oversight

Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization

Published by the Government Accountability Office on 2012-01-25.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

               United States Government Accountability Office

GAO            Report to the Chairman, Committee on
               Small Business, House of
               Representatives


January 2012
               INFORMATION
               TECHNOLOGY
               SBA Needs to
               Strengthen Oversight
               of Its Loan
               Management and
               Accounting System
               Modernization




GAO-12-295
                                              January 2012

                                              INFORMATION TECHNOLOGY
                                              SBA Needs to Strengthen Oversight of Its Loan
                                              Management and Accounting System Modernization
Highlights of GAO-12-295, a report to the
Chairman, Committee on Small Business,
House of Representatives




Why GAO Did This Study                        What GAO Found
The Small Business Administration             As of October 2011, SBA had completed one of the seven projects and awarded
(SBA) performs a range of significant         contracts for work on three others. However, the projects are experiencing
activities intended to strengthen small       increasing costs and schedule delays. Specifically, according to the most recent
businesses and relies extensively on          project schedule, SBA completed one project in May 2011, 2 months later than
information technology (IT) systems to        planned, and SBA expects five of the remaining six projects to finish between 4
do so. These systems are used to              and 11 months later than the dates reported to Congress. Further, according to
support loan accounting and track             the agency’s most recent report to Congress, dated March 2011, the total cost of
loans through origination, servicing,         the projects increased approximately $5 million since October 2010. SBA plans
and liquidation. SBA has been
                                              to complete the seven IIPs at a total cost of approximately $28 million by July
attempting to modernize these systems
                                              2013.
for several years through its Loan
Management and Accounting System              SBA has inconsistently implemented key information technology management
(LMAS) modernization effort. The most         practices for successfully managing and overseeing its LMAS modernization
recent iteration of this effort is a series   efforts; these practices include software requirements management, risk
of more focused development efforts,          management, IT human capital management, enterprise architecture, and
known as the LMAS-Incremental                 investment management (see table below). For example, SBA appropriately
Improvement Projects (IIP).                   managed changes to IIP requirements, identified risks for three of four active
GAO was asked to describe the status          projects, inventoried existing human capital capabilities, drafted target segment
of SBA’s LMAS modernization effort            architectures, and had the overall direction of the IIP effort approved by an
and determine whether SBA has                 executive review committee. However, it has not fully implemented other key
adequate processes and procedures in          aspects of these practices and policies. For example, it did not validate the
place to manage and oversee its               requirements for one of the ongoing IIPs. Also, the agency did not fully prioritize
LMAS modernization effort. In                 risks related to one IIP or plan to mitigate them. In addition, it did not fully identify
performing this work, GAO reviewed            gaps in project workforce skills, and did not fully implement basic enterprise
cost and schedule reports to Congress         architecture practices, including maintaining and prioritizing its segment
and assessed SBA’s current                    architectures, which provide the modernization details needed to develop and
management of the projects against            implement portions, or segments, of an agency’s IT portfolio. In addition, the cost
best practices and relevant guidance.         baselines approved by SBA’s executive oversight body differ from the projected
What GAO Recommends                           costs reported to Congress 2 months later. Further, there is no evidence that the
                                              projects have approved schedule baselines. These weaknesses in basic
GAO is recommending that the                  management practices make it less likely that SBA will be able to complete the
Administrator of SBA ensure that              projects within the time, budget, and scope parameters originally planned.
appropriate IT management practices
are applied to the projects as                Summary of SBA Implementation of Key IT Management Controls
described in this report and clarify the       IT management control                       Rating
responsibilities of the executive bodies       Software requirements management            Partially implemented
with purview over the LMAS-IIPs and            IT risk management                          Partially implemented
ensure they provide the appropriate
                                               IT human capital management                 Partially implemented
oversight of the projects’ progress.
                                               Enterprise architecture                     Partially implemented
                                               IT investment management                    Partially implemented
                                              Source: GAO analysis of SBA data.

                                              Inconsistencies in SBA’s application of IT management practices occurred, in
                                              part, because it did not provide adequate executive oversight through its
                                              investment management process, even though it is using two executive boards
                                              to oversee the IIPs. While these boards have overlapping responsibilities and
View GAO-12-295. For more information,        lines of authority, several basic oversight responsibilities, including executive
contact David A.Powner at (202) 512-9286 or
pownerd@gao.gov.                              approval of the project’s schedule, were left unaddressed by either body.

