SBA’s organizational structure comprises headquarters and both regional and district field offices. At the headquarters level, SBA is divided into several key functional areas that manage and set policy for the agency’s programs. As shown in figure 1, 17 headquarters offices report to the Office of the Administrator. In fiscal year 2014, the agency employed 2,137 regular funded full-time equivalent (FTE) staff (excluding staff in the Office of Advocacy, the Office of Inspector General, and the Office of Disaster Assistance) to carry out its mission of supporting small businesses. Four program offices manage the agency’s programs that provide capital, contracting, counseling, and disaster assistance services to small businesses: The Office of Capital Access administers, among other things, the 7(a) loan program. The 7(a) program is SBA’s largest loan program and guarantees a portion of loans for establishing new businesses, operating or expanding existing businesses, or acquiring businesses. The Office of Capital Access also administers the development company (504) loan program, which provides businesses with long- term, fixed-rate financing for major assets such as real estate and equipment. In fiscal year 2014, the office had 569 FTEs. The Office of Government Contracting and Business Development promotes small business participation in federal contracting through a variety of programs such as the 8(a) business development, Historically Underutilized Business Zone (HUBZone), and women- owned small business (WOSB) programs. In fiscal year 2014, the office had 180 FTEs. The Office of Entrepreneurial Development, which had 50 FTEs in fiscal year 2014, oversees a nationwide network of public and private “resource partners” that offer small business counseling and technical assistance. These include small business development centers, women’s business centers, and SCORE chapters. The Office of Disaster Assistance, which had 991 FTEs in fiscal year 2014, makes loans to businesses and families to rebuild and recover after a disaster. SBA provides its services through a network of 10 regional offices and 68 district offices that are led by the Office of Field Operations. In fiscal year 2014, there were 802 FTEs in the regional and district offices. Regional offices, whose administrators are political appointees, oversee the district offices and promote the President’s and SBA Administrator’s messages throughout the region. Considered by officials as SBA’s “boots on the ground,” district offices serve as the point of delivery for most SBA programs and services. Some district office staff work directly with SBA clients, including business opportunity, lender relations, and economic development specialists. These employees provide counseling and training services that aid in the formation, management, financing, or operation of a small business enterprise. They also provide information on and promote SBA products to lenders, the small business community, and groups such as chambers of commerce and trade associations. Additionally, district offices are charged with completing statutorily mandated reviews, such as program participant reviews that ensure participants continue to qualify and are meeting program requirements. SBA’s field structure has been revised over the years. In response to budget reductions, SBA streamlined its field structure during the 1990s by downsizing regional and district offices and shifting oversight responsibilities to headquarters. Since the early 2000s, SBA has further restructured and centralized some key agency functions. For example, from 2003 through 2006, SBA completed the centralization of its 7(a) loan processing, servicing, and liquidation functions from 68 district offices to 1 loan processing center, 2 commercial loan servicing centers, and 1 loan liquidation and guarantee purchase center. Since fiscal year 2013, SBA’s annual budget appropriation has declined. For fiscal year 2014, SBA’s appropriation was $928,975,000, approximately $116 million less than in fiscal year 2013 (see fig. 2). SBA’s fiscal year 2016 congressional budget request of $860,130,000 was approximately $27 million less than the amount enacted for fiscal year 2015. (See app. II for more information on recent trends in SBA’s budget obligations, outlays, and authority.) SBA’s spending on IT fluctuated from 2005 through 2008, as shown in figure 3. The sharp rise in spending in 2006 is attributed to increased amounts for IT investments for disaster credit management, loan and lender monitoring, and IT infrastructure. Since fiscal year 2008, the agency’s yearly IT spending has remained fairly stable at about $100 million. For fiscal year 2015, SBA estimates that it will spend approximately $109 million for IT. Of that amount, $83 million (77 percent) is to be spent on mission-critical systems to, among other things, support agency financial operations and the disaster loan assistance program. In addition, it plans to spend $21 million (19 percent) on developing, modernizing, and enhancing IT investments, while the rest is to be spent on operations and maintenance of existing systems. Government-wide, federal agencies spend more than $80 billion annually to meet their increasing demands for IT. In a 2014 report, we found that duplicative, wasteful, and low-value investments had proliferated over the years, highlighting the need for agencies to avoid such investments whenever possible. OMB has made a similar observation in its guidance. To help address their management of federal IT dollars, OMB has implemented a series of initiatives for federal agencies to use to, among other things, consolidate the growing number of federal data centers, shift to increased use of cloud computing, and promote the use of shared services. In a June 2014 report, we found that OMB’s IT reform initiatives could help to improve the efficiency and effectiveness of federal agencies and save billions of dollars. In the last 15 years, we and the SBA OIG have identified management challenges at SBA, many of which are related to specific programs. In accordance with the Reports Consolidation Act of 2000, the SBA OIG issues annual reports in which it identifies SBA’s most serious management challenges—programs or activities that it has determined pose significant risks. These annual reports represent the SBA OIG’s current assessment of SBA programs and activities that pose significant risks, including those that are particularly vulnerable to fraud, waste, error, mismanagement, or inefficiencies. The OIG’s most recent report for fiscal year 2015 identified 11 such challenges, 7 of which are issues that have persisted for 10 years or longer. These 7 long-standing challenge areas are loan guarantee purchases, the 8(a) business development program, IT security, loan agent fraud, human capital, lender oversight, and small business contracting (see fig. 4). The other challenge areas are: improper payments, the Loan Management and Accounting System, and acquisition management. Our past reports have identified some of the same long-standing management challenges that SBA needs to address, particularly in the areas of contracting, lender oversight, and the Loan Management and Accounting System (and other IT management issues). We and the SBA OIG have also identified problems in SBA’s disaster loan processing that, while not long-standing, also pose risks to the agency. To address SBA’s challenges, we and the SBA OIG have made various recommendations. While SBA has made some progress in addressing these challenge areas, many of our recommendations remain unimplemented. As of July 2015, 53 percent of the recommendations (32 of 60) we made to SBA across all subject areas in fiscal years 2010 through 2013 had not been fully addressed. See appendix III for a list of all 69 recommendations we have made to SBA since fiscal year 2000 that remain open. We maintain that these recommendations continue to have merit and should be fully implemented. Loan guarantee purchases. Loan guarantee purchases occur when lenders request that SBA purchase the guarantee following loan liquidation or delinquency. The SBA OIG has cited issues related to loan guarantee purchases as a serious management challenge since fiscal year 2000. For example, in its fiscal year 2011 management challenges report, the OIG stated that its audits of defaulted loans and SBA’s guarantee purchase and liquidation processes showed that reviews performed by the agency’s loan centers did not consistently detect lenders’ failures to administer loans in full compliance with SBA requirements and prudent lending practices, resulting in improper payments. In its fiscal year 2012 management challenges report, the OIG stated that in the last decade, the agency had made significant progress in improving deficiencies identified in SBA loan liquidation and guarantee purchase processes but that a significant deficiency continued to exist in the area of quality assurance. The report noted that while SBA had developed a quality assurance program, additional work remained before the agency could demonstrate that all elements of the program had been completed and followed. In its fiscal year 2015 report on management challenges, the SBA OIG found that SBA had made significant progress in developing and implementing a quality control program for all of its loan centers to verify and document compliance with the loan process, from origination to close- out, and to identify where material deficiencies might exist so that remedial action could be taken. Further, the OIG stated that SBA had (1) developed and documented quality program manuals and review checklists for each center; (2) assessed center functions by risk to prioritize required quality control reviews; (3) refined feedback, training, and reporting processes; and (4) developed new systems to improve the tracking of quality control deficiencies and corrective actions. However, the SBA OIG noted that SBA would need to continue monitoring the quality control program during fiscal year 2015 to verify that (1) required quality control reviews were being completed, (2) quality control activities provided adequate coverage over loan center operations, and (3) quality control reviews were effective at identifying and correcting material deficiencies. 8(a) business development program. The 8(a) business development program is a business assistance program for small disadvantaged businesses. The SBA OIG has identified issues related to this program as a serious management challenge since fiscal year 2000. For example, in its fiscal year 2003 report on management challenges (and in every report since), the OIG noted that SBA needed to modify the 8(a) business development program so more firms received business development assistance, standards for determining economic disadvantage were justifiable, and SBA ensured that firms followed 8(a) regulations when completing contracts. In a 2003 report on management challenges, we found related problems with the 8(a) program. For instance, SBA had begun to implement short- and long-term strategies to address problems in the 8(a) program, but data suggested that only a few firms continued to receive the bulk of 8(a) funding and that the volume of federal procurement funding awarded to 8(a) firms had not increased. Further, in a March 2010 report on the 8(a) program, we found that although SBA had implemented new procedures for the program, there were inconsistencies and weaknesses in internal controls that increased the potential for abuse by ineligible firms. Specifically, we found that monitoring of district staff needed to be improved and district staff needed better guidance, training, and criteria to follow the required annual review procedures for determining continued eligibility. We made six recommendations that individually and collectively could improve procedures used in assessing and monitoring the continuing eligibility of firms to participate in and benefit from the 8(a) program. SBA agreed with the six recommendations when the report was issued. As of July 2015, SBA had taken actions responsive to four of the recommendations. Specifically, it had assessed the workload of business development specialists, updated its 8(a) regulations to include more specificity on the criteria for the continuing eligibility reviews, developed a centralized process to collect and maintain data on 8(a) firms participating in the Mentor- Protégé Program, and implemented a standard process for documenting and analyzing complaint data. The two remaining recommendations yet to be fully implemented as of July 2015 focus on (1) procedures to ensure that appropriate actions are taken for firms subject to early graduation from the program and (2) taking actions against firms that fail to submit required documentation. In its fiscal year 2015 report on management challenges, the SBA OIG found that SBA had made progress towards addressing issues that hindered its ability to deliver an effective 8(a) business development program. For example, it found that SBA had expanded its ability to provide assistance to program participants through its resource partners. In addition, it noted that SBA had taken steps to ensure that business opportunity specialists assessed program participants’ business development needs during site visits. The OIG also found that SBA had revised its regulations, effective March 2011, to ensure that companies deemed “business successes” graduated from the program. However, for the second consecutive year the SBA OIG noted that SBA had not finished updating the SOP for the 8(a) business development program to reflect the March 2011 regulatory changes. In addition, the OIG continued to maintain that SBA’s standards for determining economic disadvantage were not justified or objective based on the absence of economic analysis. According to a senior SBA official, improving the 8(a) program is a priority for the new Administrator. For example, he stated that the agency was considering how to expand SBA One—an initiative designed to create a single application for most SBA loans and allow borrowers and lenders to populate forms from secure information storage—to include the 8(a) program. He noted that the goal would be to make it easier and less costly for small businesses to participate in the program. In addition, he stated that the agency was considering focusing its oversight on those 8(a) businesses that receive federal contracts. IT security. The SBA OIG has identified weaknesses in information systems security controls as a serious management challenge since fiscal year 2000. In its fiscal year 2015 management challenges report, it noted that SBA’s computer security program operates in a dynamic and highly decentralized environment and requires management attention and resources as weaknesses are identified. The OIG stated that SBA had shown progress in establishing an entity-wide incident management and response program and had improved network port security access controls, but found that SBA still needed to address long-standing security weaknesses identified in 35 open IT audit recommendations. In addition, the SBA OIG noted that SBA’s Office of the Chief Information Officer, in conjunction with SBA’s program offices, needed to implement tools and capabilities to provide effective oversight and continuously monitor computer security controls. According to a senior SBA official, the agency has recently placed an even greater emphasis on improving its IT security at the direction of the White House. He stated that one focus was increasing the use of personal identification verification cards, which are smart cards that govern access to federally controlled facilities and information systems. Loan agent fraud. A prospective borrower or a lender sometimes pays a loan agent (e.g., a loan broker or packager) to prepare documentation for an SBA loan application or find a lender. The SBA OIG has identified loan agent fraud as a serious management challenge since fiscal year 2000. Its fiscal year 2015 management challenges report stated that for years its investigations had revealed a pattern of fraud by loan packagers and other for-fee agents in the 7(a) loan program involving hundreds of millions of dollars. The report noted that SBA’s oversight of loan agents had been limited, putting taxpayer dollars at risk. It added that SBA could reduce this risk by developing a database or equivalent means to track loan agent activity, updating regulations on loan agent enforcement, issuing new guidance for lenders on not doing business with loan agents subject to enforcement actions, and implementing a loan agent registration system (including the issuance of a unique identifying number for each agent). Finally, the report noted that SBA had made substantial progress on tracking loan agency data, limited progress on updating its regulations and issuing new guidance to lenders, and had not yet started on its recent recommendation to implement a registration system. Human capital. The SBA OIG has included human capital as one of the most serious management challenges at SBA since fiscal year 2001, noting that SBA needs effective human capital strategies to carry out its mission successfully and become a high-performing organization. Problems that the SBA OIG cited in its management challenges reports over the years included the lack of a comprehensive human capital strategy that identified SBA’s current and future human capital needs, including workforce capacity and skill gaps; failure to clarify the role of or appropriately staff district offices when key program functions were transferred to service centers; and failure to adequately analyze priorities and allocate resources consistent with them. In our 2003 report on SBA’s management challenges, we also found that SBA needed to strengthen its human capital management. For example, we stated that SBA’s organizational structure had weaknesses that contributed to the challenges it faced in delivering services to the small business community. We discuss the status of SBA’s human capital management and additional challenges we identified as part of our current review later in this report. Lender oversight. SBA’s major loan programs (7(a) and 504) require effective lender oversight because the agency generally relies on the lenders that make 7(a) loans and certified development companies (CDC) that make 504 loans to process and service the loans and to ensure that borrowers meet the programs’ eligibility requirements. The SBA OIG has identified lender oversight as a serious management challenge for SBA since fiscal year 2001. We also identified SBA’s lender oversight as a challenge in our 2003 report on management challenges. More recently, we and the OIG found the following weaknesses in SBA’s lender oversight: In a July 2013 report, the SBA OIG found that SBA had not implemented procedures and policies to monitor risk across its loan portfolio and that SBA had not developed a process for ensuring that identified risks were addressed. The SBA OIG recommended that SBA implement a portfolio risk management system, use data from that system to support risk-based decisions in its loan programs, and implement additional controls to mitigate identified risks where necessary. SBA agreed with the recommendations. According to the SBA OIG, while SBA has implemented a portfolio risk-management program in accordance with its recommendations, it has not yet used data from the program to support risk-based decisions in loan programs or develop additional internal controls to manage identified risks. In a