The Gulf Coast hurricanes collectively represented the most costly natural disaster in recent U.S. history. As table 1 shows, the estimated property damage from these hurricanes exceeded $118 billion, nearly five times greater than the damage from the 1994 Northridge earthquake and more than two and one-half times greater than the damage from the 2004 Florida hurricanes. Hurricane Katrina was the first of these disasters, causing fatalities and damage in southern Florida in late August 2005 before striking the northern Gulf Coast region. This region received the brunt of the storm, including extensive damage and significant loss of life in Louisiana and Mississippi. Damage from Hurricane Katrina also extended into the Florida panhandle, Georgia, and Alabama and covered approximately 90,000 square miles—an area larger than the size of Great Britain. Hurricane Rita was the next disaster to strike the Gulf Coast region, making landfall near the Texas and Louisiana border on September 24, 2005, and causing a wide swath of damage from eastern Texas to Alabama, flooding some areas in Louisiana that had already been impacted by Hurricane Katrina about 1 month earlier. Hurricane Wilma was the last of these disasters to strike the region, making landfall in southern Florida on October 24, 2005, and inflicting widespread damage across the state. The federal government provides funding and assistance after disasters through a variety of agencies and programs. Congress created FEMA to coordinate response and recovery efforts under presidential disaster declarations. FEMA works with other federal, state, and local agencies to assist victims after major disasters, and volunteer organizations such as the American Red Cross also participate in these efforts. Following a presidential disaster declaration, FEMA will open Disaster Recovery Centers where disaster victims can meet with representatives, obtain information about the recovery process, and register for federal disaster assistance. Victims may also register with FEMA by telephone or via FEMA’s Internet site. FEMA provides housing assistance to disaster victims through the Individuals and Households Program (IHP). Under the IHP, FEMA can make grants available to repair or replace housing damaged in a disaster that is not covered by insurance. However, the IHP is a minimal repair program that is designed to make the victim’s home habitable and functional, not to restore the home to its predisaster condition. When disaster victims register for FEMA assistance, they are asked to provide their approximate household income. If the applicant’s income exceeds certain thresholds, FEMA automatically refers them to SBA’s Disaster Loan Program. SBA’s Disaster Loan Program is the primary federal program for funding long-range recovery for private sector, nonfarm disaster victims and the only form of SBA assistance not limited to small businesses. The Small Business Act authorizes SBA to make available the following two types of disaster loans: Physical disaster loans—These loans are for permanent rebuilding and replacement of uninsured or underinsured disaster-damaged property. They are available to homeowners, renters, businesses of all sizes and nonprofit organizations. These loans are intended to repair or replace the disaster victim’s damaged property to its predisaster condition. Economic injury disaster loans—These loans provide small businesses with necessary working capital until normal operations resume after a disaster declaration. They cover operating expenses the business could have paid had the disaster not occurred. The act restricts economic injury disaster loans to small businesses only. Under a presidential disaster declaration, SBA disaster assistance staff members secure space within FEMA—established Disaster Recovery Centers and begin meeting with victims to explain the agency’s disaster loan process, issue loan applications and, if requested, assist victims in completing applications. Figure 1 illustrates SBA’s disaster loan process. During the application entry stage, SBA screens all incoming applications to determine if they are acceptable. In addition, SBA conducts a preliminary financial analysis of home loan applications to determine whether the applicant’s income falls below the agency’s minimum income thresholds or if repayment ability is evident based on a review of the applicant’s gross income and fixed debts. SBA declines home loan applicants that do not meet its minimum income requirements or demonstrate repayment ability. SBA also obtains a credit bureau report for business and home loan applicants, and SBA may decline an applicant based on information contained in the report. SBA refers to denials made during the application entry stage as preprocessing declines. SBA intended for these declines to eliminate delays in notifying applicants about loan denials. SBA will refer most home loan applicants denied a loan to FEMA for possible grant assistance under a presidential disaster declaration. After the application entry stage, applications move to the loss verification stage, and SBA staff members scan application documents into DCMS. During the loss verification stage, loss verifiers conduct on-site damage inspections for physical disaster loan applications to estimate the cost of restoring damaged property to predisaster condition. Loss verifiers use tablet personal computers with software tailored to complete and submit reports electronically into DCMS. The verified loss becomes the basis for the loan amount. Once the loss verification is complete, an application moves to the application processing stage, where loan officers check for duplication of benefits and assess the applicant’s credit history and ability to obtain credit elsewhere. Loan officers also examine other applicant eligibility criteria, including compliance with child support obligations and history on other federal debt, such as student loans. Loan officers use a financial analysis tool within DCMS to determine if the applicant has the ability to repay the loan. As with preprocessing declines, SBA generally refers home loan applicants denied a loan in application processing to FEMA for possible grant assistance under presidential disaster declarations. For secured loans, legal staff members review the draft loan authorization and agreement for sufficiency of collateral instruments and other legal concerns. They also create a loan closing checklist—a list of the requirements necessary to generate the loan closing and other legal documents. Attorneys enter a legal concurrence into DCMS, which obligates the loan funds through an interface with SBA’s accounting system. Legal support staff members prepare closing documents and mail them to the applicant or nearest Disaster Recovery Center. SBA can make a maximum initial disbursement, without collateral, of up to $10,000 for physical disaster loans and $5,000 for economic injury disaster loans, once the agency receives signed closing documents from the applicant. SBA can make a maximum initial disbursement of up to $25,000 for physical disaster loans with collateral—preferably real estate. SBA generally makes subsequent disbursements on physical disaster loans based on the applicant’s needs and how they spent prior disbursements. DCMS replaced SBA’s largely manual, paper-based loan process and its Automated Loan Control System (ALCS), which it had used since the early 1990s. ALCS enabled SBA to track the movement of paper loan application files from one stage of the process to another, but the manual loan process required the movement and storage of large volumes of paper. In December 1998, SBA began planning for a replacement disaster loan system. SBA purchased a commercial-off-the-shelf package as the foundation for DCMS in 2003 and had the package customized. SBA intended for DCMS to help it move toward a paperless processing environment by automating many of the functions staff members had performed manually, such as obtaining FEMA referral data and credit bureau reports, as well as completing and submitting loss verification reports from remote locations. SBA began a phased implementation of DCMS in November 2004 at its former Niagara Falls Disaster Area Office (DAO). In January 2005, SBA began using DCMS to process loan applications for all new disaster declarations and by March 2006, SBA completed the migration of all data for disaster loan applications