                                                                                         United States Government Accountability Office
Contents


Letter                                                                                    1
               Summary                                                                    2
               Conclusions                                                                5
               Recommendations for Executive Action                                       6
               Agency Comments                                                            7

Appendix I     Briefing to the Staff of the House Committee on Small Business             9



Appendix II    Comments from the Small Business Administration                          60



Appendix III   GAO Contact and Staff Acknowledgments                                    63



Table
               Table 1: IIP Initial and Current Expected Completion Dates and
                        Projected Costs                                                   4




               Page i                                      GAO-12-295 Information Technology
Abbreviations

BTIC              Business Technology Investment Council
CMMI              Capability Maturity Model—Integration
COBOL             Common Business Oriented Language
EA                enterprise architecture
EAMMF             Enterprise Architecture Management Maturity Framework
FSAB              Financial Systems Advisory Board
IIP               Incremental Improvement Project
IT                information technology
ITIM              information technology investment management
LAS               Loan Accounting System
L/LMS             Loan and Lending Monitoring System
LMAS              Loan Management and Accounting System
OIG               Office of Inspector General
OMB               Office of Management and Budget
SBA               Small Business Administration
SEI               Software Engineering Institute




This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.




Page ii                                                GAO-12-295 Information Technology
United States Government Accountability Office
Washington, DC 20548




                                   January 25, 2012

                                   The Honorable Sam Graves
                                   Chairman
                                   Committee on Small Business
                                   House of Representatives

                                   Dear Mr. Chairman:

                                   The Small Business Administration (SBA) performs a range of significant
                                   activities intended to strengthen small businesses. To accomplish these
                                   activities, SBA relies extensively on information technology (IT) systems.
                                   Among these are financial systems used to support loan accounting and
                                   track loans through origination, servicing, and liquidation. The loan
                                   systems, collectively called the Loan Accounting System, were
                                   implemented in the 1970s and outsourced to be run on a contractor’s
                                   mainframe hardware. SBA has been pursuing efforts to upgrade and
                                   modernize its financial systems for several years.

                                   The current effort, referred to as the Loan Management and Accounting
                                   System (LMAS) program, dates from 2005 and was a response to
                                   concerns about the age and information security risks of the legacy
                                   system. The effort was intended to result in a single, integrated loan
                                   management and loan accounting solution. However, after an
                                   independent study and two reviews by the Office of Management and
                                   Budget (OMB) raised concerns about SBA’s management of the program,
                                   it was restructured into a series of seven more focused projects with
                                   shorter time frames, referred to as LMAS-Incremental Improvement
                                   Projects (IIP).

                                   As agreed, our objectives were to: (1) describe the status of SBA’s LMAS
                                   modernization effort; and (2) determine whether SBA has adequate
                                   processes and procedures in place to manage and oversee its LMAS
                                   modernization effort.

                                   To describe the status of SBA’s LMAS modernization effort, we analyzed
                                   pertinent LMAS documentation—such as program schedules, plans,
                                   budget justifications, cost and schedule data, reports provided to
                                   congressional committees, and documents provided to OMB—and we
                                   interviewed agency officials. We then compared cost and schedule
                                   information to recently published reports to Congress to determine the
                                   progress to date of the program.


                                   Page 1                                       GAO-12-295 Information Technology
          To determine whether SBA has adequate processes and procedures in
          place to manage and oversee its LMAS modernization effort, we
          evaluated its capabilities to employ the following IT management controls,
          which are critical to the success of a systems modernization effort:
          software requirements management, IT risk management, IT human
          capital management, enterprise architecture, and information technology
          investment management. For each of these controls, we determined how
          SBA applied the practices to the four IIPs for which development efforts
          are complete or in progress or for which contracts had been awarded by
          analyzing pertinent documentation—such as policies, procedures, plans,
          meeting minutes, risk logs, and software requirements, and by
          interviewing agency officials. We then compared the information collected
          to key aspects of federal guidance, best practices, and SBA policies.

          We conducted this performance audit from February 2011 to January
          2012 in Washington, D.C., in accordance with generally accepted
          government auditing standards. Those standards require that we plan
          and perform the audit to obtain sufficient, appropriate evidence to provide
          a reasonable basis for our findings and conclusions based on our audit
          objectives. We believe that the evidence obtained provides a reasonable
          basis for our findings and conclusions based on our audit objectives.


