United States Government Accountability Office GAO Testimony Before the Committee on Small Business, House of Representatives INFORMATION For Release on Delivery Expected at 1:00 p.m. EST Wednesday, February 8, 2012 TECHNOLOGY SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization Statement of David A. Powner, Director Information Technology Management Issues GAO-12-395T Mr. Chairman and Members of the Committee: I am pleased to participate in today’s hearing on the Small Business Administration’s (SBA) efforts to modernize its Loan Management and Accounting System (LMAS). As you are aware, SBA performs a range of significant activities intended to strengthen small businesses and relies extensively on information technology (IT) systems to accomplish these activities. Among these are financial systems used to support loan accounting and track loans through origination, servicing, and liquidation. The loan systems, collectively called the Loan Accounting System, were implemented in the 1970s and outsourced to be run on a contractor’s mainframe hardware. SBA has been pursuing efforts to upgrade and modernize its financial systems for several years. The current effort, referred to as LMAS, dates from 2005 and was a response to concerns about the age and information security risks of the legacy system. The effort was intended to result in a single, integrated loan management and loan accounting solution. However, after an independent study and two reviews by the Office of Management and Budget (OMB) raised concerns about SBA’s management of the program, it was restructured into a series of seven more focused projects with shorter time frames, referred to as LMAS-Incremental Improvement Projects (IIP). You asked us to testify on the status of SBA’s LMAS modernization effort and whether SBA has adequate processes and procedures in place to manage and oversee this effort. My statement today is based on our report, Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization, which is being released today at this hearing. 1 This report summarizes the results of our study—which specifically describes the status of the modernization effort and determines whether SBA has adequate process and procedures in place to manage and oversee its LMAS modernization effort. All work on which this testimony is based was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions 1 GAO, Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization, GAO-12-295 (Washington, D.C.: Jan. 25, 2012). Page 1 GAO-12-395T based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. SBA’s mission is to aid, counsel, assist, and protect the interests of small Background business concerns; to preserve free competitive enterprise; and to maintain and strengthen the overall economy of the Unites States. One way that SBA works to grow businesses is through managing a $90 billion portfolio, which includes direct and guaranty loan programs that provide small businesses with access to capital. This portfolio includes disaster loans, in which SBA makes direct loans to individuals, small businesses, and non-profit organizations in declared disaster areas. The portfolio also includes loan guaranty programs, through which SBA guarantees loans to small businesses that private sector lending institutions would not make otherwise. To administer its loan programs, SBA relies on electronic systems to support the full life cycle of loans. SBA has made several attempts to upgrade its financial software and migrate it off a mainframe environment. The current effort to modernize SBA’s loan systems was designed to, among other things, update and improve the agency’s outdated Loan Accounting System. The legacy system, implemented in the 1970s, runs on outsourced mainframe software and hardware that requires costly contracts to use and maintain. This system is programmed in COBOL (Common Business Oriented Language), a business application programming language that was introduced in the 1960s and is now becoming obsolete and difficult to manage. The Loan Accounting System is the primary system used to manage and account for loans and loan-related activities for all SBA loan programs, including allotment of funds, loan origination, servicing, liquidation, collections, and disbursements. New technologies added to the loan accounting environment over the years have created a web of stove-piped systems and databases, causing issues with interoperability. Maintaining data integrity in such an environment requires SBA to employ expensive data reconciliations. In November 2005, SBA announced the initiation of the LMAS program, with estimated total costs of approximately $217 million over a 9-year period. Its goal was to implement a single, integrated loan management and loan accounting solution that aligned with the agency’s strategic goals. SBA began work on the LMAS program in early 2006, but was unable to replace the legacy system prior to the expiration of its mainframe contract in February 2007, making it necessary for SBA to Page 2 GAO-12-395T negotiate new contracts for mainframe and application services until December 2011 at a total cost of approximately $30 million. Following recommendations from an outside study and two reviews by OMB, SBA subsequently reduced the overall scope of the LMAS modernization project and decided to pursue the modernization through a number of smaller projects with shorter time frames. The revised approach, called the LMAS Incremental Improvement Projects (LMAS- IIPs), was approved by OMB in January 2011. It consists of seven projects that are to move software off of the legacy mainframe environment, upgrade two administrative accounting systems, develop new interfaces that are to interact with updated applications, and develop plans for future improvements. As discussed in our report, SBA had completed one of the seven LMAS- Modernization IIPs and awarded contracts for work on three others as of October 2011. Projects Have However, the projects have experienced