processed since 2000 from ALCS to DCMS. According to SBA, the cost for planning, acquiring, implementing, and operating DCMS totaled about $32 million through April 2006. See appendix II for a more detailed discussion of SBA’s acquisition and implementation of DCMS. We identified several factors that affected SBA’s ability to provide timely disaster assistance, including a large volume of applications that exceeded any previous disaster. In addition, although DCMS allowed SBA to streamline the disaster loan process, SBA focused only on its historical experience and did not consider the possibility of a single or series of disasters of the magnitude of the Gulf Coast hurricanes when planning the system’s maximum user requirements. SBA’s limited planning contributed to insufficient DCMS user capacity, which restricted the number of staff that could access the system and process the large volume of applications in a timely manner. Further, SBA did not completely stress test DCMS before implementation to help ensure that it could function at its maximum user capacity and thus did not detect that the wrong processors had been installed by its hosting contractor and that the system could not support planned capacity. As a result of these and other processing-related factors, SBA experienced significant backlogs and delays in processing applications. Overall, SBA processed disaster loan applications in 74 days, on average, as of May 27, 2006, compared with its goal of within 21 days. According to SBA officials, the large volume of disaster loan applications it processed for victims of the Gulf Coast hurricanes was a significant challenge. The volume of applications associated with these hurricanes greatly exceeded any disaster in SBA’s history. As table 2 shows, as of May 27, 2006, SBA had issued more than 2.1 million applications to victims affected by the Gulf Coast hurricanes. This represented almost four times as many applications as SBA issued to victims of the Northridge earthquake—the single largest disaster SBA had previously faced. In addition, our analysis showed that SBA received a large influx of applications during the initial months following Hurricane Katrina—at the same time that SBA hired and trained a large number of temporary staff to process applications received from victims of the disasters. Specifically, SBA received about 280,000 applications during the first 3 months following Hurricane Katrina, approximately 30,000 more applications than SBA received over a period of about 1 year from victims of the Northridge earthquake. SBA officials told us that the large volume of applications that it mailed and received resulted in part from the large number of referrals FEMA made to SBA’s Disaster Loan Program without applying SBA’s income thresholds, specifically for disaster victims who registered for disaster assistance via FEMA’s Internet site and did not report any income. According to a FEMA official, disaster victims who register via FEMA’s Internet site can select the “Income Unavailable/Refused” option if they do not wish to or cannot provide their income. The official stated that these individuals are advised that selecting this option will result in an SBA referral. The FEMA official also stated that, per an SBA request, FEMA refers all applicants who claim self-employment as their primary source of income to SBA’s Disaster Loan Program, regardless of their income, because the income tests are not a valid measure of repayment ability for self-employed applicants. In both cases, FEMA’s registration system automatically fills $0 as the disaster victim’s income and refers these individuals to SBA’s Disaster Loan Program. The FEMA official stated that about 17 percent of the individuals referred to SBA for Hurricanes Katrina and Rita refused to provide their income, and another 17 percent indicated that they were self-employed. SBA officials referred to these cases as “$0 income” referrals. In February 2006, SBA’s Office of Inspector General issued an advisory memorandum, stating that many $0 income referrals ultimately failed SBA’s criteria for disaster loan eligibility and were processed as declines. SBA’s Office of Inspector General added that these referrals impacted SBA by increasing the cost incurred by SBA in mailing loan applications to disaster victims that normally would not be referred to SBA’s Disaster Loan Program; delaying response times for those applicants who did qualify for SBA’s lowering SBA’s disaster loan approval rates; and increasing the transaction flow through DCMS, which was near maximum capacity. SBA’s Office of Inspector General recommended that SBA improve its screening processes within DCMS when processing $0 income referrals and work with FEMA to reduce unnecessary online disaster referrals. In commenting on a draft of the advisory memorandum, SBA agreed that it should work with FEMA to improve their joint screening process prior to referral and issuing an SBA disaster loan application. DCMS provided SBA with a number of benefits compared with its previous system, such as the capability to complete loss verification reports and other processing-related tasks electronically. However, SBA planned DCMS’s maximum user capacity based solely on the volume of applications it received from victims of the Northridge earthquake and its other historical data; it did not consider the information available from catastrophe risk modeling firms or disaster simulations such as the likelihood and severity of damages from potential catastrophes. Although agencies are not specifically required to consider such information in developing their system’s user capacity requirements, this information could have helped SBA predict the volume of loan applications to expect and the necessary user capacity needed to process such a volume. SBA officials acknowledged that they could have considered this information in planning DCMS’s user capacity requirements but lacked the funding to do so. SBA’s limited planning and other system and processing related issues diminished the agency’s ability to provide disaster assistance in a timely manner. Many insurance companies and government agencies currently use computer programs offered by several modeling firms to estimate the financial consequences of various natural catastrophe scenarios. Risk modeling firms, which have existed since the late 1980s, rely on sophisticated mathematical modeling techniques and large databases containing information on past catastrophes, population densities, construction techniques, and other relevant information to assess the severity of potential catastrophes so that other organizations can plan accordingly. For example, one modeling firm recently estimated that 1.5 million people were vulnerable to an earthquake on the San Andreas Fault in the San Francisco area and that an earthquake similar to the 1906 earthquake would cause an estimated $260 billion in damages to residential and commercial properties. This study also noted that the U.S. Geological Survey estimated that there was a 21 percent probability of a major earthquake on this fault occurring before 2032. Another modeling firm study of a strong hurricane striking the densely populated Northeast region estimated this event could cause more than $200 billion in economic losses, including significant damage from flooding to properties and infrastructure in lower Manhattan and Long Island. While SBA would not utilize this information the way insurance companies do to assess the financial consequences of potential disasters, catastrophe risk modeling firms provide important information on the severity of damages from such events. This information could be helpful in estimating the potential number of loan applications that SBA could receive for processing and the concurrent user capacity necessary to process such applications in a timely manner if such an event were to occur. Government agencies and other organizations also participate in disaster simulation exercises to prepare for their response to natural disasters. While SBA would not use this disaster simulation information to plan a response to victims’ immediate needs, the estimated number of buildings damaged and number of people evacuated provides important information that can be considered in planning the user capacity of a disaster loan system. For example, FEMA brought together numerous officials from local, state, federal, and