Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization

Published by the Government Accountability Office on 2012-02-08.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                              United States Government Accountability Office

GAO                           Testimony
                              Before the Committee on Small Business,
                              House of Representatives

For Release on Delivery
Expected at 1:00 p.m. EST
Wednesday, February 8, 2012

                              SBA Needs to Strengthen
                              Oversight of Its Loan
                              Management and
                              Accounting System
                              Statement of David A. Powner, Director
                              Information Technology Management Issues

Mr. Chairman and Members of the Committee:

I am pleased to participate in today’s hearing on the Small Business
Administration’s (SBA) efforts to modernize its Loan Management and
Accounting System (LMAS). As you are aware, SBA performs a range of
significant activities intended to strengthen small businesses and relies
extensively on information technology (IT) systems to accomplish these
activities. Among these are financial systems used to support loan
accounting and track loans through origination, servicing, and liquidation.
The loan systems, collectively called the Loan Accounting System, were
implemented in the 1970s and outsourced to be run on a contractor’s
mainframe hardware. SBA has been pursuing efforts to upgrade and
modernize its financial systems for several years.

The current effort, referred to as LMAS, dates from 2005 and was a
response to concerns about the age and information security risks of the
legacy system. The effort was intended to result in a single, integrated
loan management and loan accounting solution. However, after an
independent study and two reviews by the Office of Management and
Budget (OMB) raised concerns about SBA’s management of the program,
it was restructured into a series of seven more focused projects with
shorter time frames, referred to as LMAS-Incremental Improvement
Projects (IIP).

You asked us to testify on the status of SBA’s LMAS modernization effort
and whether SBA has adequate processes and procedures in place to
manage and oversee this effort. My statement today is based on our
report, Information Technology: SBA Needs to Strengthen Oversight of Its
Loan Management and Accounting System Modernization, which is being
released today at this hearing. 1 This report summarizes the results of our
study—which specifically describes the status of the modernization effort
and determines whether SBA has adequate process and procedures in
place to manage and oversee its LMAS modernization effort. All work on
which this testimony is based was conducted in accordance with
generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions

 GAO, Information Technology: SBA Needs to Strengthen Oversight of Its Loan
Management and Accounting System Modernization, GAO-12-295 (Washington, D.C.:
Jan. 25, 2012).

Page 1                                                               GAO-12-395T
             based on our audit objectives. We believe that the evidence obtained
             provides a reasonable basis for our findings and conclusions based on
             our audit objectives.

             SBA’s mission is to aid, counsel, assist, and protect the interests of small
Background   business concerns; to preserve free competitive enterprise; and to
             maintain and strengthen the overall economy of the Unites States. One
             way that SBA works to grow businesses is through managing a $90 billion
             portfolio, which includes direct and guaranty loan programs that provide
             small businesses with access to capital. This portfolio includes disaster
             loans, in which SBA makes direct loans to individuals, small businesses,
             and non-profit organizations in declared disaster areas. The portfolio also
             includes loan guaranty programs, through which SBA guarantees loans to
             small businesses that private sector lending institutions would not make
             otherwise. To administer its loan programs, SBA relies on electronic
             systems to support the full life cycle of loans.

             SBA has made several attempts to upgrade its financial software and
             migrate it off a mainframe environment. The current effort to modernize
             SBA’s loan systems was designed to, among other things, update and
             improve the agency’s outdated Loan Accounting System. The legacy
             system, implemented in the 1970s, runs on outsourced mainframe
             software and hardware that requires costly contracts to use and maintain.
             This system is programmed in COBOL (Common Business Oriented
             Language), a business application programming language that was
             introduced in the 1960s and is now becoming obsolete and difficult to
             manage. The Loan Accounting System is the primary system used to
             manage and account for loans and loan-related activities for all SBA loan
             programs, including allotment of funds, loan origination, servicing,
             liquidation, collections, and disbursements. New technologies added to
             the loan accounting environment over the years have created a web of
             stove-piped systems and databases, causing issues with interoperability.
             Maintaining data integrity in such an environment requires SBA to employ
             expensive data reconciliations.

             In November 2005, SBA announced the initiation of the LMAS program,
             with estimated total costs of approximately $217 million over a 9-year
             period. Its goal was to implement a single, integrated loan management
             and loan accounting solution that aligned with the agency’s strategic
             goals. SBA began work on the LMAS program in early 2006, but was
             unable to replace the legacy system prior to the expiration of its
             mainframe contract in February 2007, making it necessary for SBA to

             Page 2                                                           GAO-12-395T
                       negotiate new contracts for mainframe and application services until
                       December 2011 at a total cost of approximately $30 million.