September 2013 report, we found that internal controls over lenders participating in the Patriot Express pilot program may not have provided the agency with reasonable assurance that loans were made only to eligible borrowers. For example, we found that SBA had not developed procedures for lenders to provide reasonable assurance that borrowers maintained their eligibility after the loans were disbursed. We recommended, among other things, that SBA enhance internal controls over borrower eligibility requirements. SBA subsequently decided to allow the program to expire in December 2013. In a March 2014 report, we found that although SBA had initiated actions to improve its reviews under the 504 loan program, its guidance for conducting risk-based reviews of the CDCs that make 504 loans did not require SBA staff to review supporting documentation on the number of jobs created or retained, a key requirement of the program. Among other things, we recommended that SBA require examiners to review such documentation. SBA generally agreed with our recommendation and subsequently revised its review procedures. Specifically, the agency incorporated steps in the worksheet examiners use to review loan files during risk-based reviews that require the review of documentation supporting the number of jobs created or retained. SBA has recently revised its procedures for conducting risk-based reviews of lenders and CDCs. A senior SBA official stated that he expected these changes to greatly improve SBA’s lender oversight. Specifically, SBA developed a new risk measurement methodology to assign risk ratings to both 7(a) lenders and CDCs and new lender risk-based review protocols for using these ratings to determine the scope of lender reviews. Those lenders with composite risk ratings above an established threshold are to undergo a targeted review of specific identified risks or a full review if risks are more pervasive. In its fiscal year 2015 report on management challenges, the SBA OIG noted that SBA also had improved its monitoring and verification of corrective actions by lenders by (1) developing corrective action assessment procedures, (2) finalizing a system to facilitate the corrective action process, and (3) populating the system with lender oversight results requiring corrective action. However, the OIG stated that in order for SBA to fully resolve this management challenge, the agency would need to demonstrate the effectiveness of the process for monitoring and verifying lenders’ implementation of corrective actions. Small business contracting. SBA’s contracting programs help eligible socially and economically disadvantaged small businesses obtain federal contracts on a set-aside basis. The agency has several such programs, including the HUBZone and WOSB contracting programs. The SBA OIG has identified small business contracting as a serious management challenge since fiscal year 2005. Its fiscal year 2015 management challenges report stated that SBA’s procurement flaws allowed large firms to obtain small business awards and agencies to count contracts performed by large firms toward their small business goals. In a September 2014 report, the OIG identified over $400 million in contract actions that were awarded to ineligible 8(a) and HUBZone firms, which may have contributed to the overstatement of small business goaling dollars reported to Congress in fiscal year 2013. In addition, we and the SBA OIG have identified internal control weaknesses in individual contracting programs, as the following examples illustrate. In a June 2008 report, we found that many firms were in the HUBZone program for more than 3 years without being recertified as required, resulting in potentially ineligible firms participating in the program. We recommended, among other things, that SBA eliminate the backlog using either SBA or contract staff and take the necessary steps to ensure that recertifications were completed in a more timely fashion in the future. SBA agreed, and in a 2009 testimony we found that the agency had eliminated the backlog of recertifications by hiring additional contract staff. However, we found in a February 2015 report that SBA did not replace the contract staff with FTE staff because, according to SBA, part of its funding authority was rescinded in 2013. As a result, we found that SBA once again had a backlog in recertifying firms. Therefore, we recommended that SBA assess the recertification process and implement additional controls, such as ensuring that sufficient staff were dedicated to the effort so that a significant backlog in recertifications did not recur. SBA agreed with the recommendation. According to SBA, it has since completed an evaluation of the current recertification procedures and plans to implement improved processes by September 30, 2015. In an October 2014 report on SBA’s WOSB program, we found that SBA performed minimal oversight of third-party certifiers and had not developed procedures to provide reasonable assurance that only eligible businesses obtained WOSB set-aside contracts. We recommended that SBA develop and implement comprehensive procedures to monitor and assess the performance of certifiers and enhance the examination of businesses that registered to participate in the WOSB program. SBA generally agreed with the recommendations and stated that the agency was in the process of implementing many of them. In June 2015, SBA officials told us that the agency was in the process of publishing a proposed rulemaking on how to proceed with certification in light of recent legislative changes to the program and planned to update its procedures for examining firms by the end of fiscal year 2015. In a May 2015 report, the SBA OIG found that federal agencies’ contracting officers awarded 15 of 34 set-aside awards without meeting the WOSB program’s set-aside requirements. These firms received approximately $7.1 million of fiscal year 2014 set- aside awards that may have been improper. It also found that of the 34 awards reviewed, only 25 had documentation of program eligibility in the WOSB program repository. Of those, 13 did not provide all of the required documentation, and 12 did not provide sufficient documentation to prove that the firm was controlled by women. According to a senior SBA official, SBA plans to improve small business contracting by extending SBA One to the 8(a) and HUBZone programs and creating a more dynamic small business search engine so that agencies can more readily identify small businesses that are eligible for contracts. Improper payments. The Improper Payments Information Act of 2002 requires agencies to review and identify those programs susceptible to significant improper payments, report on the amount and causes of improper payments, and develop plans for reducing improper payments. The SBA OIG has identified improper payments in SBA’s 7(a) and disaster loan programs as serious management challenges since fiscal year 2010 and fiscal year 2012, respectively. Its fiscal year 2015 report on management challenges stated that previous OIG audits had determined that reported improper payment rates for 7(a) loan approvals and purchases and disaster loans were significantly understated because SBA had not adequately reviewed loans, had used flawed sampling methodologies, and did not accurately project review findings. The OIG noted that SBA had taken actions to correct many of these deficiencies for the 7(a) program, including formalizing its improper payment sampling and its process for reviewing disputed cases and developing appropriate corrective action plans for the program. However, the OIG stated that SBA still needed to demonstrate that its process over disputed cases was ensuring adequate and timely resolution, that it was adhering to recovery time standards, and that corrective action plans for the 7(a) loan program were effective in reducing improper payments. The OIG also noted that SBA had implemented an improved corrective action plan for the disaster loan program that if properly implemented, should effectively reduce the improper payment rate in future years. In a February 2015 report on improper payments related to Disaster Relief Appropriations Act, 2013 funding, we found that SBA did not have policies and procedures for estimating improper payments for the Office of Entrepreneurial Development Grants program, one of its two programs that received funding under the act. We also found that SBA’s policies and procedures for its Disaster Assistance Loans program, the other program that received funding, did not cover many of the key requirements for estimating improper payments. For example, they did not define improper payments consistent with OMB guidance. SBA’s internal guidance defines an improper payment as a loan approval that does not meet the eligibility requirements in its SOP for the program. However, OMB guidance clarifies that improper payments can include certain payments to eligible recipients, such as payments that are for the incorrect amount and duplicate payments. Such types of improper payments were not captured or addressed in SBA’s policies and procedures. We recommended that SBA take eight actions to develop policies and procedures for the Office of Entrepreneurial Development Grants program and six actions to revise its Disaster Assistance Loans program policies and procedures for estimating improper payments. SBA did not explicitly concur with our recommendations but stated that it would address them by including a chapter on improper payments as it updates its SOP for internal controls. In June 2015, SBA officials told us that they planned to issue a policy notice containing additional guidance until the SOP could be updated. In a May 2015 report on SBA’s progress in complying with the Improper Payments Elimination and Recovery Act of 2010, the SBA OIG found that SBA continued to make progress in its efforts to prevent and reduce improper payments. For example, the reported improper payment rate for disaster assistance loan disbursements had decreased from 18.4 percent in fiscal year 2013 to 12 percent in fiscal year 2014, exceeding SBA’s goal of 15 percent. However, the OIG also found that SBA needed to make some improvements to effectively develop its improper payment controls and processes for Hurricane Sandy disaster relief grants and 7(a) loan guarantee purchases. Specifically, it found that the reported improper payment rate for Hurricane Sandy disaster relief grants of 3 percent might have been understated because reviewing personnel did not identify payment errors and related opportunities for correcting those errors. The OIG also noted that the reported improper payment rate of 1.33 percent for 7(a) loan guarantee purchases was slightly understated. The OIG made six recommendations to improve the effectiveness of improper payment controls over Hurricane Sandy technical assistance grants and Section 7(a) loan guarantee purchases. A senior SBA official noted that SBA’s improper payment rates were decreasing and that SBA One would help decrease them further because it included editing features designed to reduce the number of technical errors. Loan Management and Accounting System (and other aspects of IT management). SBA’s Loan Management and Accounting System (LMAS) is one in a series of attempts by SBA during the past several years to upgrade existing financial software and application modules and remove them from the mainframe environment. The SBA OIG has identified this project as a serious management challenge since fiscal year 2010 on the basis of reviews that we and it conducted, as the following examples show. In a 2012 report, we found inconsistencies in SBA’s application of IT management practices (including IT risk management) resulting in part from inadequate executive oversight of the LMAS modernization project. For example, we found that SBA had not fully prioritized risks related to one project or developed plans to mitigate them. Consequently, this modernization effort was severely delayed, and costs were well above initial estimates. We recommended that SBA ensure that appropriate IT management practices were applied to LMAS projects and that the executive bodies responsible for project oversight provide appropriate and ongoing reviews. SBA generally concurred with the recommendations and has taken some actions to address them as discussed below. In a series of reports in 2010, 2013, and 2014 on the LMAS project, the SBA OIG found that SBA did not follow federal regulations and internal guidance on IT acquisitions, leading to delays and weaknesses in project oversight. For example, in 2014 the OIG found that SBA did not identify a plan for full user acceptance testing according to the requirements outlined in its own SOPs for IT system development. The OIG also noted that SBA had made some progress but recommended that the agency adhere to internal guidelines in performing project oversight, approve and revise project baselines, and affirm the viability of project milestones. SBA agreed with the findings and recommendations and has taken actions to address them. SBA has recently completed its LMAS projects. In response to our 2012 recommendation, SBA told us that it had instituted changes to provide consistent project management, including appropriate oversight of requirements, the engagement of an independent contractor, and the establishment of risk management processes. As of March 2015, SBA reported that development activities for these projects had been successfully completed and all projects had entered the operations and maintenance phase. The SBA OIG has identified problems with other aspects of SBA’s IT management. In a February 2014 report, the OIG found that SBA had not followed federal regulations and guidance in the acquisition of the OneTrack system, a system that the Office of Government Contracting and Business Development planned to use to track 8(a) and HUBZone program participants. The SBA OIG reported that SBA had failed to perform market research or use a modular contracting strategy intended to reduce acquisition risks. As a result, SBA did not receive a system with the full capabilities originally designed. The OIG recommended, among other things, that SBA conduct a requirements analysis and cost assessment of the system and ensure that all appropriate provisions of internal guidance on IT system development were met prior to placing OneTrack into production. SBA concurred with the recommendations, but according to the SBA OIG, the agency did not deploy the OneTrack system. Instead, as noted previously, a senior SBA official told us that the agency planned to use SBA One for the 8(a) and HUBZone programs as well as its loan programs. He further noted that improving IT was a priority for the Administrator and that she was devoting additional resources to IT to meet deferred needs. Acquisition management. The SBA OIG has identified SBA’s acquisition management as a serious management challenge since fiscal year 2013. Although SBA had taken steps to improve its acquisition process—such as realigning its acquisition program within the organization, hiring new staff, and providing additional training to its acquisition personnel, the SBA OIG noted in its 2015 report on SBA’s management challenges that challenges remained. These challenges included (1) poorly defined requirements, (2) internal control deficiencies, (3) inadequate oversight of contractor performance, and (4) an incomplete acquisition SOP. We discuss SBA’s efforts to address these challenges and the results of a contractor review that found additional areas in need of improvement later in this report. Disaster loan processing. Both we and the OIG have reported that SBA needs to further strengthen planning for and controls over its disaster loan program to improve its ability to respond effectively to future disasters. SBA provides funding and assistance to individuals and businesses after disasters declared by either the President or SBA. SBA’s disaster loan program is the primary federal program for funding long-range recovery for nonfarm businesses that are victims of disasters and is the only form of SBA assistance not limited to small businesses. After the 2005 Gulf Coast hurricanes (Katrina, Rita, and Wilma), SBA faced an unprecedented demand for disaster loans, while also being confronted with a significant backlog of applications. As a result, hundreds of thousands of loans were not dispersed in a timely way. In June 2008, Congress enacted the Small Business Disaster Response and Loan Improvements Act of 2008 (2008 Act), which placed new requirements on SBA to help ensure that it is prepared to respond to catastrophic disasters. Since Hurricane Katrina, SBA has implemented reforms intended to improve disaster loan processing by increasing the capacity of the electronic loan processing platform and addressing requirements in the 2008 Act. However, continued attention on efforts to strengthen internal controls in the disaster loan program is needed, as the following examples illustrate. In a September 2014 report, we found that SBA did not adequately respond to the higher volume of physical business disaster loans and economic injury loans early in its response to Hurricane Sandy and as a result did not meet its timeliness goal for processing applications. We further found that the agency did not revise its disaster planning documents—the Disaster Preparedness and Recovery Plan and the Disaster Playbook—to reflect the effects that loan application volume and timing could have on staffing, resources, and forecasting models for future disasters. We concluded that without accounting for its recent experience in its planning documents, SBA may be unprepared for future disasters. We recommended that SBA revise its disaster planning documents. SBA generally agreed with the recommendation and provided us in June 2015 with an updated Disaster Playbook—one of its two key disaster planning documents—that includes explicit recognition of the effects that high volumes of loan applications early in the response period could have on staffing and loan processing. Also in our September 2014 report on disaster assistance, we found that SBA had not developed an implementation plan for addressing the 2008 Act’s requirements, as GAO recommended in 2009. This plan was to include, among other things, challenges the agency faces in implementing the 2008 Act’s requirements, including those to implement three new guaranteed disaster programs using private sector lenders. SBA had made a decision to focus attention first on implementing a pilot program for one of the requirements, the Immediate Disaster Assistance Program (IDAP). We found that SBA had not conducted a formal documented evaluation of lenders’ feedback or taken other actions needed to establish the basis for proposed changes to requirements for Congress to consider. In order to provide Congress with reliable information on challenges SBA has faced in implementing IDAP, we recommended that SBA (1) conduct a formal documented evaluation of lenders’ feedback that can inform SBA and Congress about statutory changes that may be necessary to encourage lenders’ participation in IDAP and (2) report to Congress on the challenges SBA has faced in implementing IDAP and on statutory changes that may be necessary to facilitate SBA’s implementation of the program. SBA generally agreed with the recommendations. While SBA has solicited some lender feedback, it has not adopted a plan for the steps the agency will take to implement IDAP (and by implication, the other two loan programs) or to reach a determination