SBA’s need to monitor activities of lenders that help deliver its programs has increased significantly in recent years. One reason is that the reported volume of loans processed by lenders almost doubled between 1992 and 1997, from about $24 billion to about $46 billion. A second reason is that SBA shifted to lenders the responsibility for key loan origination, servicing, and liquidation functions during this same time period. In 1993, SBA district offices reviewed the creditworthiness of about 84 percent of lenders’ requests for loan guarantees, with the remainder being processed under a preferred lender program. At that time, SBA also serviced and liquidated all loans that went into default. By 1997, preferred lenders processed about 52 percent of the loans and, starting in 1998, lenders became responsible for servicing and liquidating all loans they make under the 7(a) program, which constitutes about 80 percent of SBA’s loan portfolio. To improve its ability to monitor lenders’ loan servicing and liquidation actions, SBA asked for $18 million in its fiscal year 1998 budget request. According to SBA, these funds were to be used for (1) recruiting expertise in lender oversight, (2) establishing financial performance goals for private-sector partners, (3) creating a database for lender and portfolio management, and (4) developing an information system for timely and accurate reporting to agency management. “perform and complete the planning needed to serve as the basis for funding the development and implementation of the computerized loan monitoring system, including— (1) fully defining the system requirement using on-line, automated capabilities to the extent feasible; (2) identifying all data inputs and outputs necessary for timely report generation; (3) benchmark loan monitoring business processes and systems against comparable industry processes and, if appropriate, simplify or redefine work processes based on these benchmarks; (4) determine data quality standards and control systems for ensuring information accuracy; (5) identify an acquisition strategy and work increments to completion; (6) analyze the benefits and costs of alternatives and use to demonstrate the advantage of the final project; (7) ensure that the proposed information system is consistent with the agency’s information architecture; and (8) estimate the cost to system completion, identifying the essential cost element.” The act also required SBA, within 6 months of enactment, to submit a report to the Congress and to us on its progress in carrying out these mandated actions. As required, SBA submitted its report on June 2, 1998. We were required by the act to evaluate and report on SBA’s compliance with the act within 28 days of receipt of SBA’s report. On June 30, 1998, we reported that SBA had formed a team for the loan monitoring system in December 1997, but it had not yet completed any of the eight mandated actions. We noted that SBA’s report included a project plan, laying out its approach for addressing these actions. Work on the first of the required planning actions was begun in May 1998 and, according to the project plan, SBA will complete work on the last of the eight mandated actions in August 1999. In conducting our review, we analyzed SBA’s systems development and related information resources management policies and procedures, reviewed SBA’s activities to prepare for undertaking the required planning actions, and reviewed and analyzed SBA’s June 2, 1998, report to the Congress on its progress in carrying out the eight required actions that was issued pursuant to the Small Business Reauthorization Act of 1997. Our work was performed from December 1997 through June 1998, in accordance with generally accepted government auditing standards. SBA’s project plan provides information in many key areas to explain how it intends to complete the mandated actions. The plan delineates the project’s goals and objectives, resource requirements, quality standards and control systems, assumptions, methodologies, work breakdown structure with a timetable for completion of tasks, and estimated costs. SBA established four goals for the loan monitoring system project: Have high-quality, timely data necessary to perform roles such as the management of risk, collection of fees from recipients, and reporting to internal and external entities. Enforce uniform practices for loan making and reporting that will result in equal access by all eligible small businesses. Have business processes that support a streamlined workforce, use appropriate work flows, use best practices of both the government and private sectors, and include the ability to cope with both upward and downward changes in demand and resource availability. Have a computer infrastructure that supports efficient and user friendly information exchanges within SBA and among SBA and external entities, and that can enhance SBA’s program delivery and its ability to carry out its oversight functions. According to the project plan, SBA’s strategy for achieving these goals is to build on “best industry practices,” reengineer inefficient business processes, and implement contemporary technologies. In support of these goals, SBA also established objectives for the loan monitoring system; they include the following functionality: on-line update by lenders of disbursements, payments, unilateral servicing actions, and requests for SBA approvals, as necessary; waiting-to-be-processed queues for action by service center personnel; electronic (digital) signatures to