                       Following recommendations from an outside study and two reviews by
                       OMB, SBA subsequently reduced the overall scope of the LMAS
                       modernization project and decided to pursue the modernization through a
                       number of smaller projects with shorter time frames. The revised
                       approach, called the LMAS Incremental Improvement Projects (LMAS-
                       IIPs), was approved by OMB in January 2011. It consists of seven
                       projects that are to move software off of the legacy mainframe
                       environment, upgrade two administrative accounting systems, develop
                       new interfaces that are to interact with updated applications, and develop
                       plans for future improvements.

                       As discussed in our report, SBA had completed one of the seven LMAS-
Modernization          IIPs and awarded contracts for work on three others as of October 2011.
Projects Have          However, the projects have experienced increasing costs and schedule
                       delays. Specifically, according to the most recent project schedule, dated
Experienced            August 2011, SBA completed one project in May 2011, 2 months later
Increasing Costs and   than planned and expects five of the remaining six projects to finish
Schedule Delays, and   between 4 and 11 months later than the dates reported to Congress in
                       October 2010. Further, according to the agency’s most recent report to
SBA Has Not Fully      Congress, dated March 2011, the total projected cost of the projects
Implemented Key IT     increased approximately $5 million since October 2010 and the costs of
                       individual projects had risen between approximately 3 and 53 percent.
Management             SBA plans to complete the seven IIPs at a total cost of approximately $28
Practices              million by July 2013. Table 1 shows the initial and current expected
                       completion dates and projected costs for the seven LMAS-IIPs.

                       Page 3                                                          GAO-12-395T
Table 1: IIP Initial and Current Expected Completion Dates and Projected Costs (dollars in millions)

                                          Expected                     Expected
                                          completion date              completion date       Projected           Projected        Percentage
                                          as of October                as of August         costs as of         costs as of       increase in
LMAS-IIP              Current status      2010                         2011               October 2010          March 2011             costs
Oracle Upgrade        Completed May       March 2011                   Completed May                $8.45               $8.66                2.5%
                      2011                                             2011
Migration of User     Contract awarded    December 2011                May 2012                       3.32               3.76            13.3%
Interfaces            and work in
Migrate to New        Contract awarded    May 2012                     April 2013                     6.05               8.72            44.1%
Version of COBOL      to conduct
Sybase to Oracle      Contract awarded    October 2011                 September 2012                 2.51               3.11            23.9%
Migration             to conduct
Root Cause Analyses Planning initiated    October 2011                 June 2012                       n/a                n/a            41.0%
Implement             Expected to start   March 2013                   July 2013                       n/a                n/a            47.8%
Improvements          in March 2012
Document Loan         Expected to start March 2013                     January 2013                    n/a                n/a            52.5%
Accounting            in November 2011
                                          Source: GAO analysis of SBA data.

                                          Note: Cells marked “n/a” represent potentially sensitive cost estimates, which are therefore not
                                          printed here.

                                          Our report also raises concerns about SBA’s inconsistent implementation
                                          of key management practices. The success of large IT projects is
                                          dependent on agencies’ implementing management practices in areas
                                          that include software requirements management, IT risk management, IT
                                          human capital management, and enterprise architecture. In addition, IT
                                          investment management, which constitutes effective institutional
                                          oversight, is necessary to ensure that projects adhere to these
                                          management capabilities and achieve expected results.

                                          SBA partially implemented the management practices we reviewed.

                                          •     Requirements management–SBA appropriately managed changes to
                                                requirements for the two projects for which this process would be
                                                appropriate; however, it did not validate the requirements for one of
                                                the ongoing IIPs. In addition, requirements were not documented for
                                                two of the ongoing projects.

                                          Page 4                                                                                  GAO-12-395T
•   Risk management–risks were identified for three of four active
    projects; however, SBA did not fully prioritize risks related to one IIP
    or develop plans to mitigate them.
•   IT human capital management–SBA inventoried existing human
    capital capabilities; however, it did not fully identify gaps in project
    workforce skills and did not develop strategies to close them.
•   Enterprise architecture–SBA drafted target segment architectures for
    the IIPs; however, the architectures have not been approved by the
    appropriate officials. In addition, the agency did not fully implement
    other basic enterprise architecture practices, including maintaining
    and prioritizing its segment architectures.
•   IT investment management–the agency had the overall direction of
    the IIP effort approved by an executive review committee. However,
    SBA did not address other capital planning requirements for the
    program, including approving a schedule baseline or reviewing its risk
    management plan, or provide evidence that it approved the
    subsequent changes to the budget estimates reported to Congress.