on whether IDAP or the other loan programs should be implemented. In a February 2015 report, the SBA OIG found that loan officers did not have guidance for performing the financial analysis to determine whether Hurricane Sandy business loan applicants had repayment ability. It noted that because there was no guidance, loan officers used inconsistent methodologies when evaluating Hurricane Sandy business loans for repayment ability. The OIG estimated that SBA approved at least 537 Hurricane Sandy disaster business loans, totaling at least $17.9 million, without sufficiently considering principals’ living expenses when determining repayment ability and that as a result, these loans were at a higher risk of default. As this discussion of SBA’s management challenges indicates, we and the SBA OIG have identified a number of internal control weaknesses that have contributed to programmatic challenges. We have made a number of related recommendations, many of which SBA has begun to address. SBA also has a process in place to help ensure that internal controls are in place for financial reporting, an effort that is overseen by a Senior Assessment Team. Among other things, this team is responsible for determining the scope of the assessment; monitoring the assessment to confirm that it is carried out in a thorough, effective, and timely manner; and analyzing the results of the assessment. SBA’s Office of Internal Controls within the Office of the Chief Financial Officer carries out each year’s assessment of internal controls over financial reporting. These efforts are guided by federal internal control standards, which we updated in September 2014. The new standards are effective beginning with fiscal year 2016. To prepare for the implementation of these new standards, the Office of Internal Controls presented the new guidelines at a Senior Assessment Team meeting in fiscal year 2013 and at fiscal year 2014 FMFIA training provided to senior managers. SBA officials said that the agency had also begun to update its SOP on internal control and plans additional revisions after OMB has updated its Circular A-123, which is expected to include guidance on implementing the new standards. SBA has not resolved many of these long-standing management challenges due to a lack of sustained priority attention over time. In a September 2008 report, we noted that frequent turnover of political leadership in the federal government, including at SBA, often made it difficult to sustain and inspire attention to needed changes. SBA has undergone turnover in its leadership positions (see fig. 5). Senior SBA leaders have not prioritized long-term organizational transformation in management challenge areas such as human capital and information technology. For example, since 2008 SBA has published three strategic plans, each signed by a different Administrator. The overview from the Administrator in SBA’s 2008-2013 strategic plan acknowledged some of the internal management challenges the agency faced and noted that the plan reflected SBA’s efforts to address them. However, the overviews from the Administrators in the two subsequent plans did not do so. Furthermore, in an April 2013 House committee hearing on SBA’s proposed fiscal year 2014 budget, the committee Chairman stated that SBA’s proposed budget focused on the agency’s priorities but ignored some long-standing management deficits. For example, the Chairman noted that SBA included initiatives in the budget to increase the availability of loans to small businesses, but reduced resources that would be devoted to LMAS. These examples raise questions about SBA’s sustained commitment to addressing management challenges that could keep it from effectively assisting small businesses. As well as examining long-standing management challenges, we reviewed SBA’s strategic plan for fiscal years 2014 to 2018 to determine whether it met federal requirements. We found that the plan met all the requirements for planning and all but one of the content requirements. It partly met the content requirement that it describe how program evaluations were used in developing the plan and that it include a schedule of evaluations planned for the next 4 years (see table 1). Strategic planning at federal agencies, including SBA, is subject to a variety of statutory requirements. First, in 1993 Congress passed GPRA, which established strategic planning, performance planning, and performance reporting as the components of a framework for agencies to communicate progress in achieving their missions. Next, GPRAMA made some important changes to existing requirements by placing a heightened emphasis on priority setting, cross-organizational collaboration to achieve shared goals, and the use and analysis of goals and measures to improve outcomes. GPRAMA enhanced agency-level planning and reporting requirements and required agencies to increase leadership involvement and accountability. OMB has published guidance for federal agencies on the implementation of GPRAMA, including guidance on strategic planning. The statutes and guidance describe the elements agencies must include in their strategic plans and the planning process they must follow when developing them. Planning process. SBA’s process for developing its fiscal years 2014-2018 strategic plan met all federal requirements, such as gathering input from stakeholders. For example, officials from SBA’s Office of Performance Management, which took the lead in developing the strategic plan, told us that they had met with the Associate Administrator and Deputy Associate Administrator from each program office as well as with senior staff to discuss the strategic objectives, the strategies the offices planned to use to achieve the objectives, and metrics for the objectives. This office also met with the Associate Administrator of the Office of Field Operations to obtain input and published a notice in the SBA Daily, a daily e-mail communication sent to all SBA employees, to inform SBA employees that the draft strategic plan had been posted on SBA’s website and to encourage them to review the plan and provide comments. Externally, SBA officials met with relevant authorizing and oversight committees early on in the planning process to discuss a high-level outline of the plan. According to SBA officials, these meetings allowed SBA to obtain some congressional input before it committed to specific strategic goals and objectives. SBA also consulted with OMB, which provided comments on SBA’s priority goals and the structure and framing of its strategic plan, requested input from numerous stakeholder groups, and sought public comments by posting a notice in the Federal Register and making a draft strategic plan publicly available on its website. Contents of strategic plan. As shown in table 1, SBA’s fiscal years 2014-2018 strategic plan met all but one of the content requirements, partly meeting the requirement on program evaluations. For example, the plan has a comprehensive mission statement that covers the agency’s major functions and includes outcome-oriented, long-term strategic goals and objectives that reflect the results SBA is trying to achieve. It also contains specific strategies to achieve the agency’s goals and objectives. In addition, SBA’s strategic plan includes a list of external parties that have evaluated SBA’s programs, describes SBA’s efforts to build its capacity to conduct more program evaluations, and discusses two evaluations it plans to conduct in 2015. But it does not describe how program evaluations were used in developing the strategic goals and objectives or include a schedule of evaluations planned for the full 4 years. According to OMB, program evaluation is among the most important analytical tools for agency decision making. It can help agency managers, such as those at SBA, determine how best to spend taxpayer dollars effectively and efficiently, identify appropriate goals, and address questions about the effectiveness of strategies. Per OMB guidance, a strategic plan should describe how information from program evaluations and research was used to develop the strategic plan, including in establishing or revising the agency’s strategic objectives and identifying evidence-based approaches to meeting objectives. The plan should also (1) describe efforts to support high-quality evaluations, (2) discuss efforts to increase capacity for conducting them and using their findings, and (3) include a schedule of evaluations planned for the next 4 years. SBA officials stated that SBA did not use program evaluations to develop or revise its strategic objectives because the agency had conducted a limited number of them. SBA officials also told us that the agency had limited financial resources available for independent program evaluations but was working on three and considering some in other areas. SBA officials said that it thought the information included in the plan would be sufficient to meet GPRAMA’s requirements on program evaluations. Because SBA has not routinely conducted program evaluations, we have questions about whether the agency will have program evaluations on which to rely when developing its next strategic plan. GPRAMA aims to ensure that agencies use performance information in decision making and holds them accountable for achieving results and improving government performance. OMB has also encouraged agencies to improve government effectiveness by increasing their use of evidence and rigorous program evaluation in making budget, management, and policy decisions. In addition, in a June 2013 report we concluded that evaluations helped in assessing program effectiveness or value, explaining program results, implementing changes to improve program management or performance, developing or revising performance goals, designing or supporting program reforms, and sharing what works with others. We and the SBA OIG have in the past found instances in which SBA did not evaluate the effectiveness of new or existing programs, and the agency has not yet fully addressed our recommendations in this area, as the following examples show. In an August 2010 report, the SBA OIG found that SBA had not assessed the Community Express pilot loan program’s effectiveness. The OIG recommended, among other things, that SBA not extend the program after its expiration in December 2010 but instead evaluate the need for it. Rather than evaluate the program, SBA ended it in April 2011 and replaced it with the new Small Loan Advantage and Community Advantage programs. SBA officials told us that while the agency annually publishes loan program measures that incorporate initiatives such as these, it had not evaluated the initiatives. In an August 2012 report, we found that SBA lacked program evaluations for 10 of the 19 entrepreneurial assistance programs we reviewed. We recommended that SBA conduct more program evaluations to better understand the reasons the programs were not meeting their performance goals and to determine the programs’ overall effectiveness. SBA did not say whether it agreed or disagreed with the recommendation but did take some steps to begin to address it. For example, SBA has begun meeting monthly with other agencies as part of an OMB-led interagency working group that shares best practices in program evaluation and has started pilot programs to test evaluation methods. However, we are unsure of SBA’s commitment to conducting more program evaluations because as of May 2015, the agency had not completed evaluations of any of the programs covered by our recommendation. Therefore, we continue to maintain that our recommendation has merit and should be fully implemented. In a September 2013 report, we found that SBA lacked an evaluation plan to assess the performance of the Patriot Express pilot loan program. As a result, we concluded that SBA was unable to determine if the program was achieving its intended goals. We recommended, among other things, that SBA design an evaluation plan for pilot programs prior to implementation and consider the results of such an evaluation before extending any pilot. SBA responded to the report by stating that the agency would consider our findings as it determined whether to extend the program. Subsequently, SBA did not conduct a performance evaluation of the program and instead decided to terminate the program by allowing it to expire in December 2013. SBA replaced the Patriot Express program with the Veterans Advantage initiative in 2014. Although SBA officials told us the agency tracks performance measures for its loan programs and keeps raw data for each of the loan types (including veterans fee relief), the agency had not evaluated the initiative as of May 2015 and had no plans to do so. In April 2014, the House Committee on Small Business held a hearing on initiatives that SBA had created. The hearing explored the committee’s concerns that SBA had requested funding for potentially duplicative new programs while lacking adequate performance metrics to measure their success or failure. While they did not specifically address the lack of performance metrics for all the programs discussed during the hearing, two SBA witnesses cited the agency’s legislative authority for the new initiatives. Our August 2012 report on entrepreneurial assistance raised similar concerns about overlap in programs and stressed the importance of program evaluations. A senior SBA official acknowledged the agency’s challenges in conducting program evaluations and stated that it was developing a more systematic approach to conducting them, including determining how to collect needed data. While he identified two ongoing studies, he did not provide detailed information on the systematic approach, an expected completion date, or whether the agency would prioritize additional resources to conduct evaluations. Without prioritizing resources to conduct more evaluations of its programs and incorporating the results into its strategic planning process, SBA lacks a critical source of information for ensuring the validity and effectiveness of its goals, objectives, and strategies. In addition, SBA lacks pertinent information that would help in determining the effectiveness of both new and existing programs. SBA needs better planning and oversight in several key management areas. We reviewed SBA’s management of its (1) human capital, (2) organizational structure, (3) enterprise risk, (4) acquisition, and (5) procedural guidance. We found that SBA continued to face long-standing human capital challenges and had not completed development of a workforce plan or training goals to help address them. We also found that SBA faced a skill gap resulting from a 2004 reorganization, and as of June 2015 SBA officials told us the agency had not completed an assessment of its organizational structure. Further, SBA initiated in 2009 efforts to implement enterprise risk management but had only recently begun assessing agency-wide risks and lacked adequate documentation of its progress and future plans. In the area of acquisition management, SBA hired a contractor to assess its acquisition operations and, as of May 2015, was in the process of finalizing its action plan in response to the contractor’s findings. Finally, we found that SBA had not updated many of its guidance documents that it had identified as outdated. As previously noted, SBA’s OIG has identified SBA’s need for effective human capital strategies—the programs, policies, and processes that agencies use to build and manage their workforces—as one of the most significant management challenges facing the agency since 2001. We have also identified challenges to SBA’s human capital management. For example, in our January 2003 report on SBA’s management challenges, we found that SBA needed to strengthen its human capital management by, among other things, getting properly trained people into the right places, identifying the knowledge and skills requirements of its employees, and providing professional development opportunities as needed. According to SBA documents, the agency faces programmatic, demographic, and budgetary challenges that have had an effect on its workforce. To begin to address these challenges, SBA requested Voluntary Early Retirement Authority and Voluntary Separation Incentive Payments (VERA/VSIP) programs for fiscal years 2012 and 2014. Agency officials said that the VERA/VSIP programs were intended to allow SBA to begin reshaping its workforce to meet its ongoing needs in light of its evolving mission. In its applications for these programs, SBA identified the following challenges it faced. Programmatic. SBA stated that its workforce faced an ongoing skill gap resulting from the 2004 centralization of its loan processing function. SBA noted that this organizational change resulted in a gap between the competency mix of employees who had been hired for one mission and the competency mix needed to accomplish a new mission. Specifically, after loan processing was moved from the district offices to loan processing centers, the district offices were given new responsibilities, including business development and outreach. These new responsibilities created a skill gap because employees who were originally required to have a financial background for loan processing were now required to have different skills, such as a marketing background and interpersonal skills. SBA stated that the skill gap was particularly pronounced among 885 employees in two job series—GS-1101 and GS-1102. These employees include business opportunity specialists, economic development specialists, and procurement staff. According to SBA, despite its efforts during the last several years to address this skills imbalance through training and the fiscal year 2012 VERA/VSIP, among other things, the competency gap remains. SBA also noted that the skill gap had been compounded by recent changes in job requirements and new initiatives that required new skill sets for its employees. Demographic. SBA has stated that it has a high number of employees who will retire or will become eligible to retire in the next 5 years. As of June 24, 2014, about 25 percent of SBA employees were eligible to retire, and 50 percent will be eligible in 2019. According to SBA, its aging workforce presents two issues. First, 43 percent of those fully eligible to retire work in two mission-critical job series—GS- 1101 and GS-1102—that have a significant competency gap, but SBA noted that using attrition to obtain a better competency mix in the GS- 1101 job series would be slow. SBA thought that offering VERA/VSIP programs would give it an opportunity to more quickly reshape its workforce to obtain the needed competencies and skill set. Second, SBA stated that the high number of retirement-eligible employees meant that the agency needed a pipeline of new leaders. Creating this pipeline could mean increasing the number of employees who were at the early stages of their careers. Budgetary. SBA has also stated that current economic challenges mean that the agency cannot afford to retain staff with skills that do not support its mission. SBA noted that the fiscal years 2012 and 2014 VERA/VSIP programs kept the agency from having to implement a reduction in force in order to meet budgetary constraints, which would have exacerbated the skills imbalance. Specifically, SBA stated that under reduction-in-force procedures, the agency would lose the types of employees it had recently been recruiting—those with the needed mix of competencies to better ensure SBA’s mission success. SBA has recently developed goals and objectives for its strategic human capital plan and has