          On November 18, 2011, we transmitted the results of our review to the
Summary   staff of the House Committee on Small Business. This report transmits
          the briefing materials we provided and the recommendations we made to
          the Administrator of SBA. The full briefing materials, including the full
          details on our scope and methodology, are reprinted in appendix I. 1

          In summary, we made the following points:

          As of October 2011, SBA had completed one of the seven LMAS-
          Incremental Improvement Projects, and awarded contracts for three
          others. Specifically, it completed the first project, an upgrade of its internal
          administrative accounting and management system, in May 2011. A
          contract has been awarded for another project—to migrate user
          interfaces from a legacy mainframe platform to SBA’s current web-based


          1
           In comments on the original briefing reprinted in appendix I, officials cited concerns with
          publicly releasing estimates for contracts not yet awarded by SBA. Accordingly, we
          redacted this information from the attached briefing.




          Page 2                                                   GAO-12-295 Information Technology
infrastructure—which is being deployed incrementally. In addition, SBA
has awarded contracts to conduct assessments of work to be done for
two other IIPs—addressing the conversion of code in a legacy mainframe
environment to a nonproprietary platform and a migration of legacy
database systems at its Denver office to its current database
infrastructure. For the three remaining projects, the agency intends to
build off of the work completed as a result of the first four projects
identified earlier in this report. SBA has begun planning for one of these,
and work has yet to begin for the remaining two IIPs.

Even though the agency only received approval to pursue the IIPs in
January 2011, the projects are already experiencing increased costs and
schedule delays. Specifically, according to the most recent project
schedule, dated August 2011, it completed one IIP in May 2011, 2
months later than planned. In addition, the agency expects five of the
remaining six projects to finish between 4 and 11 months later than the
dates reported to Congress in October 2010. Further, according to its
most recent report to Congress, dated March 2011, the total cost of the
IIPs increased approximately $5 million since October 2010, while the
projected individual project cost for each of the seven projects had risen
between approximately 3 and 53 percent. SBA plans to complete the
seven projects at a total cost of approximately $28 million by July 2013,
which is an overall increase of about 22 percent. Table 1 provides details
on the status of the individual projects with contracts awarded.




Page 3                                       GAO-12-295 Information Technology
Table 1: IIP Initial and Current Expected Completion Dates and Projected Costs

                                     Expected                 Expected           Projected cost Projected cost
                                     completion date          completion date     as of October   as of March         Percentage
                                     as of October            as of August              2010 (in      2011 (in        increase in
LMAS-IIP          Current status     2010                     2011                     millions)      millions)   projected costs
Oracle Upgrade Completed in May      March 2011               Completed in May           $8.45           $8.66               2.5%
               2011                                           2011
Migration of      Contract awarded   December 2011            May 2012                     3.32            3.76               13.3
User Interfaces   and work in
                  progress
Migrate to New    Contract awarded   May 2012                 April 2013                   6.05            8.72               44.1
Version of        to conduct
COBOL             assessment
Sybase to        Contract awarded    October 2011             September 2012               2.51            3.11               23.9
Oracle Migration to conduct
                 assessment
                                         Source: GAO analysis of SBA data.



                                         SBA has inconsistently implemented key practices for successfully
                                         managing and overseeing its LMAS modernization efforts; these practices
                                         include software requirements management, IT risk management, IT
                                         human capital management, enterprise architecture, and IT investment
                                         management:

                                         •     Requirements management. SBA appropriately managed changes to
                                               requirements for the two projects for which this process would be
                                               appropriate; however, it did not validate the requirements for one of
                                               the ongoing IIPs. In addition, requirements were not documented for
                                               two of the ongoing projects.

                                         •     Risk management. Risks were identified for three of four active
                                               projects; however, it did not fully prioritize risks related to one IIP or
                                               develop plans to mitigate them.

                                         •     IT human capital management. SBA inventoried existing human
                                               capital capabilities; however, it did not fully identify gaps in project
                                               workforce skills and did not develop strategies to close them.

                                         •     Enterprise architecture. SBA drafted target segment architectures for
                                               the IIPs; however, they have not been approved by the appropriate
                                               officials. In addition, the agency did not fully implement other basic
                                               enterprise architecture practices, including maintaining and prioritizing
                                               its segment architectures.




                                         Page 4                                                   GAO-12-295 Information Technology
              •   IT investment management. The agency had the overall direction of
                  the IIP effort approved by an executive review committee. However,
                  SBA did not address other capital planning requirements for the
                  program, including approving a schedule baseline or reviewing its risk
                  management plan, or provide evidence that it approved the
                  subsequent changes to the budget estimates reported to Congress.