volunteer organizations to conduct an exercise referred to as Hurricane Pam in July 2004. This exercise used realistic weather and damage information developed by the National Weather Service, the U.S. Army Corps of Engineers, the Louisiana State University Hurricane Center, and other state and federal agencies to help officials develop joint response plans for a catastrophic hurricane in Louisiana. This fictional hurricane brought sustained winds of 120 miles per hour, up to 20 inches of rain in parts of southeast Louisiana, and storm surge that topped levees in the New Orleans area. Hurricane Pam, as projected, destroyed between 500,000 and 600,000 buildings and forced the evacuation of more than 1 million residents from the New Orleans area. In planning the maximum user capacity for DCMS, SBA relied solely on the volume of applications it received from victims of the Northridge earthquake and its other historical data, such as the average number of applications processed for the previous 5 years. SBA did not plan for the likelihood of a single disaster or series of disasters of the magnitude of the Gulf Coast hurricanes. If SBA had considered the information available from catastrophe risk modeling firms or disaster simulations, such as the likelihood and potential damages from catastrophic events, to help it predict the volume of loan applications that might be expected and the user capacity needed to process this volume, the agency may have acquired additional capacity that would have enabled it to reduce its backlog of applications sooner. SBA’s limited planning contributed to insufficient DCMS user capacity, which restricted the number of staff that could access the system and process the large volume of applications in a timely manner. SBA experienced instability with DCMS during the initial months following Hurricane Katrina, as users experienced outages, difficulties connecting to the system, and slow response times in completing loan processing tasks. For example, our review of DCMS system logs showed that between September and December 2005 SBA experienced the following incidents: 19 incidents where DCMS was not available to all system users due to an unscheduled outage, and 26 incidents where DCMS was not available to various units due to an unscheduled outage. SBA officials told us that the longest period of time DCMS was unavailable to users due to an unscheduled outage was 1 business day. These unscheduled outages and other system-related issues slowed productivity and affected SBA’s ability to provide timely disaster assistance; however, we could not determine the specific impact on the agency’s time frames for processing disaster loan applications received from Gulf Coast hurricane victims. According to SBA officials, ineffective technical support contributed to the system instability experienced by users, as its hosting contractor did not properly monitor the DCMS network as contractually required and did not make the agency aware of incidents that could make the system unstable prior to DCMS users being affected. In addition, SBA officials told us that its hosting contractor did not provide the agency with the correct computer hardware for DCMS as contractually required, which further contributed to the instability users initially experienced with the system and reduced processing power by about one-third. Specifically, in developing DCMS, SBA planned for a maximum capacity of 1,500 concurrent users. SBA officials told us that they discovered that DCMS was operating near 100 percent capacity in September 2005 before the agency had reached its maximum user capacity. At that time, SBA discovered that the hosting contractor had not provided the agency with the correct computer hardware required per its contract in order to support 1,500 concurrent users. However, SBA did not verify that its hosting contractor provided the agency with the correct computer hardware specified in its contract. Federal procurement policies require agencies to have trained and experienced officials available to judge whether contractors are performing according to contract terms and conditions, particularly when contracting for highly specialized or technical services. In addition, SBA’s internal procurement procedures require that the agency inspect each item or service provided under a contract, report capital equipment acquisitions immediately—including computer equipment, and provide a serial number for capital equipment acquisitions for tracking purposes. SBA officials did not have an explanation for why the agency did not verify that the hosting contractor provided the correct computer hardware. If SBA had verified this equipment as required, the agency might have discovered this issue prior to the Gulf Coast hurricanes and been able to take the appropriate corrective action. Prior to implementation, SBA did not completely stress test DCMS to ensure that the system could operate effectively at maximum capacity, which contributed to the initial system instability SBA experienced. In 2003, SBA began testing various aspects of DCMS, including the core application interfaces and additional components such as loss verification and scanning. Although SBA conducted performance testing for DCMS, we found that the agency only stress tested the system for up to 120 concurrent users due to limitations with the hardware in the testing environment. The testing environment simulated an increasing number of concurrent users and exercised different functional scenarios, but the hardware used in the simulation reached its capacity earlier than anticipated. Even if the testing environment functioned as planned, an estimate showed that DCMS could accommodate approximately 600 concurrent users at this time—significantly less than the system’s planned maximum capacity of 1,500. According to leading information technology organizations, to be effective, practices for testing software should be planned and conducted in a structured and disciplined environment. Typically, this involves testing increasingly larger increments of a system until the complete system and all of its functionality are tested and accepted. It also involves stress testing and fully demonstrating the effectiveness and accuracy of the system. Additionally, SBA’s internal systems development manual requires that the agency determine testing and acceptance criteria that must be met for a system to be accepted as “fit for use” by the user or sponsoring organization and requires user or sponsoring organization approval of all acceptance criteria. Further, the manual identifies how acceptance testing is to be conducted and reported to determine whether the system meets its requirements upon completion of its development. In doing limited stress testing of DCMS, SBA did not completely follow its own requirements or industry best practices for systems testing. When these requirements are not met, there is potential risk that the implemented system will not meet the system requirements. If SBA had conducted complete stress testing, the agency might have detected that it did not receive the correct equipment and had an opportunity to address this issue before implementing DCMS. Because of the unpredictable nature of disasters and the cost of maintaining staff that it might not need, SBA hires and trains a large number of temporary staff to help process loan applications following any large scale disaster, such as the Gulf Coast hurricanes. SBA also has a disaster reserve corps, a group of experienced individuals it relies upon who have worked with the agency in responding to previous disasters and are trained in its disaster loan process. SBA officials told us that it generally took approximately 30 days for loan officers without prior SBA experience to become fully productive. This slows processing during the initial months following a disaster, as loan officers become familiar with SBA’s disaster loan process and DCMS. In response to the Gulf Coast hurricanes, SBA also had to secure additional space and equipment to support loan processing. According to SBA officials, this process took approximately 30 to 60 days. As figure 2 shows, as the average number of loan processing staff increased, SBA generally processed more applications than it did during the first 2 months following Hurricane Katrina. Because SBA normally relies on temporary staff to help process loan applications after large