developed an accountability policy, steps that should help improve its human capital management. It also obtained authority for the two VERA/VSIP programs that it believed would help reshape its workforce. Strategic human capital plan. OPM requires agencies to have documented evidence of a current agency human capital plan that includes human capital goals, objectives, and performance measures. Additionally, in our 2003 report on strategic workforce planning we concluded that periodic measurement of an agency’s progress toward human capital goals provided information for effective oversight by identifying performance shortfalls and appropriate corrective actions. SBA’s fiscal years 2013-2016 strategic human capital plan incorporates these practices. For example, the plan identifies human capital goals and objectives, such as building strategic partnerships and incorporating human capital flexibilities, and is designed to support SBA’s agency-wide strategic plan, particularly SBA’s strategic objective to invest in its employees. The plan also includes action items and performance measures that SBA tracks annually and demographic information about SBA’s workforce. Human capital accountability policy. OPM requires agencies to have documented evidence of a human capital accountability system that provides for an annual assessment of agency human capital management progress and results. SBA has developed a human capital accountability policy that outlines SBA’s processes for evaluating its human capital systems and a multiyear schedule for conducting human resource program assessments. VERA/VSIP programs. As discussed previously, SBA requested VERA/VSIP authority for fiscal years 2012 and 2014 in hopes that these initiatives would enable the agency to begin reshaping its workforce to meet its ongoing needs. In both years, OPM authorized SBA to offer this authority to 300 employees. SBA has taken several other steps to begin addressing its human capital management challenges, including working toward a workforce plan and identifying mission-critical competencies. According to federal internal control standards, workforce planning is a key internal control that allows agency management to ensure that skill needs are continually assessed and that the organization is able to obtain and maintain a workforce with the skills necessary to achieve organizational goals. Although agencies may take various approaches to workforce planning, in a December 2003 report we identified key principles they should address. SBA has taken some recent actions to incorporate these principles but has not completed a formal workforce plan that fully incorporates them (see table 2). Workforce plan. SBA indicated in its fiscal years 2013-2016 strategic human capital plan that it was working on a separate workforce plan. SBA officials said that they had taken steps to develop the plan but as of May 2015 had not completed it. SBA officials told us that they had been unable to complete the workforce plan because a current agency-wide competency and skill gap assessment was necessary to develop it. As discussed in more detail later, they have not yet completed this assessment because of a delay in deploying the system needed to conduct it. As stated earlier, SBA has faced a long- standing skills imbalance resulting from organizational changes dating to 2004. Critical skills and competencies. SBA has taken steps to identify competencies for its mission-critical occupations. For example, in 2011 SBA conducted competency assessments for its human resources staff and its managers and supervisors. In addition, in fiscal year 2013 SBA’s Office of Human Resources Solutions reviewed 31 of SBA’s mission-critical position descriptions, developed competency lists, and requested that program offices review and make adjustments to those lists. SBA’s Office of Disaster Assistance has also taken steps to identify competencies for its employees by developing a baseline competency framework based on OPM- recommended competencies, current position descriptions, performance goals, and organizational strategic goals. However, SBA has not completed an agency-wide competency and skill gap assessment since 2006, and an up-to-date assessment is critical for determining whether there are additional skill gaps in its current workforce. In 2012, SBA began using an electronic system called the Talent Management Center to manage employee training and performance. The system consists of two components—a learning management module and a performance management module. The learning management module is a software application that provides SBA employees with access to online training courses and allows employees to track their training. The performance management module allows employees to track their performance goals and evaluations. According to SBA officials, the contractor that implemented the Talent Management Center was also going to implement a tool as part of the learning management module that would allow SBA to conduct a competency and skill gap assessment. However, SBA was unable to conduct the assessment because the contractor did not deploy the tool on time as planned. SBA officials told us the agency had contracted with another vendor to conduct the assessment during fiscal year 2015 and had held several meetings with the vendor to discuss the methodology and process for the assessment as of June 2015. Gap-closure strategies. As discussed earlier, SBA has taken initial steps aimed at addressing the skills imbalance in its workforce that resulted from its 2004 organizational change. SBA’s VERA/VSIP programs in fiscal years 2012 and 2014 were intended to provide the agency needed flexibility to address this skills imbalance by creating vacancies that would allow it to strategically recruit new employees who have the needed competencies and skills. Under the VERA/VSIP programs, a total of 327 employees left the agency, but this number was lower than SBA expected. In addition, SBA has developed a Leadership Succession Plan. The purpose of the plan is to strengthen current and future agency leadership capacity by creating leadership readiness programs and adopting a succession planning model to develop pools of potential leaders. The plan also outlines other succession strategies, such as job rotations to broaden employees’ understanding across different functional areas of the agency and a mentoring program to help employees clarify career goals and analyze strengths and developmental needs. In addition, a senior SBA official stated that improving human capital management was a priority for the Administrator and that SBA was focused on developing different ways to recruit a younger and more diverse workforce. For example, SBA has revised its Presidential Management Fellows program with the goal of improving retention and is working with the Peace Corps to identify returning volunteers who may be interested in a career in public service. Despite these steps, SBA does not have a current agency-wide competency and skill gap assessment and as a result cannot develop and document an effective long-term strategy to fully address its previously identified skill gaps and any additional skill gaps that may exist. SBA officials told us they had not developed a long-term plan because they were relying in part on their VERA/VSIP programs to help reshape SBA’s workforce to address its long-standing skills imbalance. SBA developed guidance outlining how vacancies were to be filled after the fiscal year 2014 VERA/VSIP program, and SBA officials stated that options for restructuring and related hiring following this program were still being considered as of May 2015. However, because both the fiscal year 2012 and fiscal year 2014 VERA/VSIP programs resulted in a smaller-than-expected number of retirees, whether these efforts will ultimately allow SBA to reshape its workforce to achieve its needed skill mix is unclear. Support capacity. Although SBA has policies in place that enable the use of human capital flexibilities to support its workforce, such as a recruitment and retention incentives policy, the use of these flexibilities is not directly tied to a workforce plan. Evaluation. SBA has taken steps to monitor and evaluate its progress toward its human capital goals through its human capital accountability policy and tracking progress of the measures in its strategic human capital plan. However, because SBA has not established a strategic workforce plan, the agency has not monitored and evaluated the results of its workforce planning efforts. Without a workforce plan that fully addresses key principles, including a current agency-wide competency and skill gap assessment and a long- term strategy to close skill gaps, SBA cannot provide reasonable assurance that its workforce has the skills needed to meet the agency’s mission. For example, having a current assessment and completed workforce plan prior to its early retirement programs would have helped SBA target its hiring and retention efforts. Without having first taken these steps, SBA risked compromising its efforts to reshape the agency. In a 2004 report, we concluded that effective training and development programs are an integral part of a learning environment that can enhance an agency’s ability to attract and retain employees with the skills and competencies needed to achieve results. We also noted that training and development programs help an agency achieve its mission and meet its goals by improving individual and ultimately organizational performance. In the same 2004 report, we identified key principles that could help federal agencies produce a strategic approach to their training and development efforts. SBA has taken steps to incorporate these principles but has only partly incorporated them (see table 3). Planning. SBA officials told us that SBA had conducted a training needs assessment in the summer of 2014, which helped the agency identify a list of top training courses for its employees. SBA also developed a fiscal years 2014-2015 training plan that outlines SBA’s major training programs and activities. However, the plan does not fully establish a strategic approach to training that would help achieve agency results. First, it does not establish training goals and related performance measures to help SBA determine whether its training and development programs are achieving their intended results. SBA officials told us that they had not developed these goals and measures because the employees developing the plan had left the agency, but that they planned to develop them for the next iteration of the training plan. However, as of June 2015, SBA did not have an expected completion date for the revised plan. Second, as previously discussed, SBA has not conducted a competency and skill gap assessment since 2006. Third, SBA officials told us that the training plan incorporated input from supervisors but did not directly incorporate employee development goals because the agency was not required to have individual development plans for its staff. However, while SBA is not required to have individual development plans, it could choose to require them or to obtain employee development goals through other means. Design and development. SBA has also taken steps to identify specific training and development initiatives. For example, as discussed earlier SBA recently began using an electronic system called the Talent Management Center which, among other things, allows employees to take certain training courses online. SBA officials stated that SBA is currently developing the curriculum for its online courses in consultation with program office management, supervisors, and hiring managers. SBA officials told us that they decided to use this system due to its cost-effectiveness and flexibility. The training plan also identifies a number of other training initiatives, such as a leadership development program. However, whether these training and development initiatives are directly connected to improving individual and agency performance is unclear. For example, although SBA launched an electronic learning module and is developing a curriculum for it, the lack of a completed competency assessment makes it difficult to specifically design the curriculum to improve individual performance. Furthermore, while SBA offers a mix of centralized and decentralized training programs, a recent training assessment it conducted found that the decentralized training that program offices provide receives no review or oversight to detect duplicative offerings or identify opportunities to provide training more effectively and efficiently. According to SBA officials, its new electronic learning module will enable the agency to track and monitor both decentralized and centralized training. In addition, a senior SBA official stated that SBA was considering ways to offer more systematic training and mentorship programs. Implementation. SBA officials told us that they had taken steps to communicate information about training efforts to employees by, for example, publishing notices about upcoming training opportunities in the SBA Daily. SBA officials also told us that they had provided employees with training on how to use SBA’s new electronic learning module and training for each staff member on their positions as part of their professional development. However, whether SBA has taken actions to foster an environment conducive to effective training and development is unclear. For example, results from SBA’s 2014 Federal Employee Viewpoint Survey (FEVS) showed that just over one-third of employees felt that their training needs had been assessed. Specifically, in response to a question asking whether their training needs were assessed, 39.22 percent (537 employees) agreed or strongly agreed, 24.82 percent (341 employees) neither agreed nor disagreed, and 35.96 percent (489 employees) disagreed or strongly disagreed. In addition, about 40 percent indicated that they were satisfied with the training they had received. Specifically, in response to a question asking whether they were satisfied with the training they had received for their present job, 39.93 percent (533 employees) were satisfied or very satisfied, 25.48 percent (343 employees) were neither satisfied nor dissatisfied, and 34.59 percent (457 employees) were dissatisfied or very dissatisfied. The SBA district office employees we interviewed also expressed mixed views about the training provided by SBA. For example, three employees stated that they received helpful training related to their positions. However, 15 employees described difficulties obtaining the training they needed. For example, 9 of these employees—including 4 lender relations specialists, 2 economic development specialists, and 1 business opportunity specialist—stated that they did not receive any formal training related to their positions. Two employees stated that they had multiple job responsibilities but did not receive the training needed to perform them all. The other 4 employees stated that the training they did receive was not helpful or relevant to meeting their job responsibilities. Evaluation. In fiscal year 2012, SBA’s Office of Human Resources Solutions established an accountability function in its Strategy, Policy, and Accountability Division with responsibility for conducting internal assessments. The program assessment schedule calls for reviewing SBA’s training programs annually, and SBA conducted its first assessment of the centralized training program under this schedule in 2013. SBA found significant weaknesses and areas of noncompliance with regulatory requirements, including not having evaluated its training programs on a regular basis, not maintaining records of training and expenditures, and not addressing federally mandated training requirements in written policies. The assessment contained 14 required actions designed to strengthen SBA’s training and development programs and ensure regulatory compliance. In April 2015, SBA completed its fiscal year 2014 assessment of its training program to determine the agency’s progress on correcting these deficiencies and found that 10 of the 14 required actions remained incomplete. SBA stated that it planned to assess its training program again at the end of fiscal year 2015. Without a more strategic approach to its training and development programs, including incorporating training goals and measures and input on employee development goals in its training plan, it will be difficult for SBA to effectively establish priorities in its training initiatives or address skill gaps. In our 2003 report on results-oriented cultures, we identified key principles in employee performance management. We concluded that an effective employee performance management system can be a strategic tool to drive internal change and achieve desired results. Specifically, we concluded that employee performance management systems must show how team, unit, and individual performance can contribute to overall organizational results and that the system serves as the basis for setting employee expectations and for evaluating individual performance. In 2011, SBA updated critical elements and performance standards for its employees in the field, and in 2012 began using a new electronic system to manage performance (the Talent Management Center). But it did not update its March 15, 2000, SOP before the new system and standards were implemented. According to a recent SBA assessment of its performance appraisal program, the existing SOP does not reflect the agency’s current practices. SBA officials stated that as of August 2015 they had revised the SOP, it had been signed by the Administrator, and it was in the process of being published. Prior to finalizing its SOP, SBA officials stated that the agency had provided employees with guidance on using the new electronic system and on new performance standards for the field. Our review of a set of critical elements and performance standards that we received from SBA indicated that field office employees are primarily evaluated on the basis of quantitative measures. For example, business opportunity specialists are evaluated in part on their participation in outreach events and procurement visits to assigned entities. In order to receive the highest rating of five for these activities, these specialists must conduct or participate in more than 65 events annually. According to the elements and standards, supervisors are responsible for monitoring the quality of employee activities. The elements and standards do not describe what criteria supervisors should apply to make that determination, but SBA officials stated that SBA provides program offices with guidance on incorporating qualitative measures. Some of the 58 SBA managers and employees we spoke with in SBA’s regional and district offices expressed mixed views about SBA’s new employee performance management system. For example, 11 (10 managers and 1 nonmanager) said the system clearly laid out employee performance expectations. However, some managers and employees criticized certain aspects of SBA’s employee performance management system. Specifically, 5 (2 managers and 3 nonmanagers) said the performance appraisal elements and standards focused primarily on quantitative measures and did not account for quality. As discussed earlier, our review of a set of critical elements and performance standards also indicated a lack of qualitative measures. In addition, 6 (3 managers and 3 nonmanagers) stated that there were problems with technical aspects of the electronic performance system. For example, 4 (1 manager