              Inconsistencies in SBA’s application of IT management practices
              occurred, in part, because it did not provide adequate executive oversight
              through its investment management process, even though it is using two
              executive bodies to oversee the projects. While these bodies have
              overlapping responsibilities and lines of authority, several basic oversight
              responsibilities, including executive approval of the project’s schedule,
              were left unaddressed by either body. In addition, the cost baselines
              approved by SBA’s executive oversight body differ greatly from the
              projected costs reported to Congress 2 months later. According to SBA
              officials, additional oversight was provided through undocumented
              meetings and reviews of reports to Congress. These weaknesses in the
              use of basic management practices make it less likely that SBA will be
              able to complete the IIPs within the time, budget, and scope parameters
              originally planned.


              SBA has completed one of the seven IIPs, work is underway on one
Conclusions   other, and contracts have been awarded for two more. However, most of
              the projects are already experiencing individual schedule delays of 4 to
              11 months and an overall cost increase of about 22 percent, which
              increases the risk that SBA will not be able to deliver the projects as
              planned.

              SBA’s likelihood of successfully completing the projects would improve if
              it more consistently applied basic IT management practices. SBA has
              taken a number of steps that are consistent with sound IT management.
              For example, it has identified and validated system requirements and has
              identified system development risks as well as plans to mitigate them, but
              it has not done so consistently for each of its ongoing projects. Also, it
              has taken several actions consistent with sound enterprise architecture
              and human capital management practices, including developing segment
              architectures and identifying staff positions needed to complete the IIPs. It
              has not, however, fully applied other sound practices in these areas,
              including maintaining and prioritizing the segment architectures and
              developing a strategy to meet outstanding human capital needs. Given



              Page 5                                        GAO-12-295 Information Technology
                      that SBA has been unable to successfully complete prior efforts to
                      modernize its loan systems, the consistent use of sound IT management
                      practices will be critical to reducing the risk of its new approach
                      encountering similar difficulties.

                      Weaknesses in executive oversight of the IIPs have contributed to SBA’s
                      inconsistent use of sound IT management practices and increase the
                      likelihood that the projects will experience delays or cost overruns. In
                      particular, its use of two oversight bodies with overlapping responsibilities
                      and lines of authority is likely to lead to continued duplication or gaps in
                      oversight, such as the lack of documented schedule and cost baselines
                      for the projects. The gaps, in particular, make it difficult for SBA to
                      conduct the necessary oversight of project progress. In addition,
                      addressing these weaknesses in executive oversight should result in
                      more effective management of program progress and more timely
                      decisions about adjustments needed to arrest or reverse the schedule
                      delays and cost overruns that have already occurred.


                      To better ensure that the loan management incremental improvement
Recommendations for   projects are completed as planned and provide anticipated capabilities,
Executive Action      we are recommending that the Administrator of SBA direct the Chief
                      Information Officer to ensure that SBA is applying the appropriate
                      information technology management practices to the IIPs. Specifically,
                      SBA should ensure that

                      •   IIP requirements are managed appropriately, including elicitation,
                          documentation, and verification and validation;

                      •   IT risks to the IIPs are adequately managed, including preparing for
                          risk management, identifying and analyzing risks, mitigating risks, and
                          providing executive oversight of risk management activities;

                      •   the human capital necessary for the IIPs is managed appropriately,
                          including the determination of human capital needs, the identification
                          of gaps between current capabilities and needs, the development of a
                          strategy to close those gaps, and the documentation of these
                          activities; and

                      •   the enterprise architecture segments related to the IIPs are managed
                          appropriately, including the development, prioritization, and
                          maintenance of the segments.




                      Page 6                                         GAO-12-295 Information Technology
                  In addition, we recommend that the Administrator of SBA clarify the
                  responsibilities of the executive bodies responsible for the IIPs and
                  ensure they provide the appropriate oversight of the project’s progress.
                  Specifically, these executive bodies should conduct and document
                  executive review and approval of the LMAS modernization’s

                  •   risk management approach;

                  •   target segment architectures; and

                  •   cost and schedule baselines, including ongoing oversight of progress
                      against those baselines.