disasters, it might be unrealistic to expect the agency to process a large volume of applications quickly during the initial period following such disasters. The geographic dispersion of disaster victims—in particular for Hurricanes Katrina and Rita—also affected SBA’s ability to provide timely disaster assistance. Figure 3 illustrates the location of displaced applicants affected by these disasters that registered for FEMA IA. These applicants relocated to all 50 states, with the largest concentrations in Louisiana, Mississippi, and Texas. SBA officials told us that FEMA referred many of these applicants to its Disaster Loan Program, and their widespread geographic dispersion made it more challenging to provide timely disaster assistance. Loan officers we met with also told us that contacting applicants to discuss the status of their loan application was difficult in some cases—particularly during the initial months following the disasters, as some applicants had moved or changed employment several times since applying for disaster assistance. Thus, SBA did not always have an applicant’s most current information, which slowed the processing of their application. Our analysis showed that it took SBA several months to significantly reduce the backlog of applications that developed in various stages of its disaster loan process because of the large volume of applications, limited planning for DCMS, and other processing-related challenges. For example, SBA did not clear the backlog in the application entry stage until nearly 3 months following Hurricane Katrina. SBA nearly cleared the backlog in the loss verification stage 8 months after the disaster when the backlog was reduced to less than 1,800 applications. However, at that time, SBA still needed to complete loan processing for about 25,000 applications. As figure 4 shows, SBA’s backlog in the loss verification and application processing stages increased significantly during the first 3 months following Hurricane Katrina as SBA began receiving a large volume of applications from victims of the other hurricanes. These backlogs combined peaked at over 204,000 applications in late December 2005. Figure 4 also shows that, individually, SBA’s backlog in the loss verification stage peaked at almost 129,200 applications about 3 months following Hurricane Katrina, and the backlog in the application processing stage peaked at more than 121,700 applications nearly 6 months after the disaster. As a result of the backlogs, victims of the Gulf Coast hurricanes waited about 74 days on average for SBA to process their loan applications, compared with the agency’s goal of within 21 days. Figure 5 shows SBA’s average processing time frames for approval and decline decisions made between mid-October 2005 and May 2006 compared with its goal of within 21 days. Although SBA began to reduce the total backlog in loss verification and application processing in late December 2005, average processing time frames for approval and decline decisions generally increased through May 2006 because of the average age of applications in the backlog. For example, SBA reduced the backlog in application processing to less than 4,500 by late May 2006; however, average processing time frames were still significantly higher than its goal because loan applications had been in the application processing queue for a long time—about 63 days on average. SBA’s processing average for approvals does not include additional time frames for loan closings and initial disbursements. For example, SBA received signed closing documents from borrowers about 35 days, on average, after making the approval, as of May 27, 2006. According to SBA officials, delays in closing loans were mostly the result of factors beyond their control. For example, SBA officials stated that they scheduled loan closings at the convenience of the borrower. These officials added that because of the displacement of Gulf Coast hurricane victims, SBA had closed about 50 percent of disaster loans by mail, a higher percentage than previous disasters, which generally takes more time than closings done in person. SBA officials also stated that there were a significant number of disaster victims who had not returned to the affected area and who had expressed uncertainty about rebuilding their homes and businesses. As a result, these victims had been reluctant to quickly close on their loans. SBA’s disaster lending procedures generally require applicants to close loans within 60 days of the date on the loan authorization and agreement. These procedures also allow SBA to accept loan closing documents after 60 days on a discretionary basis. SBA officials told us they had allowed Gulf Coast hurricane victims additional time to determine if they really wanted the loan. To facilitate loan closings, SBA officials also told us they used staff to conduct follow-up calls with borrowers after closing documents were mailed. In addition, our analysis of an SBA data extract further showed that the agency made an initial disbursement for approved loans on average about 9 days after the receipt of closing documents. As of May 27, 2006—9 months after Hurricane Katrina—SBA had disbursed about $1.4 billion or 14 percent of the $9.7 billion approved loan dollars. As of the same date, about 73,000 approved loans had not been fully disbursed to disaster victims. As with loan closings, SBA officials stated that the length of time it took to disburse disaster loans was primarily determined by the borrower. SBA’s disaster lending procedures require borrowers to arrange for and obtain all loan funds within 12 months from the date of the loan agreement. However, SBA officials told us that it might be difficult for some disaster victims to meet this requirement. In our subsequent report on SBA’s response to the Gulf Coast hurricanes, we plan to discuss the perspectives of disaster victims related to the disaster loan process. Although SBA took several actions after the Gulf Coast hurricanes to improve its response to disaster victims, our analysis showed that some of these actions were more successful at reducing the backlog of loan applications than others. For example, SBA increased the number of concurrent users that could access DCMS by acquiring additional computer hardware and adding a second work shift for loan processing staff to better balance the system’s workload. In addition, SBA initiatives to relax filing requirements for applicants whose business records were destroyed and establish a satellite office to process disaster loans at its former Sacramento DAO allowed SBA to improve its response to disaster victims. However, SBA did not experience as much success with its initiatives to expedite small business financing to communities affected by the disasters and use private sector banks to process disaster loan applications. As a result, some of SBA’s initiatives did not significantly reduce the backlog of loan applications or the time victims waited for SBA to process their disaster loan applications. As previously discussed, SBA initially experienced instability and other issues with DCMS. However, the agency took actions to address these issues. In October 2005, SBA obtained the computer hardware, as agreed to with its contractor, that increased DCMS’s capacity to about 2,000 concurrent users. SBA also obtained additional support from its hosting contractor, at no additional cost, to ensure adequate monitoring of the DCMS network. By November 2005, because DCMS continued to operate near its maximum capacity, SBA added a second shift for loan processing staff at its Fort Worth processing facility to better balance DCMS’s workload. According to SBA officials, DCMS had been stable since January 2006, and users reported having a greater comfort level and more success in processing applications using the system. The officials added that the hosting contractor had provided better oversight over DCMS compared with the initial months following Hurricane Katrina. In April 2006, SBA officials advised us that the agency had not made any payments to its hosting contractor since August 2005 because it did not satisfy contract requirements, and negotiations were under way to determine the amount of any subsequent payments. In preparation for the 2006 hurricane season, SBA awarded a new contract in April 2006 for up to $54 million to its integration contractor to provide project management and