and 3 nonmanagers) said that they had to track their performance activities in separate systems that did not communicate with one another. Employees responding to SBA’s 2014 FEVS also expressed mixed views about SBA’s employee performance management system. For example, in response to a question asking whether SBA employees understood what they had to do to be rated at different performance levels, 71.87 percent (986 employees) agreed or strongly agreed, 11.20 percent (158 employees) neither agreed nor disagreed, and 16.92 percent (229 employees) either disagreed or strongly disagreed. In response to another question asking employees whether they believed their performance appraisal was a fair reflection of their performance, 68.06 percent (938 employees) agreed or strongly agreed, 13.03 percent (180 employees) neither agreed nor disagreed, and 18.91 percent (254 employees) either disagreed or strongly disagreed. However, in response to a question asking whether differences in performance were recognized in a meaningful way, 36.09 percent (472 employees) agreed or strongly agreed, 24.90 percent (324 employees) neither agreed nor disagreed, and 39.01 percent (509 employees) disagreed or strongly disagreed. SBA officials told us that a committee of district directors was working with the Office of Human Resources Solutions to bring qualitative components back into the performance appraisal elements and standards for the field offices and resolving technical problems with the system. SBA officials stated that these efforts were ongoing, but the agency does not have an expected completion date. Despite long-standing organizational challenges affecting program oversight and human capital management, SBA officials told us that as of June 2015, SBA had not completed an assessment of its structure or made any needed changes to determine how to address the challenges. In a January 2003 report on SBA’s management challenges, we found that the agency’s organizational structure created complex overlapping relationships among offices that contributed to challenges in delivering services to small businesses. In 2004, SBA centralized its loan functions by moving responsibilities from district offices to loan processing centers. However, some of the complex overlapping relationships we identified in 2003 still exist (see fig. 6). Specifically, SBA’s organizational structure often results in working relationships between headquarters and field offices that differ from reporting relationships, potentially posing programmatic challenges. District officials work with program offices at SBA’s headquarters to implement the agency’s programs, but these officials report to regional administrators, who themselves report to the Office of Field Operations. For example, the lender relations specialists in the district offices work with the Office of Capital Access at SBA headquarters to deliver programs but report to district office management. Similarly, the business opportunity specialists in the district offices work with the Office of Government Contracting and Business Development at SBA headquarters to assist small businesses with securing government contracts but report to district office management. Further, some officials have the same duties. The public affairs specialists at the district offices and the regional communications directors both handle media relations. In addition, district directors and regional administrators both are to conduct outreach to maintain partnerships with small business stakeholders such as chambers of commerce; lending institutions; economic development organizations; and federal, state, regional, and local governments. They also participate in media activities and speak at public events. In later reports, we and others—including SBA itself—identified organizational challenges that affected SBA’s program oversight and human capital management. In a March 2010 report on the 8(a) business development program, we found a breakdown in communication between SBA district offices and headquarters (due in part to the agency’s organizational structure) that resulted in inconsistencies in the way district offices delivered the program. For example, in about half of the 8(a) files we reviewed, we found that district staff did not follow the required annual review procedures for determining continued eligibility for the program. This was due in part to the lack of clear guidance from headquarters. In addition, we found that confusion over roles and responsibilities led to district staff being unaware of the types and frequency of complaints across the agency on the eligibility of firms participating in the 8(a) program. As a result, district staff lacked information that could be used to help identify issues relating to program integrity. As discussed earlier, we made six recommendations, including that SBA provide more guidance to help ensure staff more consistently follow procedures, and SBA agreed with them. As of July 2015, SBA had taken actions responsive to four of the recommendations. In addition, in 2013 the SBA OIG found that communication from a headquarters program office to field offices about conducting examinations for a specific program had been limited. The report noted that this lack of communication could have not only inhibited the sharing of crucial information but also caused inconsistencies in the examinations across field offices. It concluded that these weaknesses in the examination process had diminished the agency’s ability to identify regulator violations and other noncompliance issues in the operation of the program. The OIG recommended that SBA create and execute a plan to improve the internal operations of the examination function, including a plan for better communication. Although SBA disagreed with the recommendation, the agency issued examination guidelines that the OIG in 2015 deemed satisfactory to close the recommendation. In documentation requesting fiscal years 2012 and 2014 VERA/VISP programs, SBA said that long-standing skill gaps, primarily in field offices, which had resulted from the 2004 reorganization and centralization of the loan processing function, still existed. SBA determined that its organizational changes had resulted in a programmatic challenge because employees hired for a former mission did not have the skills to meet the new mission. Specifically, before the centralization effort field offices had primarily needed staff with a financial background to process individual loans. But the new mission required staff who could develop socially and economically disadvantaged businesses and conduct annual financial reviews of them, engage with lenders, and conduct outreach to small businesses. Despite the organizational and managerial challenges it has faced, SBA’s changes to its organizational structure since fiscal year 2005 have been incremental (piecemeal), as the following examples illustrate: In 2007, SBA reorganized five program offices and four administrative support functions in order to clearly delineate reporting levels, among other things. The agency also eliminated the Chief Operating Officer as a separate office and integrated its functions into the Office of the Administrator. In 2008, the Office of Equal Employment Opportunity and Civil Rights Compliance began reporting directly to the Associate Administrator for Management and Administration to facilitate better oversight, planning, coordination, and budgeting for all of the agency’s administrative management operations. In 2010, SBA consolidated financial management by moving its procurement function to the Office of the Chief Financial Officer and transferring day-to-day procurement operations from headquarters to the agency’s Denver Finance Center. This change was intended to improve the efficiency and effectiveness of SBA’s acquisition programs. In 2011, SBA restructured the Office of Human Capital Management in response to significant turnover that had a serious effect on the level and scope of services. The reorganization streamlined the office, which was renamed the Office of Human Resources Solutions, by reducing the number of branches and divisions. In 2012, new offices were created in the Office of Capital Access to respond to, among other things, growth in small business lending programs and increased servicing and oversight responsibilities following the 2007-2009 financial crisis. The changes sought to help the agency become a better partner with lending institutions and nonprofit financial organizations to increase access to capital for small businesses. In 2012, SBA established a headquarters unit within the Office of Government Contracting and Business Development and made it responsible for processing the continued eligibility portion of the annual review required for participants in the 8(a) program. Prior to this change, district officials, who are also responsible for providing business development assistance to 8(a) firms, were tasked with conducting exams of continued eligibility. While district officials have continued to perform other components of the annual review, shifting the responsibility for processing continued eligibility to headquarters was designed to eliminate the conflict of interest for district officials associated with performing both assistance and oversight roles. In 2012, the Office of Field Operations revamped field office operations following a 2010 review of all position descriptions to ensure that they aligned with SBA’s strategic plan and district office strategic plans. Many position descriptions were rewritten, although there were no changes in grade or series. Before the review, district offices had two principal program delivery positions—lender relations specialist and business development specialist. As a result of the review, descriptions for both positions were rewritten, and the business development specialist position became two—economic development specialist and business opportunity specialist. The skills and competencies for the new position descriptions focused on the change in the district offices’ function from loan processing to compliance and community outreach in an effort to address skill gaps. As a result, staff were retrained for the rewritten positions. In 2013, SBA reestablished the Office of the Chief Operating Officer (formerly the Office of Management and Administration) to improve operating efficiency. Among other things, this change transferred Office of Management and Administration staff to the reestablished office, along with the Office of the Chief Information Officer and the Office of Disaster Planning, which saw its mission expanded to include enterprise risk management. While SBA has made incremental changes, SBA officials told us that as of June 2015, the agency had not completed an evaluation of its organizational structure and made changes as necessary in response to changing conditions. According to federal internal control standards, organizational structure affects the agency’s control environment by providing management’s framework for planning, directing, and controlling operations to achieve agency objectives. A good internal control environment requires that the agency’s organizational structure clearly define key areas of authority and responsibility and establish appropriate lines of reporting. Further, internal control guidance suggests that management periodically evaluate the organizational structure and make changes as necessary in response to changing conditions. Since its last major reorganization in 2004, SBA has seen significant changes, including decreases in budget and an increase in the number of employees eligible to retire. In 2012, the agency committed to assessing and revising its organizational structure to meet current and future SBA mission objectives. However, the contractor that SBA hired to assess its organizational structure did not begin its assessment until November 2014. SBA officials told us that the effort was delayed because in February 2013 SBA’s Administrator announced she was leaving the agency and the position was vacant from August 2013 until April 2014. In August 2015, SBA told us that after the new administrator reviewed business delivery models and became acclimated to the agency, the agency procured a contractor and work began on the organizational assessment in November 2014. According to the statement of work, the contractor was to assist the chief human capital officer by making recommendations regarding an agency-wide realignment to improve service delivery models, modernize systems and processes, and realign personnel, among other things. During the course of our review, SBA officials told us the contractor completed its assessment in March 2015, but SBA had not finished analyzing the results and determining what organizational changes, if any, to make. In its August 2015 comments on a draft of this report, SBA noted that the agency had recently completed that review and determined that major restructuring was not warranted at the time. However, SBA did not provide us with any documentation that shows when the assessment was completed or that supports its conclusions that major changes were not warranted. Until SBA documents its assessment, it will not have an institutional record of its actions. Instead of conducting its planned assessment and subsequent reorganization when initially scheduled, SBA used two VERA/VSIP programs to attempt to address workforce challenges resulting from the 2004 reorganization. SBA’s plans in the aftermath of the fiscal year 2014 VERA/VSIP program include restructuring. Specifically, an October 2014 guidance memorandum on staffing the agency-wide vacancies after the fiscal year 2014 VERA/VSIP stated that an Administrator’s Executive Steering Committee for SBA’s Restructuring would make decisions about restructuring. The memorandum also stated that the Chief Human Capital Officer had been tasked with identifying vacant FTEs for new positions that would support any new functions or initiatives envisioned by the Administrator’s restructuring efforts. For example, the memorandum noted that 82 of the 147 new vacancies from the VERA/VISP would be used to support the Administrator’s restructuring. The memorandum added that the remaining 65 vacancies would remain in their respective program offices and that the position descriptions would be modified or positions relocated to meet internal needs. According to SBA, options for restructuring and related hiring were still being considered as of May 2015. Although SBA told us that it has recently completed an assessment of its organizational structure, it had not documented this effort as of August 2015. Until it documents its efforts to examine its structure and any findings, it will be difficult for SBA to provide reasonable assurance, or for a third party to validate, that SBA’s current organizational structure is contributing effectively to its mission objectives and programmatic goals. Given the range of programs SBA manages and oversees, having a robust enterprise risk management system is critical to effectively managing risks. SBA initiated efforts to implement enterprise risk management in 2009, noting the importance of managing the range of cross-agency risks it faces. However, it could not provide us with adequate documentation on the progress of these efforts or on any future plans and had only recently begun assessing agency-wide risks. SBA began its enterprise risk management efforts in 2009 with the designation of an unofficial chief risk officer but considers itself to be in the “early stages” of implementation. In 2013, SBA established an Office of Enterprise Risk Management under the chief operating officer and developed a process to guide its approach. SBA officials told us that they had developed this process based in part on recommendations made by Deloitte & Touche as part of that organization’s review of the risk management practices within SBA’s Office of Capital Access. In the course of our work, SBA provided a graphic depicting the five phases of its enterprise risk management process: (1) identify risk; (2) assess risk; (3) strategize response; (4) implement; and (5) monitor and report (see fig. 7). The agency also provided a brief summary of the progress it had made in implementing these phases. However, the agency could not elaborate on and did not provide any other documentation of its process, including on the goals it hoped to achieve or the specific actions it planned to take during each phase. Federal internal control standards require that significant actions be clearly documented in, for example, management directives, administrative policies, or operating manuals. Although SBA’s enterprise risk management plans and efforts to date are not fully documented, we used available information to compare SBA’s process to our risk management framework (see table 4). GAO’s risk management framework calls for the following five phases and lays out key elements for each: (1) defining strategic goals, objectives, and constraints: (2) assessing risk; (3) evaluating alternatives; (4) selecting responses; and (5) implementing and monitoring. As table 4 shows, SBA has partially implemented two phases of its risk management process and those phases partially align with one phase of our framework. Specifically, SBA has begun to identify and assess risks, which partially aligns with our risk assessment phase. However, we rated SBA as not following the other four phases of our framework, as it had not yet made progress on implementing the remaining phases of its process. Strategic goals, objectives, and constraints. Our risk assessment framework calls for fully documenting strategic goals and objectives, which should be clearly articulated and measurable, as well as any limitations or constraints that may limit effective risk management. In October 2014, the SBA Administrator approved the formation of an Enterprise Risk Management Board to ensure that the greatest risks to the agency are regularly identified, assessed, and monitored. The Administrator approved the membership of the board on April 24, 2015. According to officials, the board plans to develop a charter by September 2015. However, because the board met for the first time on April 30, 2015, SBA had not yet documented the strategic goals and objectives it is attempting to achieve, the steps needed to attain these results, or the constraints under which the agency operates, as of May 2015. Risk assessment. Our framework calls for identifying potential events that can adversely affect the agency and evaluating them based on the likelihood of occurrence and impact. SBA officials told us that as of November 2014, officials in SBA’s risk management office had interviewed program office leaders and reviewed agency processes to draft an inventory of risks and complete an initial assessment. The officials explained that they needed to further refine this assessment and that the Enterprise Risk Management Board would determine additional steps. However, because the board was still reviewing the draft risks as of May 2015, SBA has not completed the risk inventory or developed procedures to identify and evaluate the potential risks to the agency’s ability to achieve its goals and objectives. Alternatives evaluation. Our framework calls for identifying alternative ways the agency can prevent or manage an identified risk while taking into consideration the costs and benefits of the alternatives. However, to date, SBA has not been able to consider managing risks because it has not completed the risk assessment process. According to