identify and verify who takes and electronic notification of actions via external e-mail or lender notification on-line exception reporting to notify SBA of potential problems, such as “neglected” loans, poor credit analysis, and slow lender servicing or reporting; data analysis tools for management information, such as lender and loan trend identification, and end-user query and reporting; a centralized electronic file to replace on-site paper loan folders; integrated interactive voice response allowing borrowers and lenders to receive status data; on-line electronic collateral file with a centralized storage site for paper centralized, automated generation of uniform commercial code filing expanded use of auto-dial for collections; and sophisticated industry models to analyze and manage credit risk and portfolio performance. SBA included estimates of the personnel resources that it would need to execute the project plan. It estimated that 18 staff would be needed for the first phase of the project, which addresses the completion of the mandated actions, and that an additional three staff would be needed for the development phase. The project plan also describes the types of skills needed—such as programming, systems architecture, and database administration—to manage and execute the project. To address the quality standards and controls to be used for the loan monitoring system project, the plan includes work elements to establish systems development standards and procedures and process change control procedures. The plan also describes the quality control process that SBA plans to use to identify compliance with standards, and defines how the compliance findings will be reported. The plan recognizes that the project includes a number of assumptions that may affect its success. It identifies seven key assumptions that SBA made but will need to validate during the project. For example, SBA assumed that the agency’s information technology architecture will be completed before it is needed to support this project, and that agreements with benchmarking partners will be timely and structured to meet SBA’s needs. The project plan also cites the methodologies that SBA plans to use or is considering for key areas of the project. These include methodologies for project planning and management, benchmarking, reengineering, systems development, software acquisition, risk management, and development of an information technology architecture. In some areas, such as software acquisition, SBA is comparing its current methodologies with industry best practices to select the methodologies that will be used for the project. In other areas, such as benchmarking, SBA did not have a methodology; it has now either selected a new methodology or is in the process of selecting one for these areas. Included in the project plan is a work breakdown structure that lists the work elements from the start of the project through completion. These elements include the individual steps necessary to complete the mandated actions and the steps planned for the subsequent system design, development or acquisition, and implementation. The work elements for completing the mandated actions are sequenced, beginning with benchmarking and ending with the identification of an acquisition strategy to support a make-or-buy decision. The project plan recognizes that the project will not have enough information to fully evaluate the make or buy issue until it has completed benchmarking, business process reengineering, requirements gathering and analysis, and benefits and costs analyses. According to the project plan, SBA estimates that the loan monitoring system will cost about $20 million to complete. In addition to the automated system, this estimate includes the costs of staffing; developing training; developing lender performance standards; establishing subsidy rate analysis processes; and making infrastructure improvements, such as buying communications hardware and software. The project plan specifies that SBA will refine the cost estimates after the systems requirements have been defined and the alternatives analyzed. While developing the project plan is a good start, SBA must still successfully execute it to complete the eight mandated actions. In executing the plan, SBA will face formidable technical and management challenges and risks, including establishing software project management capability while undertaking its largest information technology project ever; using methodologies and practices for the first time while conducting a large, complex project; and implementing the loan monitoring system project without having an information technology architecture in place. SBA recognizes the need to establish defined processes for software project management and use them on this project. Research by the Software Engineering Institute has shown that defined and repeatable processes for managing software acquisition or development are critical to an organization’s ability to consistently deliver high-quality information systems on time and within budget. These critical management processes include project planning, requirements management, software project tracking and oversight, software quality assurance, software configuration management, and change control management. If SBA cannot implement disciplined software development and acquisition processes for this project, it risks building or buying a system that does not effectively meet its requirements, is delivered late or over budget, or does not perform as specified.