information technology support for DCMS over the next 5 years. This contractor will continue to upgrade the system to support increased loan processing activity by implementing software changes and hardware upgrades, providing ongoing support to DCMS users, and supporting all information technology operations associated with the system under the contract. In addition, SBA has plans to increase DCMS’s maximum user capacity to at least 8,000 concurrent users by the summer of 2006. However, we could not determine how SBA selected this number or whether the agency considered the information available from catastrophe risk modeling firms or disaster simulations in determining the planned for increase in maximum user capacity. To facilitate this planned capacity increase, SBA added on to and extended the contract with its hosting contractor in February 2006. Although SBA had experienced problems with the initial oversight provided by this hosting contractor, according to agency officials, the contractor’s performance had improved. For example, the contractor had dedicated a project manager to this effort. Because of these improvements and the contractor’s familiarity with SBA’s needs, agency officials decided that the contractor could provide a hardware solution for the expanded capacity within the agency’s time frames. After the Gulf Coast hurricanes, SBA made several changes to its disaster loan process and implemented other initiatives intended to improve its response to victims. While some of these initiatives improved SBA’s ability to process large numbers of disaster loan applications, others did not. For example, in October 2005, SBA established a satellite office to process disaster loans at its former Sacramento DAO. SBA increased the number of loan processing staff in this Sacramento satellite office from approximately 40 in late August 2005 to more than 250 by February 2006. According to SBA, 8 months after Hurricane Katrina, the Sacramento satellite office had processed about 95,500 home and 4,800 business applications through DCMS for Gulf Coast hurricane victims. Table 3 describes other SBA changes or initiatives that improved its response to disaster victims by making the application process easier or referring some applicants to FEMA for grant assistance sooner. In contrast to these actions, SBA implemented other initiatives that had more limited success. For example, in November 2005, SBA implemented the GO Loan Program. SBA intended for this program to expedite small business financing for communities severely impacted by Hurricanes Katrina and Rita. This program provided an 85 percent guaranty to qualified lending partners, such as banks, that agreed to make expedited loans available under the agency’s 7(a) loan program up to $150,000 to small businesses located in communities affected by the disasters. Under the GO Loan Program, small businesses applied directly to qualified lenders, who evaluated their creditworthiness and determined if they required an SBA guaranty to make the loan. SBA agreed to make a decision on whether to apply a guaranty to the loan within 24 hours. While SBA prescribed the maximum interest rate lenders could charge, the lender and borrower negotiated the actual rate. For loans of $50,000 or less, lenders could charge a maximum interest rate of 6.5 percentage points over the prime rate and a maximum rate of 4.5 percentage points over the prime rate for loans over $50,000. Thus, lenders could charge disaster victims interest rates that were significantly higher under the GO Loan Program than the rates SBA charged under the Disaster Loan Program. For example, a disaster victim applying for a $60,000 GO Loan could have been charged an interest rate up to 11.5 percent in November 2005 when the prime rate was 7 percent. In contrast, a business owner not able to obtain credit elsewhere would have received a 4 percent rate under the Disaster Loan Program. SBA only guaranteed 222 GO Loans totaling $19 million through May 2006. The higher interest rates lenders could charge under the GO Loan Program made these loans less attractive than SBA disaster loans and likely contributed to the small number of loans made under the program. In December 2005, SBA implemented a pilot program to expedite the processing of disaster loan applications. Under this program, DCMS made automatic approval recommendations for applicants with credit scores indicating that they were less likely to default on a loan, and loan officers did not have to conduct the lengthy repayment analysis for these applications. According to SBA, loan officers processed 8 to 10 home loan applications per day, on average, under the pilot program—about twice as many applications as under the normal process. However, loan officers did not review DCMS-generated approval recommendations until after the loss verification stage under the program. In addition, when SBA implemented the pilot program, the agency faced a significant backlog of 115,000 applications in the loss verification stage, and these applications had been in the queue for 39 days on average. As a result, SBA’s data showed that the agency actually took longer to process expedited approvals compared with SBA’s average processing time frames for all approvals. Specifically, SBA processed expedited approvals in about 104 days on average between December 2005 and April 2006, compared with 94 days for all approvals processed through the end of April 2006. If SBA had implemented this initiative sooner when the backlog in loss verification was not so large or if the agency had implemented an expedited loss verification process for these applications, the pilot program may have been more effective in reducing the amount of time disaster victims waited for a decision on their application. Table 4 describes other SBA actions or initiatives that did not significantly reduce the backlog of loan applications because they were either not implemented in a timely manner or did not fully incorporate the use of DCMS to process applications. DCMS provided SBA with opportunities to help the agency move toward a paperless processing environment by automating many of the functions the agency previously performed manually, such as obtaining FEMA referral data and credit bureau reports as well as completing and submitting loss verification reports from remote locations. SBA officials also told us that DCMS improved its ability to process disaster loans, and the agency would have experienced even greater processing delays using its previous system and loan process. However, we found other potential opportunities during our review that might help SBA to process loans more efficiently and move closer to its goal of processing loan applications within 21 days when faced with disasters. For example, SBA may be able to increase the efficiency of its application entry process by implementing a secure Internet-based application feature for home loan applicants. Currently, SBA accepts only paper loan application documents from disaster victims, and data-entry staff manually input application data into DCMS. According to the Direct Loan Systems Requirements issued by the Joint Financial Management Improvement Program, federal agency loan systems “should provide for an electronic application process using various media, such as a secure Internet application.” SBA could reduce the number of paper application documents it receives, the number of documents it subsequently scans into DCMS, and the resources and time required to input application data by capturing much of this information electronically. According to SBA officials, DCMS has the capability to interface with a secure Internet-based application feature where this data could be captured electronically. However, SBA did not attempt to add this functionality after the Gulf Coast hurricanes because of the instability it initially experienced with DCMS. SBA officials added that the agency concentrated its efforts on expanding the capacity of DCMS and would examine adding this functionality to the system in the future. SBA officials told us that, prior to the Gulf Coast hurricanes, the agency initiated a business process reengineering effort within ODA to reevaluate the disaster loan process. As part of this effort, ODA planned to (1) determine what type financial analysis would be performed for applicants with credit scores indicating a high degree of default risk, (2) design