SBA, risk responses will be guided by the Management selection. Our framework requires management to select and document responses to potential risks and provide a rationale for its selections. To date, SBA has not proceeded to this step. As noted earlier, SBA told us that the Enterprise Risk Management Board would guide risk responses. Implementation and monitoring. Our framework includes implementing management’s selected alternatives to address risks and periodically assessing the efficiency and effectiveness of the entire risk management program. Because it has not identified risks and possible responses to them, SBA cannot proceed to this step. According to SBA officials, the Office of Risk Management will maintain records of the Enterprise Risk Management Board’s decisions and follow up with the chief risk officer to ensure that the steps the board decides on are implemented. According to a senior SBA official, the Enterprise Risk Management Board will be assessing SBA’s risks in the near future, and he plans to ask the Board to consider our risk management framework at that time. Given the long-standing management challenges related to specific SBA programs discussed earlier, it may be challenging for SBA to establish an agency-wide system. However, until SBA identifies and fully documents the steps that it plans to take to implement its enterprise risk management process and incorporates the elements of our risk management framework, it will not be able to provide reasonable assurance that its enterprise risk management efforts effectively identify, assess, and manage risks before they can adversely affect SBA’s ability to achieve its mission. SBA has met its small business contracting goals and taken steps to address acquisition management challenges. Contracting represents a small portion of SBA’s obligations. SBA’s total contract obligations for fiscal year 2014 were approximately $116.6 million, compared with total obligations for fiscal year 2014 of about $845.8 million. But the agency in recent years has exceeded its primary goals for awarding contracts to small businesses. By statute, federal agencies are to award 23 percent of their prime contract funds to small businesses. To help meet this government-wide goal, each agency has its own individual goal. In fiscal year 2013, of approximately $106.7 million in total small business-eligible contracting dollars, SBA awarded $76.8 million to small businesses, exceeding the agency’s goal of 67 percent (see table 5). Despite these successes, over the last several years the SBA OIG has identified deficiencies in several areas of SBA’s acquisition management, including lack of compliance with laws and regulations, such as the Improper Payments Information Act requirements for planning, execution, and reporting of improper payments for its contracting activities; inadequate application of funding principles, including obligating funds by issuing contract modifications without identifying specific requirements for IT hardware and software; and turnover in key contracting staff, resulting in a workforce insufficient to effectively award, administer, and oversee contracts. SBA has taken steps to address some of these deficiencies. In October 2010, SBA realigned its acquisition program by transferring its procurement function and operations to the Office of the Chief Financial Officer’s Denver Finance Center and rebranding it the Acquisition Division. This redesign was intended to improve the efficiency and effectiveness of the acquisition program by integrating acquisition and procurement activities. Since this realignment, SBA has taken further steps to improve the acquisition process, including hiring new staff and providing training to its acquisition personnel. Specifically, according to its fiscal year 2014 Acquisition Human Capital Plan, in fiscal year 2011 SBA hired 17 new employees in the acquisition office. Each employee was given a plan with measureable outcomes and over 50 hours of individual job-specific training. In addition, in fiscal year 2011 SBA reinstituted its Contract Review Board, giving greater oversight to high-risk contracts. Members of the board include the chief acquisition officer, senior procurement executive, and director of procurement law. However, in its most recent report on SBA’s management challenges, the SBA OIG noted that while SBA had made some progress in its acquisition program, the program continued to face challenges, including (1) poorly defined requirements, (2) internal control deficiencies, (3) inadequate oversight of contractor performance, and (4) an incomplete acquisition SOP. Specifically, the fiscal year 2015 report noted that SBA, among other things, had inadequately monitored contract performance and did not provide assurance that products and services were delivered according to contract requirements; updated its acquisition SOP but did not include elements such as the use of interagency acquisitions or define postaward contract administration requirements, among other things; and did not complete the acquisition assessment required in OMB’s Memorandum for Chief Acquisition Officers: Conducting Acquisition Assessments under OMB Circular A-123. The OIG made recommendations to SBA to address these issues, including (1) completing an assessment of the agency’s acquisition activities using OMB guidance; and (2) creating and implementing a comprehensive improvement plan—based on the results of the acquisition function assessment—that has measurable goals, objectives, prioritized actions, and time frames to address any identified deficiencies. In response to these recommendations, SBA awarded a contract for an assessment of its acquisition function. This assessment—completed at the end of March 2015—included a functional assessment of SBA acquisition operations using OMB Circular A-123, Appendix 1, “Guidelines for Assessing the Acquisition Function,” which describes the four cornerstones of acquisition management: organizational alignment and leadership, policies and processes, human capital, and information management and stewardship. In its final report, the contractor noted that SBA’s decision to realign acquisition and procurement functions under the direction of the chief financial officer was consistent with the practices of many of the Chief Financial Officers Act agencies and other small independent agencies. However, the contractor found several shortcomings with the agency’s internal controls in each of the four cornerstones. For example, the contractor noted a lack of clarity on the roles and responsibilities of the various stakeholders in the acquisition process. While most people understood their general role in the acquisition lifecycle, their specific responsibilities were not clearly defined. The contractor noted that this lack of clarity lead to gaps and inconsistencies in the acquisition process. Similarly, while the contractor found that SBA had SOP documents for its acquisition process, for the most part they restated the Federal Acquisition Regulation guidelines and did not describe the processes as they exist or should exist at SBA. As such, these SOPs had limited value in creating operational consistency and did not serve as useful training tools for new members of the acquisition team. Further, the contractor noted that performance standards, while incorporated into all procurements, were generic and lacked the specificity to guide desired outcomes. The contractor made several recommendations to SBA to support the establishment, assessment, and correction of internal controls in these four areas. Using the findings and recommendations identified from the functional assessment, the contractor was to develop a formal plan that addressed each cornerstone and would serve as an action plan to implement the contractor’s recommendations for SBA’s acquisition operations. According to SBA officials, the contractor had delivered this plan to SBA as of May 2015, but the Office of the Chief Financial Officer had not finalized its plan and had no time frame for doing so. We found that SBA’s inventory of SOPs—guidance for its staff and external parties—included outdated SOPs that did not align with current program requirements as well as SOPs that the agency had previously canceled. Federal internal control standards state that documentation— which helps managers control their processes and is essential for evaluating and analyzing operations—must be properly managed and maintained to ensure proper stewardship of and accountability for government resources and effective and efficient program results. Based on our review of an inventory of 153 internal and external SOPs, we found that nearly half (71) had not been updated in the last 10 years. Furthermore, 36 of these 71 had not been updated since the 1990s, and 19 had not been updated since the 1980s. These SOPs covered a number of programs and organizational processes. While not all SOPs may need to be updated on a regular basis, federal internal control standards state that internal controls and all transactions and other significant events need to be clearly documented and that all documentation and records should be properly managed and maintained. We and the SBA OIG have found that some of the SOPs that SBA updated in the last few years did not align with current program requirements. For example, we found in a February 2015 report that SBA had updated its SOP for the HUBZone program in 2007 but that the program subsequently underwent significant changes that the updated document did not reflect. Similarly, as noted earlier, SBA overhauled its employee performance standards in 2011 but did not update its Performance Management and Appraisal System SOP from 2000. Finally, in a March 2011 report the SBA OIG found that the disaster loan servicing centers lacked a clearly defined records management and documentation process and therefore did not consistently make and preserve records containing adequate and proper documentation. Records that should have been preserved because they contained evidence of agency activities or information of value to the agency were not systematically maintained. As a result, the SBA OIG recommended that SBA make and preserve records containing adequate and proper documentation of procedures for its oversight of its loan servicing programs, including incorporating these procedures into the relevant SOPs. As of February 2015, SBA had not implemented the SBA OIG’s 2011 recommendations on updating the SOPs for its loan servicing procedures. In fiscal year 2014, SBA’s Office of the Chief Operating Officer, Office of Administrative Services began a review of the status of all SOPs, working with the program offices to determine whether any updates were needed. Specifically, SBA issued a notice requiring all office heads to certify in writing the status of their SOPs. For each SOP, the cognizant office was to note whether (1) it did not require any revision, (2) it was under review, (3) it was being revised, or (4) it was being canceled. If an SOP was deemed to fall within one of the last three categories, the office was to provide the date by which the action would be completed. As a result of that review, SBA created a spreadsheet that flagged some SOPs as outdated and some for cancelation. Of the 165 SOPs reviewed as of March 2015, SBA determined that 74 needed to be revised, 31 needed to be canceled, and 60 required no revision. SBA also determined that it needed to issue an additional 9 new SOPs (see app. IV for a list of all SOPs and their status). However, many of these outdated and canceled SOPs were still on SBA’s internal website in March 2015 when we requested an updated list, raising questions as to whether SBA staff and partners may be using outdated or canceled SOPs. Further, in most cases SBA’s spreadsheet did not include projected completion dates for revising or canceling old SOPs or creating new ones. SBA officials told us that they lacked resources to update their SOP inventory but were in the process of revising those that had been flagged for revision. They also told us that they planned to revise the SOP for the entire Records Management Program and send it to the administrator for approval in fiscal year 2015. In addition, a senior SBA official noted that several SOPs had been updated and were undergoing final review. Without setting time frames to help ensure that SOPs are properly maintained and periodically updated, it will be difficult for SBA to hold staff accountable for updating the SOPs as intended and to illustrate its progress in doing so. Moreover, without updated SOPs, agency staff and their partners may not have clear guidance on how to most effectively deliver program services in accordance with laws and regulations. In a February 2015 report, we identified the management of information technology acquisitions and operations as an area that presents a high risk to the federal government. We reported that too frequently agency IT efforts failed or incurred cost overruns and schedule slippages and did not meet mission goals due to challenges in managing the investments. The federal government has undertaken several initiatives to better manage its IT investments, with the goal of increasing efficiency and reducing costs. However, agencies continue to have poorly performing projects, such as SBA’s LMAS project, which we discussed earlier. While SBA has taken steps to implement six IT initiatives set out by OMB, it has not fully completed all of them. TechStat reviews. As part of the Federal Chief Information Officer’s (CIO) 25 Point Implementation Plan, in December 2010, OMB empowered agency CIOs to hold agency-level TechStat accountability reviews for investments that are at risk. According to OMB’s instructions, agency CIOs are to report the status of risk of their investments on the Federal IT Dashboard. Using the ratings (high, medium, or low risk), agencies determine whether or not to hold a TechStat review of an investment and decide, based on the evidence presented, whether to intervene to turnaround, halt, or terminate a project. OMB also required federal agencies to hold at least one TechStat review by March 2011. Based on the success of the TechStat initiative, OMB issued a requirement in August 2011 that agency CIOs continue holding such reviews. From December 2010 through February 2015, SBA reported three investments on the Federal IT Dashboard that exhibited moderately high risk. In March 2011, SBA held a TechStat session for one of those investments—the Homeland Security Presidential Directive (HSPD)-12, a system to implement a new government-wide standard for secure and reliable forms of identification for employees and contractors who access government-controlled facilities and information systems. As of February 2015, SBA’s HSPD-12 system was still considered to be at moderately high risk. SBA officials stated that this investment was rated moderately high risk because they had not yet implemented the requirements that would allow the identification card readers to work properly in the field. SBA did not hold a TechStat for the second investment rated moderately high risk—the Loan Accounting System—from July 2011 through February 2012. SBA changed the investment’s rating several times, from medium to low risk, and it has been rated low risk since June 2014. SBA officials attributed the low risk rating to the completion of associated projects in November 2014 that previously had not performed as expected. They added that the investments were being continually reviewed by SBA’s CIO and the Executive Steering Committee. The third investment rated moderately high risk from September 2014 through February 2015 was the Office of the CIO IT Infrastructure investment. SBA officials said that the moderately high-risk rating of this investment was due to a delay in data center consolidation efforts that resulted from a lack of funding. SBA officials stated that they had not conducted any additional TechStat reviews since the one held in 2011, explaining that under the previous CIO’s management, it had been decided that the agency would leverage other oversight and governance efforts for all of its IT investments. These efforts included discussing the overall performance of investments and prescribing action items when warranted to help ensure investments were on schedule, within budget, and meeting defined metrics. SBA said that as warranted, it would hold formal TechStat sessions in the future for underperforming IT investments. Operational analysis of IT investments. OMB guidance calls for agencies to develop a policy for examining the ongoing performance of existing IT investments to measure, among other things, whether the investment is continuing to meet business and customer needs and is contributing to meeting the agency’s strategic goals. The policy is to require annual operational analyses of the agency’s investments that address costs, schedules, customer satisfaction, strategic and business results, financial goals, and innovation. SBA officials said that operational analysis reports had not been prepared but that the CIO reviewed the investments in SBA’s portfolio every month. They added that the agency had focused on ensuring that investments were up-to-date and providing the accurate risk status, schedule, cost, and performance metrics for each. Although SBA officials told us that the agency’s operational investments were reviewed periodically, the 2014 reviews were not documented according to OMB guidance. As a result, we could not evaluate the extent to which the reviews followed OMB guidance for operational analyses. Agency officials also said that they planned to conduct an analysis on each investment in fiscal year 2015. However, as of July 2015, no such analyses had been documented. Until SBA ensures that all its existing investments are fully assessed and that all reviews are appropriately documented, it will not be able to determine whether its IT investments are meeting their intended objectives, increasing the risk of inefficient spending. Federal data center consolidation. In February 2010, the Federal CIO established the Federal Data Center Consolidation Initiative to address the growing number of federal data centers. This initiative’s four high-level goals were to reduce the overall energy consumption and real estate footprint of government data centers; reduce the cost of data center hardware, software, and operations; increase the overall IT security posture of the government; and shift IT investments to more efficient computing platforms and technologies. OMB guidance requires SBA and other federal agencies to submit an updated data center inventory that includes 4 elements and a consolidation plan with 13 elements. In July 2011 and July 2012 reports, we found that SBA had developed plans to consolidate its large data centers from four to two by December 2015 but that its inventory and plans for its data centers did not address all the elements required by OMB guidance. Furthermore, OMB guidance required agencies to describe year-by- year investments and cost savings in their 2010 and 2011 consolidation plans. Beginning in August 2013, agencies were to identify and report all cost savings and avoidances related to data center consolidation, among other areas, as part of a quarterly data collection process. In the 2012 report, we found that SBA’s June 2011 update to its inventory and plans included some inventory elements that had been completed and others that had not. Specifically, the update included 2 completed inventory elements (of 4) and 6 plan elements (of 