Inconsistencies in SBA’s application of IT management practices
occurred, in part, because it did not provide adequate executive oversight
through its investment management process, even though it is using two
executive bodies to oversee the projects. While these bodies have
overlapping responsibilities and lines of authority, several basic oversight
responsibilities, including executive approval of the project’s schedule,
were left unaddressed by either body. In addition, the cost baselines
approved by SBA’s executive oversight body differ from the projected
costs reported to Congress 2 months later. According to SBA officials,
additional oversight was provided through undocumented meetings and
reviews of reports to Congress. Nevertheless, these weaknesses in the
use of basic management practices make it less likely that SBA will be
able to complete the IIPs within the time, budget, and scope parameters
originally planned.

Page 5                                                           GAO-12-395T
                        To better ensure that the loan management Incremental Improvement
SBA Needs to Apply      Projects are completed as planned and provide anticipated capabilities,
Appropriate             we are making several recommendations to the Administrator of SBA in
                        our report. Specifically, we are recommending that SBA apply the
Information             appropriate information technology management practices to the IIPs, by
Technology              ensuring that
Management              •   IIP requirements are managed appropriately, including elicitation,
Practices and Clarify       documentation, and verification and validation;
                            IT risks to the IIPs are adequately managed, including preparing for
Roles of Oversight      •
                            risk management, identifying and analyzing risks, mitigating risks, and
Bodies                      providing executive oversight of risk management activities;
                        •   the human capital necessary for the IIPs is managed appropriately,
                            including the determination of human capital needs, the identification
                            of gaps between current capabilities and needs, the development of a
                            strategy to close those gaps, and the documentation of these
                            activities; and
                        •   the enterprise architecture segments related to the IIPs are managed
                            appropriately, including the development, prioritization, and
                            maintenance of the segments.

                        In addition, we are recommending that SBA clarify the responsibilities of
                        the executive bodies responsible for the IIPs and ensure they provide the
                        appropriate oversight of the project’s progress. Specifically, these
                        executive bodies should conduct and document executive review and
                        approval of the LMAS modernization’s risk management approach, target
                        segment architectures, and cost and schedule baselines.

                        In written comments on the draft of this report, the Small Business
                        Administration’s Assistant Administrator, Office of Congressional and
                        Legislative Affairs, stated that SBA generally agreed with our
                        recommendations. The Assistant Administrator also asked that we clarify
                        two points. First, he stated that the costs of the LMAS modernization had
                        not increased, and that the figures we included from an October 2010
                        report to Congress included only contractor costs while the figures from a
                        March 2011 report included both contractor and government costs.
                        However, neither the original request nor SBA’s response specifically
                        indicate that the costs discussed included only contractor costs. Further,
                        this lack of clarity on the projected cost of the modernization reinforces
                        the need for an approved cost and schedule baseline that can be used to
                        evaluate program progress, as discussed in our briefing.

                        Page 6                                                          GAO-12-395T
                  Second, the Assistant Administrator stated that SBA’s executive oversight
                  bodies reviewed the LMAS modernization’s overall schedule and cost
                  estimates through both formal and informal discussions, including
                  executive-level meetings in August and September 2010. We considered
                  this information in our initial assessment. However, we do not believe that
                  the records he cites demonstrate that SBA is maintaining current cost or
                  schedule baselines because the approved project cost estimates are
                  inconsistent with estimates subsequently reported to Congress and
                  neither of the meetings’ minutes included project-level schedule
                  estimates. The Assistant Administrator stated that SBA is considering
                  formalizing the additional reviews that are currently undocumented. We
                  agree that fully documenting decisions about the projects’ costs and
                  schedules would improve SBA’s ability to manage the improvement

                  In conclusion, Mr. Chairman, while SBA has made progress in
                  modernizing its loan accounting system, cost increases and schedule
                  slippage raise concerns about SBA’s ability to complete the
                  modernization as planned. More consistent application of basic
                  information management techniques and stronger executive oversight
                  could help SBA arrest or reverse these conditions.

                  Mr. Chairman, this concludes my prepared statement. I would be pleased
                  to answer any questions you or other Members of the Committee may

                  If you have questions concerning this statement, please contact David A.
GAO Contact and   Powner, Director, Information Technology Management Issues, at (202)
Staff             512-9286. Other individuals who made key contributions include James
                  R. Sweetman (Assistant Director), Eric Costello, Franklin Jackson, Lee
Acknowledgments   McCracken, Meredith Raymond, and Karl Seifert.

                  Page 7                                                          GAO-12-395T
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (www.gao.gov). Each weekday afternoon,
GAO Reports and       GAO posts on its website newly released reports, testimony, and
                      correspondence. To have GAO e-mail you a list of newly posted products,
Testimony             go to www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
To Report Fraud,
Waste, and Abuse in   Website: www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548

                        Please Print on Recycled Paper.