a streamlined loan application (both paper and electronic), and (3) identify policy and legislative changes required to implement the new process. However, ODA postponed this effort after the Gulf Coast hurricanes because of the resources needed to meet the demands of the disaster loan program. Business process reengineering can help organizations identify, analyze, and redesign their core business processes with the aim of achieving dramatic improvements in critical performance measures such as cost, quality, service, and speed. According to SBA officials, it has plans to resume this effort in 2006 in order to identify ways to more efficiently process disaster loan applications and to maximize the benefits of DCMS. The Gulf Coast hurricanes presented SBA with unprecedented challenges that, in combination, led to significant backlogs and delays in processing disaster loan applications. For example, SBA faced the largest volume of disaster loan applications in its history, as the United States experienced three extremely destructive natural disasters over a period of about 2 months. This large volume was due in part to the large number of applicants automatically referred to SBA by FEMA’s Internet site, many of whom ultimately did not qualify for disaster loans. We also agree that SBA should improve its screening process within DCMS when processing “$0 income” referrals and continue to work with FEMA to reduce unnecessary online disaster referrals, as recommended by SBA’s Office of Inspector General. In addition, various system and processing-related issues also challenged SBA, such as a new disaster loan system that was not designed to effectively respond to a disaster of this magnitude and that was unable to operate at the planned maximum capacity. Moreover, SBA based the maximum number of concurrent users for DCMS solely on its historical experience rather than considering information available from catastrophe risk modeling firms and disaster simulations, such as the likelihood and severity of damages from potential catastrophes to help predict the volume of applications that it might expect from such events. While SBA has plans to greatly expand its capacity of concurrent users for DCMS and should be more capable of processing larger volumes of loan applications once it achieves this increased capacity, it is not clear how the agency determined the new maximum number of concurrent users and whether this new capacity will be appropriate to handle future large scale disasters like the Gulf Coast hurricanes. If SBA had considered information available from catastrophe risk modeling firms and disaster simulations to help predict the volume of loan applications it could expect to receive, SBA could have made better informed decisions and might have acquired additional capacity that could have enabled SBA to reduce the backlog of applications in a more timely manner. Such an analysis would also better position SBA to determine its loan processing capacity for future disasters. SBA’s limited planning was further exacerbated by the lack of complete stress testing and the ineffective technical support provided by the hosting contractor. If SBA had appropriately stress tested the system before implementation, it might have discovered before the Gulf Coast hurricanes struck that it had received the incorrect computer hardware. Going forward, SBA would benefit from improving its process for verifying that the equipment provided by contractors meets all required specifications. While some of SBA’s initiatives improved its response to disaster victims, other efforts did not help the agency significantly reduce the large backlog of applications because they were either not implemented in a timely manner, not attractive to the applicant, or did not fully incorporate the use of DCMS to process applications. If some of these initiatives had been implemented soon after the Gulf Coast hurricanes struck, they might have enhanced SBA’s ability to process a large volume of loan applications in a timely manner. In addition, DCMS has the capability to interface with an Internet-based application feature that could reduce the resources and time required to input application data for home loan applicants by capturing much of this information electronically. As the 2006 Atlantic hurricane season has already begun, SBA would benefit by expediting its plans to resume its business processing reengineering efforts to analyze ways to more efficiently process loan applications, including an evaluation of implementing an Internet-based application feature. In order to provide more timely disaster assistance in the future, we recommend that the Administrator of SBA direct the Office of Disaster Assistance to take the following four actions: reassess DCMS’s maximum user capacity and related loan processing resource needs based on such things as lessons learned from the Gulf Coast hurricanes, a review of information available from catastrophe risk modeling firms and disaster simulations, and related cost considerations; conduct complete stress testing to ensure that DCMS can function at planned for maximum user capacity levels; improve management controls over assessing contractor performance through inspections of all equipment purchased or leased to support DCMS; and expedite plans to resume business process reengineering efforts to analyze the disaster loan process and identify ways to more efficiently process loan applications including an evaluation of the feasibility of implementing a secure Internet-based application feature for home loan applicants. We provided SBA with a draft of this report for review and comment. The Associate Administrator for Disaster Assistance provided written comments that are presented in appendix III. In these comments, SBA provided additional context regarding the magnitude of the disasters and the impact on the Disaster Loan Program. SBA stated that it generally agreed with our recommendations and intended to improve the delivery of the Disaster Loan Program for events of all sizes. However, SBA disagreed with the following four findings and conclusions in our draft. First, SBA disagreed with our conclusions that it performed limited planning and that it would have been better prepared to reduce the backlog of applications through the use of catastrophe risk models rather than relying primarily on the Northridge earthquake to establish its capacity needs. As we noted in our report, SBA planned the maximum user capacity for DCMS based on the volume of applications it received from victims of the Northridge earthquake—the single largest disaster SBA had previously faced—and did not anticipate the likelihood of a single disaster or series of disasters of the magnitude of the Gulf Coast hurricanes. We continue to believe that catastrophe risk modeling firms and disaster simulations provide critical information, such as the likelihood and severity of damages from potential catastrophes. Combined with other elements of a comprehensive planning process, such information would have been useful in planning the maximum user capacity of DCMS. If SBA had considered this information, the agency may have concluded that the likelihood of large scale disasters exceeding the magnitude of the Northridge earthquake was significant enough to expand its maximum concurrent user requirement. This additional capacity would have better prepared SBA to reduce the backlog of loan applications more rapidly because additional staff in all phases of the loan application process would have been able to access DCMS. Second, SBA stated in its comments that our draft report does not include an analysis of the difference between using DCMS and ALCS—SBA’s previous system. SBA also highlighted in its comment letter many of the benefits offered by DCMS. While it was not in the scope of our work to conduct a comparative analysis of ALCS and DCMS, our report recognized some of the benefits realized by adopting DCMS. For example, we noted that ALCS tracked the movement of paper loan application files from one stage of the loan process to another and required the movement and storage of large volumes of paper. We also noted that DCMS helped SBA move toward a paperless processing environment by automating many of the functions staff members had performed manually using ALCS such as obtaining FEMA referral data and credit bureau reports, as well as completing and submitting