13); 2 partially completed inventory elements and 2 plan elements, and 5 plan elements with no information. SBA officials stated that several missing elements, such as performance metrics, a schedule, and a risk management strategy, had been developed after the plan’s completion. We emphasized the importance of fully implementing the recommendation from our 2011 report that SBA complete the missing elements from its inventories and plans. SBA neither agreed nor disagreed with our recommendation, but has since taken the steps necessary to implement it. PortfolioStat. In March 2012, OMB launched the PortfolioStat initiative, which requires SBA and other federal agencies to conduct an annual agency-wide portfolio review of all their IT investments to, among other things, reduce commodity IT spending and demonstrate how IT investments align with the agency missions and business functions. PortfolioStat is designed to assist agencies in assessing the current maturity of their IT portfolio management process, making decisions on eliminating duplication, and moving to shared services in order to maximize the return on IT investments across the portfolio. OMB established several requirements for agencies in implementing PortfolioStat, including reporting estimated savings and cost avoidances associated with consolidation and shared services initiatives through fiscal year 2015 and completing a final action plan that addressed additional elements. In a November 2013 report on the progress SBA and other agencies had made in conducting PortfolioStat reviews, we found that SBA had held a PortfolioStat review for some IT investments but completed only some of the OMB requirements for conducting the reviews. Specifically, SBA had designated a PortfolioStat lead, completed an IT portfolio survey, held a PortfolioStat meeting, completed two migration efforts, and reported lessons learned. The agency reported that it had identified six PortfolioStat initiatives, of which four had resulted in cost savings of about $800,000. However, SBA had not completed its commodity IT baseline because it had not identified a process for ensuring the completeness of the baseline information. Additionally, SBA had not completed an action plan with all the required elements. Specifically, while its plan fully addressed four elements, it partially addressed three, and did not address one. We recommended that the agency take two actions: (1) develop a complete commodity IT baseline and (2) fully describe the required PortfolioStat action plan elements in future reporting to OMB. SBA did not agree nor disagree with our recommendations, but SBA officials told us that as of May 2015, they had begun to take steps to address them. For example, SBA officials told us that the agency had procured tools that would help it develop its commodity IT baseline and that it was reporting to OMB quarterly on the status of its implementation of action plan elements. Cloud computing strategy. In order to accelerate the adoption of cloud computing services across the government, OMB’s 25 Point Plan included a “Cloud First” policy. This policy requires each agency CIO to fully migrate three services by June 2012 to an Internet-based cloud service providing computing services and resources, and implement cloud services whenever a secure, reliable, and cost- effective cloud option is available. Building on this requirement, in February 2011, OMB issued the Federal Cloud Computing Strategy, which provided definitions of cloud computing services; benefits of the services, such as accelerating data center consolidations; case studies to support agencies’ migration to cloud computing; and roles and responsibilities for federal agencies. In a July 2012 report, we found that SBA had implemented one cloud- based computing service by OMB’s deadline of June 2012, and an additional two by the end of 2012, but that the agency’s plans for doing so lacked estimated costs and performance goals. In addition, the agency had not developed any plans for additional cloud- based services. We recommended that SBA establish estimated cost and performance goals for additional cloud-based services and that it develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for additional cloud-based services. SBA officials responded that the agency would work to implement the recommendations. In May 2015, SBA officials told us that they were continuing to implement the agency’s cloud computing strategy and that they were in the early stages of implementing a cloud e-mail solution to replace the agency’s legacy e-mail system. In addition, in September 2014, we evaluated SBA’s progress in implementing cloud services and the extent to which it had experienced cost savings in light of OMB guidance that called for agencies to assess all IT services for migration to a cloud service irrespective of the investment’s age. SBA had not assessed a majority of its IT investments for cloud computing services. We recommended that SBA direct its CIO to ensure that all IT investments be assessed for suitability for migration to a cloud computing service and establish evaluation dates for each investment. SBA officials concurred. In June 2015, SBA officials told us that they had revised their SOP in response to the recommendation and that they discussed cloud computing options at each investment review. However, SBA did not document these discussions, so it is not clear the extent to which they addressed the factors required by OMB. Software licensing management. Two executive orders address the effective management of agency software licenses. Executive Order 13103 requires that federal agencies adopt policies and procedures to ensure that only computer software not in violation of copyright laws is being used. In addition, Executive Order 13589 promotes efficient spending at federal agencies to include assessments of inventories of current devices and their usage and the establishment of controls to ensure that agencies are not paying for unused or underused IT equipment, installed software, or services. In our May 2014 report on the management of software licenses across the federal government, including the extent to which SBA and other federal agencies had developed appropriate policies on software management licensing and were adequately managing licenses for their software, we found that SBA had not addressed all of the seven elements of a comprehensive license policy and had not implemented all five of the leading initiatives for managing software licenses. Specifically, SBA did not have any SOPs or a general policy to manage all software licenses agency-wide and had only partially addressed two out of the five leading initiatives for managing software licenses. We recommended that SBA implement six actions to ensure the effective management of its software licenses. SBA neither agreed nor disagreed with our recommendations, but SBA officials told us that as of June 2015, they had started taking actions to address some of them. For example, SBA officials told us that they had drafted a software licensing policy that was under review and were working on a software license inventory. While these are positive initial steps, until SBA fully implements our recommendations on software management, it lacks assurance that it can cost- effectively manage its software. SBA is a relatively small agency with a large mission—to help Americans start, build, and grow small businesses by overseeing programs that provide tens of billions of dollars in support to these enterprises. To fulfill this important role, it is essential that SBA better plan and oversee several of its key management areas across the agency. For example, SBA has developed an agency-wide strategic plan that meets all GPRAMA requirements on the process used to develop the plan and all but one requirement on the contents of the plan. SBA’s plan only partially meets the requirement that the agency describe how it used program evaluations in setting strategic goals and include a schedule of evaluations planned. In addition, although GPRAMA aims to ensure that agencies use performance information in decision making and OMB has encouraged agencies to improve government effectiveness by increasing their use of evidence and rigorous program evaluation in making budget, management, and policy decisions, SBA has a poor track record of conducting program evaluations and told us it has limited resources to conduct them. However, conducting more program evaluations could help SBA assess program effectiveness and learn how to improve program performance. In addition, relying on program evaluations to help set strategic objectives could better enable SBA to assess the appropriateness and reasonableness of its goals and objectives and the effectiveness of the strategies used to meet them. Further, SBA faces ongoing challenges in several key management areas, including workforce planning and training and development. SBA currently does not have a workforce plan that fully addresses key principles—including conducting and acting upon a competency and skill gap assessment and developing a long-term strategy to address its skills imbalance. As a result, it cannot provide reasonable assurance that its workforce has the skills needed to effectively administer the agency’s programs and meet the agency’s mission and strategic goals. Similarly, SBA lacks a strategic approach to its training and development programs, such as incorporating goals and measures and input on employee development goals in its training plan. Without such an approach, SBA cannot establish priorities in its training initiatives or address skill gaps to help ensure that employees can effectively deliver programs and meet SBA’s strategic objectives. Changes to SBA’s organizational structure have contributed to the agency’s skill gaps and, in some cases, have affected program oversight. Federal internal control standards state that an agency’s organizational structure should clearly define key areas of authority and responsibility and establish appropriate lines of reporting. SBA committed in 2012 to revising its organizational structure and planned some workforce restructuring related to its most recent voluntary retirement program. However, SBA had not documented efforts to assess its organizational structure as of August 2015 or completed its workforce restructuring as of June 2015. Until it documents its examination of its structure and any findings, SBA will not have an institutional record of its actions. Thus, it will be difficult for SBA to provide reasonable assurance, or for a third party to validate, that SBA’s current organizational structure contributes effectively to its mission objectives and programmatic goals. SBA has initiated efforts to identify and manage risks facing the agency at an enterprise level. However, SBA lacks documentation on its progress and future plans required by federal internal control standards and has not incorporated elements of our risk management framework, such as including goals or specific actions. Without identifying and documenting the steps that it plans to take to implement its risk management process and incorporating the elements of our framework, SBA cannot provide reasonable assurance that its efforts effectively identify, assess, and manage risks before they adversely affect SBA’s ability to achieve its mission. SBA also faces challenges in managing and maintaining adequate records. We found that many of its SOPs were outdated and did not reflect program and operating changes. The lack of up-to-date guidance can affect program delivery. Internal control activities, such as establishing the policies, procedures, and techniques for SBA programs and maintaining them through periodic updates, are essential mechanisms that help ensure that management’s directives are carried out. Without setting time frames to help ensure that SOPs are properly maintained and periodically updated, it will be difficult for SBA to hold managers accountable for completing them as intended and to demonstrate progress in doing so. Moreover, without updated SOPs, agency staff may lack clear guidance and therefore may not effectively deliver program services in accordance with laws and regulations. Finally, SBA has taken steps to implement aspects of several key IT management initiatives. However, the agency has not developed a policy for conducting regular operational analyses of all of its investments. SBA officials told us that all IT investments were reviewed regularly but could not provide documentation of recent assessments. Without these analyses, SBA cannot provide reasonable assurance that it is effectively managing its IT investments so that they meet the agency’s mission and goals, increasing the risk of inefficient spending on IT investments. In addition, as SBA begins to implement new systems intended to improve agency operations such as SBA One, fully applying accepted IT management initiatives to its efforts will be important. Otherwise, SBA risks them not meeting cost, schedule, or capability goals. We make the following eight recommendations to improve management of the Small Business Administration. 1. To ensure that SBA assesses the effectiveness of its programs, we recommend that the SBA Administrator prioritize resources to conduct additional program evaluations. 2. To ensure that SBA fully meets GPRAMA requirements, we recommend that the SBA Administrator use the results of additional evaluations it conducts in its strategic planning process and ensure the agency’s next strategic plan includes required information on program evaluations, including a schedule of future evaluations. 3. To improve SBA’s human capital management, we recommend that the SBA Administrator complete a workforce plan that includes key principles such as a competency and skill gap assessment and long- term strategies to address its skill imbalances. 4. To improve SBA’s human capital management, we recommend that the SBA Administrator incorporate into its next training plan key principles such as goals and measures for its training programs and input on employee development goals. 5. To ensure that SBA’s organizational structure helps the agency meet its mission, we recommend that the SBA Administrator document the assessment of the agency’s organizational structure, including any necessary changes to, for example, better ensure areas of authority, responsibility, and lines of reporting are clear and defined. 6. To ensure that SBA can effectively identify, assess, and manage risks, we recommend that the SBA Administrator develop its enterprise risk management consistent with GAO’s risk management framework and document the specific steps that the agency plans to take to implement its enterprise risk management process. 7. To improve SBA’s program and management guidance, we recommend that the SBA Administrator set time frames for periodically reviewing and updating its SOPs as appropriate. 8. To help ensure that SBA’s IT operations and maintenance investments are continuing to meet business and customer needs and the agency’s strategic goals, we recommend that the SBA Administrator direct the appropriate officials to perform an annual operational analysis on all SBA investments in accordance with OMB guidance. We requested comments from SBA on a draft of this report, and the agency provided written comments that are presented in appendix V. SBA stated that overall it generally agreed with our recommendations. In response to our recommendation that the SBA administrator complete the assessment of the agency's organizational structure and make any necessary changes, SBA concurred but noted that the agency had initiated a full review of its organizational structure shortly after the current administrator was confirmed in April 2014. SBA noted that the agency had recently completed that review and determined that major restructuring was not warranted at the time. However, SBA has not provided us with any documentation of its assessment, either during the course of our review or when it provided comments on a draft of this report. Therefore, we revised the recommendation to clarify that SBA document its assessment, including the results and any changes. In response to our two recommendations that SBA conduct additional program evaluations and use the results in its strategic planning process, SBA generally agreed with our recommendations but noted that it would face challenges in implementing them. Specifically, SBA stated that it was currently restricted from collecting data on small businesses from some resource partners. Further, SBA said that it did not have adequate information collection systems for some programs that could house and assess the data needed for evaluations. SBA also noted that independent evaluation studies consistent with OMB and GAO preferred methodologies would be costly. As a result, SBA said its ability to satisfy the recommendations would depend, at least in part, on the agency's ability to receive funding for them or find other viable evaluation methods. SBA stated that in prior years the agency had requested additional funding to conduct independent evaluations but had not received it. The agency agreed with our two recommendations related to SBA’s human capital management, adding that a workforce plan was under development that would address the need for competency and skills gap analysis and that contained strategies to address skill imbalances through recruitment and training. SBA also noted that its projected analyses would include goals and measures for training and development. SBA added that it had procured a contractor to perform a competency gap analysis and that additional contractor support would allow for a final draft of a workforce plan in early fiscal year 2016. SBA agreed with our recommendation regarding the agency’s enterprise risk management process. SBA said that the agency was working to document its process, which is to include aspects of various available frameworks, including those published by GAO, the Committee of Sponsoring Organizations of the Treadway Commission, and the International Organization for Standardization. Further, SBA agreed with our recommendation on updating SOPs. In its comment letter, SBA noted that the agency was conducting annual reviews of SOPs and working to streamline the clearance process for the publication of new and updated SOPs. However, as we stated in the report, SBA’s most recent effort to review its SOPs began in fiscal year 2014, and in most cases the results did not include projected completion dates for revising or canceling old SOPs or creating new ones. SBA also concurred with our recommendation on performing an annual operational analysis on all SBA IT investments in accordance with OMB guidance. SBA also provided several technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to SBA and appropriate congressional committees. This report also will be available at no charge on our website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. This report examines the extent to which the U.S. Small Business Administration (SBA) (1) has addressed previously identified management challenges related to specific programs, including those related to internal controls; (2) is following federal requirements for strategic planning; (3) is following key principles or internal controls for human capital management, organizational structure, enterprise risk management, acquisition management, and procedural guidance; and (4) is making progress in implementing the Office of Management and Budget’s (OMB) high-priority