan applications since 2005). For Hurricane Sandy and for previous disasters, SBA declined business loan applications primarily because of applicants' lack of repayment ability and credit history. SBA has not implemented the guaranteed disaster loan programs Congress mandated in 2008, including the Immediate Disaster Assistance Program (IDAP)—a bridge loan program through private sector lenders providing disaster victims with up to $25,000 with a 36-hour application approval period. SBA officials told GAO they are trying to implement IDAP but have received feedback from lenders that some program requirements—such as a statutory minimum 10-year time frame for servicing the loan under certain circumstances—may discourage lenders from participating. However, SBA has not conducted a formal documented evaluation of lenders' feedback that would establish the basis for proposed changes to requirements for Congress to consider. Without an appropriately documented evaluation of its outreach to lenders, SBA may not have complete and reliable information on which to base its reporting to Congress about its challenges with implementing the programs required by the act. GAO recommends that SBA revise its disaster planning documents, conduct a formal documented evaluation of lenders' feedback on IDAP, and report to Congress on challenges to implementing the program. SBA generally agreed with GAO's recommendations.