loss verification reports from remote locations. Third, SBA stated that the draft report does not indicate that the specific computer components, which the hosting contractor incorrectly provided, were processing chips that were embedded subcomponents of the computer servers, which SBA personnel could only detect by opening and dismantling the computer hardware. We agree that the hardware was embedded in the computer servers and could have been verified by physical inspection. SBA conducted such an inspection in September 2005. However, alternative ways of verifying the computer hardware were possible. For example, SBA staff could have used its system utilities to view details of the hardware and operating system after the processors were installed and may have detected the incorrect processors and taken corrective actions in a more timely manner. Finally, SBA took issue with our finding that it actually took longer to process expedited approvals under a pilot program, compared with its average processing time frames for all approvals. SBA stated that our interpretation of the data was misleading because it did not adjust for the length of time an application was in the loss verification inventory before being assigned to the loan department for processing. We disagree that our interpretation of the data was misleading because all physical disaster loan applications had to go through loss verification before a decision was made, regardless of whether the application was part of the expedited pilot program. While the expedited approval pilot program may have reduced the amount of time for loan officers to complete the underwriting decision, our intent, consistent with our overall objective, was to show the total time disaster victims waited for SBA to make a decision on their application. This includes the time an application is in other stages of the disaster loan process, such as application entry and loss verification. As we noted in our report, SBA implemented the pilot program when the agency faced a significant backlog of 115,000 applications in the loss verification stage, and these applications had been in the queue for 39 days on average. SBA’s data showed that the agency actually took longer to process expedited approvals, about 104 days on average, compared with 94 days on average for all approvals. We continue to believe that it is appropriate to consider the total processing time frames when comparing applications approved under the pilot program with all approved applications. SBA also provided other technical corrections and comments, which have been incorporated in this report, where appropriate. We are sending copies of this report to appropriate congressional committees, the Administrator of the Small Business Administration, and other interested parties and will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. In this report, we evaluate: (1) what affected the Small Business Administration’s (SBA) ability to provide timely disaster assistance and (2) the actions SBA took after the disasters to improve its response to disaster victims. This report focuses primarily on the Disaster Credit Management System (DCMS) and the disaster loan process. We visited the Gulf Coast region to observe conditions and meet with federal, state, and local officials and victims of the disasters. We also interviewed officials from the Office of Disaster Assistance at SBA’s headquarters and officials from the Processing and Disbursement Center in Texas, Field Operations Centers East and West in Georgia and California, Customer Service Center in New York, DCMS Operations Center in Virginia, and Georgia District Office. We reviewed SBA’s standard operating procedures for approving, declining, and withdrawing disaster loans. In addition, we reviewed documents related to the agency’s response to the Gulf Coast hurricanes, congressional testimony, and other program documentation. We reviewed documents related to SBA’s acquisition and implementation of DCMS. In addition, we discussed the acquisition process with officials from SBA’s DCMS Operations Center, which provides technical and program management support for the system. We also reviewed SBA’s standards for system development and compared the acquisition process for DCMS with industry standards for effective information technology acquisition. Further, we interviewed officials from SBA’s Office of Inspector General and reviewed their reports related to the implementation of DCMS and SBA’s Disaster Loan Program. We did not conduct a comparative analysis of DCMS and ALCS—SBA’s previous system—as part of our work. To obtain the perspectives of system users, we interviewed loan processing staff at various SBA locations. We also obtained SBA’s total costs for planning, acquiring, and implementing DCMS through April 2006. However, we did not audit the reported costs and thus cannot attest to their accuracy or completeness. We obtained documents related to the performance of DCMS, including system status reports, troubleshooting reports, and system change requests. We reviewed these documents to assess the extent to which system-related problems detailed in the documents affected SBA’s ability to provide timely disaster assistance. In addition, we obtained various reports on SBA’s disaster lending activity for victims of Hurricanes Katrina, Rita, and Wilma. We used these reports to calculate descriptive statistics on the number of applications mailed and received, the number and amount of approved loans, the backlog of applications in various stages, and other characteristics for applications processed through May 27, 2006. For comparative purposes, we also obtained summary statistical reports related to SBA’s disaster lending for past significant disasters. We also obtained data extracts from DCMS of disaster loan applications SBA received from victims of Hurricanes Katrina, Rita, and Wilma for various dates. We used the extracts to calculate average time frames for various stages of the disaster loan process. In assessing the reliability of SBA’s data, we reviewed documents such as the DCMS Privacy Act Assessment and met with appropriate SBA officials. To increase our confidence in the reliability of SBA’s data, we compared information from selected hard copy application files with the information recorded in DCMS. We also performed various tests of the information in the data extracts we obtained to ensure the completeness of the data. We concluded that SBA’s data were sufficiently reliable for the purposes of our report. To evaluate actions SBA took after the disasters to improve its response to disaster victims, we reviewed documents related to changes SBA made to DCMS and changes SBA planned to make to the system. We discussed these changes with officials from SBA’s DCMS Operations Center. In addition, we obtained and reviewed documents related to changes SBA made to the disaster loan process and other initiatives intended to improve SBA’s response to disaster victims. We discussed these changes and initiatives with the appropriate SBA officials and obtained data on the impact of these efforts where available. We reviewed documents related to the Federal Emergency Management Agency’s (FEMA) Individuals and Households Program, which makes assistance available to victims of major disasters. We also contacted FEMA to obtain additional information regarding the agency’s process for referring applicants to SBA’s Disaster Loan Program. We performed our work in Atlanta, Ga.; Buffalo, N.Y.; Fort Worth, Tex.; New Orleans and Metarie, La.; Sacramento, Calif.; Bay St. Louis, Biloxi, Gulfport, and Waveland, Miss.; Herndon, Va.; and Washington, D.C. We conducted our work between November 2005 and July 2006 in accordance with generally accepted government auditing standards. Since the early 1990s, SBA utilized its Automated Loan Control System to track the movement of paper application files from each stage of the process until it made a decision on the application, disbursed funds for approved applications, and transferred the application file to servicing. SBA also obtained data manually from external data sources, including FEMA, the Internal Revenue Service (IRS), and the credit reporting agencies. In December 1998, after using a significant number of resources in response to victims of Hurricane Georges, which struck Puerto Rico that previous September, SBA began an effort to modernize its