                  In written comments on the draft of this report, the Small Business
Agency Comments   Administration’s Assistant Administrator, Office of Congressional and
                  Legislative Affairs, stated that SBA generally agreed with our
                  recommendations (see Appendix II). The Assistant Administrator also
                  asked that we clarify two points. First, he stated that the costs of the
                  LMAS modernization had not increased, and that the figures we included
                  from an October 2010 report to Congress included only contractor costs
                  while the figures from a March 2011 report included both contractor and
                  government costs. However, the documents provided by SBA do not
                  specify that the two reports describe different costs. Specifically, while the
                  Congressional letter that requested the October 2010 report asked for
                  “contract costs to date,” it also asked for “future obligations and expected
                  future costs.” Also, the report itself does not state that the future costs
                  include only contractor costs. We used these two reports as sources of
                  cost data for the modernization because they were the only sources
                  available at the time of our initial review. Further, this disagreement on
                  the projected cost of the modernization reinforces the need for an
                  approved cost and schedule baseline that can be used to evaluate
                  program progress, as discussed in our briefing.

                  Second, the Assistant Administrator stated that SBA’s executive oversight
                  bodies reviewed the LMAS modernization’s overall schedule and cost
                  estimates through both formal and informal discussions, including
                  executive-level meetings in August and September 2010. We considered
                  this information in our initial assessment, but do not believe that the
                  records he cites demonstrate that SBA is maintaining current cost or
                  schedule baselines. Our briefing notes the inclusion of initial cost
                  estimates for each of the improvement projects in the August executive
                  discussion. However, we also note that even though SBA reported


                  Page 7                                         GAO-12-295 Information Technology
different cost estimates in subsequent reports to Congress, we did not
find evidence of executive approval of changes to the budget after August
2010. In addition, while the minutes of the August 2010 discussion
include a single estimated completion date for the IIP effort, they do not
specify the estimated completion dates for each project. The minutes of
the September meeting did not include any specific information on the
improvement projects’ costs or schedule. The Assistant Administrator
stated that SBA is considering formalizing the currently-undocumented
reviews. We agree that fully-documenting decisions about the projects’
costs and schedules would improve its ability to manage the improvement
projects. A copy of the Assistant Administrator’s comments are included
as Appendix II.


As agreed with your office, unless you publicly announce the contents of
this report earlier, we plan no further distribution until 30 days from the
report date. At that time, we will send a copy of this report to the
Administrator of SBA. The report will also be available at no charge on
the GAO website at http://www.gao.gov.

If you or your staffs have any questions concerning this report, please
contact me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Contact
points for our Offices of Congressional Relations and Public Affairs may
be found on the last page of this report. GAO staff who made major
contributions to this report are listed in appendix II.

Sincerely yours,




David A. Powner
Director, Information Technology
   Management Issues




Page 8                                        GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
               Appendix I: Briefing to the Staff of the House
               Committee on Small Business



Committee on Small Business




               Page 9                                           GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 10                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 11                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 12                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 13                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 14                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 15                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 16                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 17                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 18                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 19                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 20                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 21                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 22                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 23                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 24                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 25                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 26                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 27                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 28                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 29                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 30                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 31                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 32                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 33                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 34                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 35                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 36                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 37                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 38                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 39                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 40                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 41                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 42                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 43                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 44                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 45                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 46                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 47                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 48                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 49                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 50                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 51                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 52                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 53                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 54                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 55                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 56                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 57                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 58                                          GAO-12-295 Information Technology
Appendix I: Briefing to the Staff of the House
Committee on Small Business




Page 59                                          GAO-12-295 Information Technology
Appendix II: Comments from the Small
              Appendix II: Comments from the Small
              Business Administration



Business Administration




              Page 60                                GAO-12-295 Information Technology
Appendix II: Comments from the Small
Business Administration




Page 61                                GAO-12-295 Information Technology
Appendix II: Comments from the Small
Business Administration




Page 62                                GAO-12-295 Information Technology
Appendix III: GAO Contact and Staff
                  Appendix III: GAO Contact and Staff
                  Acknowledgments



Acknowledgments

                  David A. Powner, (202) 512-9286 or pownerd@gao.gov
GAO Contact
                  In addition to the individual named above, James R. Sweetman, Jr.,
Staff             Assistant Director; Eric Costello; Franklin Jackson; Lee McCracken;
Acknowledgments   Meredith Raymond; Karl Seifert; and Dan Wexler made key contributions
                  to this report.




(311271)
                  Page 63                                   GAO-12-295 Information Technology
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (www.gao.gov). Each weekday afternoon,
GAO Reports and       GAO posts on its website newly released reports, testimony, and
                      correspondence. To have GAO e-mail you a list of newly posted products,
Testimony             go to www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      http://www.gao.gov/ordering.htm.
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
                      Contact:
To Report Fraud,
Waste, and Abuse in   Website: www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548




                        Please Print on Recycled Paper.