management practices for information technology. For the background, we analyzed data on staffing levels at headquarters, regional, and district offices in fiscal year 2014. To assess the reliability of these data, we interviewed SBA officials from the Office of Human Resources Solutions to gather information on the completeness and accuracy of the full-time equivalent database and examined the data for logical inconsistencies and completeness. We determined that the data were sufficiently reliable for the purposes of reporting on staffing levels. To address our objectives, we reviewed relevant federal laws and regulations and interviewed SBA officials, including headquarters officials, all 10 regional administrators, management and nonmanagement staff at 10 district offices, and union representatives. We interviewed headquarters officials within the following SBA offices: Capital Access, Entrepreneurial Development, Government Contracting and Business Development, Disaster Assistance, Performance Management and Chief Financial Officer, Field Operations, and Human Resources Solutions. To obtain perspectives from SBA district office officials on our objectives, we selected a purposive sample of 10 of the 68 district offices, 1 from each SBA region to provide national coverage. We randomly selected 7 of the 10 district offices from those offices located within the continental United States. We selected the Washington, D.C., and Georgia district offices to pre-test our interview questions because of proximity to GAO offices. We selected the New York district office to include an additional large office to ensure a variety of offices with both a larger and smaller number of employees. During our on-site meetings at the 10 district offices, we interviewed managers such as district directors and deputy district directors at each location. For our interviews with nonmanagement staff at the 10 district offices, district office management invited any interested nonmanagement staff to meet with us. However, SBA required the presence of district counsel during these interviews. Participation by nonmanagement staff members in the interviews was limited. Specifically, out of approximately 120 nonmanagement employees in the 10 district offices that were invited to speak with us, a total of 28 employees attended the interviews. To allow any nonmanagement staff who did not participate in our on-site interviews an additional opportunity to share their thoughts on our objectives, we sent an e-mail to all nonmanagement staff at those 10 district offices, inviting them to share their thoughts on specific topics with us by sending an e-mail to a specified GAO e-mail address. Nine staff members responded to our e-mail and provided us with information. The results of our interactions with the 10 district offices cannot be generalized to other SBA district offices. The union representatives we interviewed were from headquarters and the field. To assess the status of SBA’s management challenges related to specific programs, we reviewed annual SBA Office of the Inspector General (OIG) reports on SBA management challenges for fiscal years 2000 through 2015 (the years for which reports were available on the SBA OIG’s website). We reviewed the challenges noted in the fiscal year 2015 report, including the fiscal year in which each challenge was first reported by the OIG. We also reviewed GAO reports issued during this time frame to identify those which dealt with SBA management challenges. Finally, we reviewed information from GAO’s system for tracking agency recommendations to determine which recommendations made to SBA in fiscal years 2010 through 2013 remained open. To evaluate SBA’s strategic planning efforts, we reviewed relevant SBA documents such as its Strategic Plan Fiscal Years 2014-2018 and Fiscal Year 2016 Congressional Budget Justification and Fiscal Year 2014 Annual Performance Report. We compared SBA’s strategic planning and reporting practices with requirements in the Government Performance and Results Act of 1993 (GPRA), as updated by the GPRA Modernization Act of 2010 (GPRAMA). Specifically, we first identified GPRA and GPRAMA requirements related to the elements that must be included in a federal agency’s strategic plan, such as a mission statement and goals and objectives, and requirements related to the strategic planning process, such as obtaining stakeholder input. We then reviewed SBA’s strategic plan to determine whether it included the required elements and interviewed SBA officials to determine the process SBA used to develop the strategic plan. We assessed the extent to which SBA met each requirement using three categories. “Met” indicates that, in our judgment, SBA met all or mostly all aspects of the requirement. “Partially met” indicates that it met some but not all or mostly all aspects of the requirement. “Not met” indicates that it did not meet the requirement. Specifically, one GAO analyst identified the strategic planning requirements, reviewed SBA’s practices, and made the initial assessment for each requirement reviewed. A second analyst then verified each of these steps to ensure consistent results. To assess SBA’s human capital management practices, we reviewed SBA documents such as its Strategic Human Capital Plan Fiscal Years 2013-2016, Annual Training Plan (Talent Development Initiative) Fiscal Year 2014-2015, two assessments of its training programs, and standard operating procedures (SOP). We also reviewed SBA’s 2014 Federal Employee Viewpoint Survey results on training and employee performance management. To assess the reliability of these data, we reviewed the methodology used to conduct the survey and SBA’s response rate. We determined that the data we used were sufficiently reliable for the purposes of reporting on employees’ perspectives on training offered by SBA and on SBA’s employee performance management system. In addition, we reviewed a list of individuals who had served in senior-level positions at SBA from calendar years 2005 through 2015 (the years for which information on all these positions was available) and determined the number of individuals who served in each position during this time frame. We also compared SBA’s human capital practices in the areas of workforce planning and training with key principles identified in our previous work. Specifically, we reviewed SBA’s human capital documents and interviewed SBA officials to determine SBA’s workforce planning and training practices. We then assessed the extent to which SBA followed each key principle, again using three categories. “Follows” indicates that, in our judgment, SBA was following all or mostly all aspects of the principle. “Partially follows” indicates that it was following some but not all or mostly all of the aspects of the principle. “Does not follow” indicates that it was not following any aspects of the principle. Specifically, one GAO analyst reviewed SBA’s policies and practices and made the initial assessment. A second analyst then verified these steps to ensure consistent results. Because SBA was in the process of updating the SOP on its employee performance management system, we were unable to conduct an assessment of SBA’s employee performance management system to determine whether it was consistent with key principles in employee performance management that we identified in a 2003 report. Instead we reviewed a set of critical elements and performance standards used to evaluate employee performance. Specifically, we reviewed critical elements and performance standards for the following managers and employees in the field: regional administrators, district directors, deputy district directors, economic development specialists, business opportunity specialists, and lender relations specialists. We requested these because they are the elements and standards for the staff whom we interviewed during our site visits. In addition, we reviewed one set of generic critical elements and performance standards for SBA employees and one set for SBA managers. SBA officials stated that they could not provide data on the total number of critical elements because the elements are tracked on an individual basis and not across the agency. To review SBA’s organizational structure, we reviewed prior GAO and SBA OIG reports that discussed, among other things, the effect of the agency’s structure on its human capital management and program oversight. We also examined documentation on changes to SBA’s organizational structure from fiscal year 2005 to 2014 (the period after SBA’s last major reorganization in 2004). Specifically, we requested and reviewed all of the forms that SBA used to document organizational changes that were approved during this period. We also reviewed documentation on SBA’s planned efforts to assess its organizational structure—including its Strategic Human Capital Plan Fiscal Years 2013- 2016, guidance implementing its fiscal year 2014 Voluntary Early Retirement Authority (VERA) and Voluntary Separation Incentive Payments (VSIP) programs, and the statement of work for a contractor’s assessment of organizational structure—and compared these plans to federal internal control standards and guidance related to organizational structure. To evaluate SBA’s risk management, we compared SBA’s enterprise risk management practices with GAO’s Standards for Internal Control in the Federal Government and risk management criteria on elements of risk management. Specifically, we reviewed SBA’s limited documentation on its enterprise risk management process and implementation plans for each step of the process and then assessed the extent to which SBA’s process was consistent with the stages of our risk management framework, again using three categories. “Follows” indicates that, in our judgment, SBA was following all or mostly all aspects of the practice. “Partially follows” indicates that it was following some but not all or mostly all of the aspects of the practice. “Does not follow” indicates that it was not following any aspects of the practice. For acquisition management, we reviewed (1) data on SBA contracts awarded to small businesses from Small Business Goaling Reports for fiscal years 2011-2013 to assess whether SBA met contracting goals in the last 3 years and (2) SBA contract obligations for fiscal year 2014 as reported in the Federal Procurement Data System-Next Generation to determine types of spending. To assess the reliability of these data, we reviewed documentation on the data and assessed them for consistency and completeness. We determined that the data were sufficiently reliable for the purposes of reporting on SBA’s contracting efforts. We also reviewed recent SBA OIG reports on SBA’s acquisition management (including whether the agency’s practices align with guidelines developed by OMB). In addition, we examined SBA’s efforts to improve its acquisition management, including reviewing documentation of its 2014 contract with an outside entity to conduct an assessment of SBA’s acquisition function to determine the scope and methodology of that review. We also reviewed documentation of the results of that assessment. For procedural guidance, we asked SBA to provide us with an inventory of all current SOPs, including the dates of the most recent revisions. In July 2014, SBA provided a list of SOPs maintained on the agency’s internal website. We also reviewed the agency’s external website and found additional SOPs, identifying a total inventory of 153 internal and external SOPs. We reviewed this inventory of SBA’s SOPs to determine when they were last updated and compared SBA’s guidance to federal internal control standards to determine if it met the standards for documentation. We also reviewed documentation related to SBA’s fiscal year 2014 efforts to conduct an assessment of the status of all SOPs across the agency. In fiscal year 2014, SBA’s Office of the Chief Operating Officer, Office of Administrative Services began a review of the status of all SOPs, working with the program offices to determine whether any updates were needed. SBA issued a notice requiring all office heads to certify in writing the status of their SOPs. For each SOP, the cognizant office was to note whether (1) it did not require any revision, (2) it was under review, (3) it was being revised, or (4) it was being canceled. If an SOP was deemed to fall within one of the last three categories, the office was to provide the date by which the action would be completed. As a result of that review, SBA created a spreadsheet that flagged some SOPs as outdated and some for cancelation. We reviewed SBA’s spreadsheet to determine the number of SOPs that needed to be revised, canceled, or required no revision. To assess SBA’s progress in implementing high-priority management practices for information technology (IT), we evaluated SBA’s progress on six OMB IT initiatives. We used the relevant sections of recent GAO reports to report on SBA’s efforts on the initiatives, interviewed SBA officials about recent steps that they have taken to implement them, and analyzed SBA TechStat documentation to determine when past TechStat sessions were held and to identify the outcomes of the reviews. We reviewed SBA’s ratings on the IT Dashboard to determine if SBA had held a TechStat for the at-risk investments. To corroborate the data reliability of those ratings, we interviewed SBA officials to determine their process for collecting, updating, and maintaining the data and asked them to verify the data’s completeness and accuracy. We determined that the data were sufficiently reliable for the purposes of reporting on TechStat reviews of at-risk investments. We analyzed SBA’s operational analyses to determine if, within the past year, the agency had performed such analyses on all of its major IT investments in the operations and maintenance phase. We conducted this performance audit from March 2014 through September 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In this appendix, we provide additional information on the Small Business Administration’s (SBA) budget from fiscal year 2004 through fiscal year 2016 (requested). Specifically, table 6 provides information on total obligations, net outlays, and gross budget authority agency-wide. In addition, table 7 breaks down these amounts according to Office of Management and Budget (OMB) accounts. Finally, figure 8 compares the gross budget authority amounts by OMB account to the total gross budget authority for each of these fiscal years. As of July 2015, 69 of the recommendations that we have made to the Small Business Administration (SBA) were open. See table 8 for a list of these open recommendations by subject area. In fiscal year 2014, the Small Business Administration’s (SBA) Office of the Chief Operating Officer, Office of Administrative Services began a review of the status of all standard operating procedures (SOP), working with the program offices to determine whether any updates were needed. Specifically, SBA issued a notice requiring all office heads to certify in writing the status of their SOPs. For each SOP, the cognizant office was to note if it (1) did not require any revision, (2) was under review, (3) was being revised, or (4) was being canceled. As a result of this review, SBA determined that 74 SOPs needed to be revised (see table 9); 31 needed to be canceled (see table 10); and 60 required no revision (see table 11). SBA also determined that it needed to issue an additional 9 new SOPs (see table 12). In addition to the contact named above, David Powner (Director), A. Paige Smith (Assistant Director), James Sweetman, Jr. (Assistant Director), Deena Richart (Analyst-in-Charge), Gerard Aflague, Emily Chalmers, Elizabeth Curda, Pamela Davidson, Nancy Glover, Meredith Graves, Kaelin Kuhn, John McGrail, Marc Molino, Erika Navarro, Meredith Raymond, William Reinsberg, and Gloria Ross made key contributions to this report.

Summary: SBA has provided billions of dollars in loans and guarantees to small businesses. As of March 31, 2015, SBA’s total loan portfolio was about $116.9 billion, including $110.3 billion in direct and guaranteed loans and $6.6 billion in disaster loans. GAO has previously reported on management challenges at SBA. GAO was asked to review SBA management, including whether those challenges were ongoing. This report discusses SBA’s efforts to address management challenges related to specific programs and internal controls. It also looks at challenges in strategic planning, human capital, organizational structure, enterprise risk, procedural guidance, and IT. To do this work, GAO reviewed SBA policies and compared them with federal requirements, key principles for human capital management, and internal control standards. GAO also interviewed officials at SBA headquarters, all 10 regional offices, and 10 of 68 district offices selected on the basis of location and size. The Small Business Administration (SBA) has not resolved many of its long-standing management challenges due to a lack of sustained priority attention over time. Frequent turnover of political leadership in the federal government, including at SBA, has often made sustaining attention to needed changes difficult (see figure below). Senior SBA leaders have not prioritized long-term organizational transformation in areas such as human capital and information technology (IT). For example, at a 2013 hearing on SBA's budget, the committee Chairman stated that SBA's proposed budget focused on the agency's priorities but ignored some long-standing management deficits. This raises questions about SBA's sustained commitment to addressing management challenges that could keep it from effectively assisting small businesses. Many of the management challenges that GAO and the SBA Office of Inspector General (OIG) have identified over the years remain, including some related to program implementation and oversight, contracting, human capital, and IT (see figure below). SBA has generally agreed with prior GAO recommendations that were designed to address these issues and other challenges related to the lack of program evaluations. The agency has made limited progress in addressing most of these recommendations but has recently begun taking some steps. A senior SBA official told us that improving human capital management, IT, and the 8(a) program (a business development program) were priorities for the new administrator. For example, he stated that SBA was exploring creative ways to recruit staff and plans to expand SBA One—a database currently used to process loan applications—to include the 8(a) program. Also, SBA has begun addressing some internal control weaknesses that GAO and the SBA OIG identified as contributing to the agency's management challenges. SBA officials noted that the agency had begun to update its standard operating procedure (SOP) on internal controls and planned more revisions after the Office of Management and Budget (OMB) updated its Circular A-123, which is expected to include guidance on implementing GAO's 2014 revisions to federal internal control standards. OMB issued a draft of the revised circular in June 2015 and is reviewing comments it received. GAO makes eight new recommendations designed to improve SBA's program evaluations, strategic and workforce planning, training, organizational structure, ERM, procedural guidance, and oversight of IT investments. SBA generally agreed with these recommendations and provided additional context. In response, GAO clarified one of its recommendations. GAO also maintains that 69 recommendations it made in prior work have merit and should be fully implemented.