manual and paper-based disaster loan process. SBA intended for its new disaster loan system to support: (1) a “paperless” electronic loan application and loan process, (2) loan processing from any location where the system is implemented, (3) multiple interaction methods between loan applicants and the Office of Disaster Assistance (e.g., by Internet or telephone), and (4) access to external data sources. The modernization effort entailed the following actions: documenting SBA’s current loan process and proposed future loan performing requirements analysis, conducting a commercial-off-the- shelf (COTS) market survey, and developing a business case; and acquiring, customizing, and implementing the system. In March 1999, SBA completed a business process reengineering study to document the current process and proposed future process. In August 2000, SBA completed the initial development of the new system requirements. Subsequently, SBA contracted for a COTS survey of products meeting its requirements and leveraging its other information technology resources. The survey identified two products that met a significant number of SBA’s requirements, with some customization and integration of additional products needed to meet all requirements. After the contractor completed the survey, SBA’s information technology investment review board required the agency to complete a business case analysis for the proposed disaster loan system. SBA’s analysis involved researching the existing requirements, evaluating potential alternatives, and providing a recommendation. In March 2001, SBA completed the analysis, which evaluated three alternatives: (1) develop a custom solution, (2) acquire a COTS product, or (3) stay with the current environment. SBA determined that the COTS product represented the best solution after considering the costs and time frames associated with each alternative. In June 2002, a SBA contractor developed more specific requirements for the project because a considerable amount of time had passed since the first survey and because of the uniqueness of certain aspects of the disaster loan process, such as loss verification and a check for duplication of benefits. Later that year, SBA contracted for a separate COTS survey that utilized the Carnegie Mellon University’s Software Engineering Institute process for evaluating COTS products. SBA evaluated products from 10 different vendors, and after narrowing the selection to two products, received vendor demonstrations in January 2003. In March 2003, the contractor recommended a COTS product for SBA to use as the foundation for the Disaster Credit Management System (DCMS). In September 2003, SBA completed an analysis of the DCMS design to identify potential gaps between the recommended COTS product and the requirements for the system. For example, SBA recognized that the COTS product did not have the functionality to perform loss verification activities; therefore, SBA decided to implement a custom loss verification application and link the application to the core system. This ensured that loss verification data would automatically synchronize with DCMS. In 2003, SBA also began to test various aspects of its new system. In November 2003, the agency began testing the core application, interfaces, and additional components (loss verification, scanning, etc.). User validation readiness testing was conducted between December 2003 and March 2004. In October 2004, SBA contracted for an Independent Verification and Validation (IV&V) of an initial release of DCMS. An IV&V can help provide reasonable assurance that a system satisfies its intended use and user needs, and its use is recognized as an industry best practice. The IV&V conducted for DCMS found that the system was supported by strong requirements, test plans, test cases, and other supporting documentation. In addition, the IV&V found that DCMS was developed with a high level of user involvement. However, the IV&V did not evaluate performance testing, including tests to help ensure that the system could function at its maximum user capacity, because these tests were not completed until December 2004 after the agency had begun implementation. This performance testing was conducted with only up to 120 concurrent users due to problems with the hardware associated with the testing environment. If the testing environment had functioned as planned, it was estimated the system could accommodate approximately 600 concurrent users. SBA used a phased approach for implementing DCMS. In November 2004, SBA first implemented DCMS in its Niagara Falls, New York, Disaster Area Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas, and Sacramento, California DAO. SBA also began using DCMS to process applications for all new disaster declarations. As figure 6 illustrates, SBA’s process of moving from its former manual, paper-based disaster loan process to a more automated process using DCMS took about 6 years. SBA’s costs for planning, acquiring, implementing, and operating DCMS totaled about $32 million through April 2006. In addition to the individual named above, Daniel Blair, Assistant Director; Barbara Oliver, Assistant Director; Bernice Benta; Tania Calhoun; Marshall Hamlett; Marc Molino; David Pittman; Jennifer Popovic; Rhonda Rose; and Eric Trout made key contributions to this report.

Summary: Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused more than $118 billion in estimated property damages across the Gulf Coast region in 2005. The Small Business Administration (SBA) helps individuals and businesses recover from disasters through its Disaster Loan Program. GAO initiated work to determine how well SBA provided victims of the Gulf Coast hurricanes with timely assistance. This report, the first of two, focuses primarily on the Disaster Credit Management System (DCMS) and disaster loan process. Here, GAO evaluates (1) what affected SBA's ability to provide timely disaster assistance and (2) actions SBA took after the disasters to improve its response to disaster victims. In conducting this study, GAO analyzed data on loan applications and assessed key aspects of SBA's acquisition and implementation of DCMS. Although DCMS provided SBA with a number of benefits, several factors affected SBA's ability to provide timely disaster assistance to victims of the Gulf Coast hurricanes. First, the large volume of applications SBA processed greatly exceeded any previous disaster, including the 1994 Northridge earthquake--the largest single disaster SBA previously faced. Second, SBA primarily used this earthquake as the basis for planning the maximum user capacity for DCMS and did not consider information available from catastrophe risk modeling firms and disaster simulations, such as the likelihood and severity of damages from potential catastrophes, to help predict the expected application volume from such events. SBA's limited planning contributed to insufficient DCMS user capacity, which restricted the number of staff that could access the system and process the large volume of applications in a timely manner. SBA also did not receive the correct computer hardware from its contractor, and the agency did not completely stress test DCMS before implementation, which contributed to the system instability, outages, and slow response times initially experienced by SBA staff. As a result of these and other factors, SBA faced significant delays and backlogs in processing loan applications, as depicted in the figure below. This backlog peaked at more than 204,000 applications 4 months after Hurricane Katrina. As of May 27, 2006, SBA processed applications, on average, in about 74 days compared with its goal of within 21 days. Some of the actions SBA took after the Gulf Coast hurricanes helped to improve its response to disaster victims. For example, SBA addressed system-related issues by increasing the number of users that could access DCMS, and it plans to further increase the system's maximum user capacity. SBA implemented other initiatives that had limited success. For example, SBA made only a few loan guarantees under its Gulf Opportunity Pilot Loan Program for small businesses in communities affected by the disasters. SBA would benefit by expediting its planned business process reengineering efforts to analyze ways to more efficiently process loan applications, such as implementing a secure Internet-based application feature for home loan applicants.