increasing costs and schedule delays. Specifically, according to the most recent project schedule, dated Experienced August 2011, SBA completed one project in May 2011, 2 months later Increasing Costs and than planned and expects five of the remaining six projects to finish Schedule Delays, and between 4 and 11 months later than the dates reported to Congress in October 2010. Further, according to the agency’s most recent report to SBA Has Not Fully Congress, dated March 2011, the total projected cost of the projects Implemented Key IT increased approximately $5 million since October 2010 and the costs of individual projects had risen between approximately 3 and 53 percent. Management SBA plans to complete the seven IIPs at a total cost of approximately $28 Practices million by July 2013. Table 1 shows the initial and current expected completion dates and projected costs for the seven LMAS-IIPs. Page 3 GAO-12-395T Table 1: IIP Initial and Current Expected Completion Dates and Projected Costs (dollars in millions) Expected Expected completion date completion date Projected Projected Percentage as of October as of August costs as of costs as of increase in LMAS-IIP Current status 2010 2011 October 2010 March 2011 costs Oracle Upgrade Completed May March 2011 Completed May $8.45 $8.66 2.5% 2011 2011 Migration of User Contract awarded December 2011 May 2012 3.32 3.76 13.3% Interfaces and work in progress Migrate to New Contract awarded May 2012 April 2013 6.05 8.72 44.1% Version of COBOL to conduct assessment Sybase to Oracle Contract awarded October 2011 September 2012 2.51 3.11 23.9% Migration to conduct assessment Root Cause Analyses Planning initiated October 2011 June 2012 n/a n/a 41.0% Implement Expected to start March 2013 July 2013 n/a n/a 47.8% Improvements in March 2012 Document Loan Expected to start March 2013 January 2013 n/a n/a 52.5% Accounting in November 2011 Source: GAO analysis of SBA data. Note: Cells marked “n/a” represent potentially sensitive cost estimates, which are therefore not printed here. Our report also raises concerns about SBA’s inconsistent implementation of key management practices. The success of large IT projects is dependent on agencies’ implementing management practices in areas that include software requirements management, IT risk management, IT human capital management, and enterprise architecture. In addition, IT investment management, which constitutes effective institutional oversight, is necessary to ensure that projects adhere to these management capabilities and achieve expected results. SBA partially implemented the management practices we reviewed. Specifically: • Requirements management–SBA appropriately managed changes to requirements for the two projects for which this process would be appropriate; however, it did not validate the requirements for one of the ongoing IIPs. In addition, requirements were not documented for two of the ongoing projects. Page 4 GAO-12-395T • Risk management–risks were identified for three of four active projects; however, SBA did not fully prioritize risks related to one IIP or develop plans to mitigate them. • IT human capital management–SBA inventoried existing human capital capabilities; however, it did not fully identify gaps in project workforce skills and did not develop strategies to close them. • Enterprise architecture–SBA drafted target segment architectures for the IIPs; however, the architectures have not been approved by the appropriate officials. In addition, the agency did not fully implement other basic enterprise architecture practices, including maintaining and prioritizing its segment architectures. • IT investment management–the agency had the overall direction of the IIP effort approved by an executive review committee. However, SBA did not address other capital planning requirements for the program, including approving a schedule baseline or reviewing its risk management plan, or provide evidence that it approved the subsequent changes to the budget estimates reported to Congress. Inconsistencies in SBA’s application of IT management practices occurred, in part, because it did not provide adequate executive oversight through its investment management process, even though it is using two executive bodies to oversee the projects. While these bodies have overlapping responsibilities and lines of authority, several basic oversight responsibilities, including executive approval of the project’s schedule, were left unaddressed by either body. In addition, the cost baselines approved by SBA’s executive oversight body differ from the projected costs reported to Congress 2 months later. According to SBA officials, additional oversight was provided through undocumented meetings and reviews of reports to Congress. Nevertheless, these weaknesses in the use of basic management practices make it less likely that SBA will be able to complete the IIPs within the time, budget, and scope parameters originally planned. Page 5 GAO-12-395T To better ensure that the loan management Incremental Improvement SBA Needs to Apply Projects are completed as planned and provide anticipated capabilities, Appropriate we are making several recommendations to the Administrator of SBA in our report. Specifically, we are recommending that SBA apply the Information appropriate information technology management practices to the IIPs, by Technology ensuring that Management • IIP requirements are managed appropriately, including elicitation, Practices and Clarify documentation, and verification and validation; IT risks to the IIPs are adequately managed, including preparing for Roles of Oversight • risk management, identifying and analyzing risks, mitigating risks, and Bodies providing executive oversight of risk management activities; • the human capital necessary for the IIPs is managed appropriately, including the determination of human capital needs, the identification of gaps between current capabilities and needs, the development of a strategy to close those gaps, and the documentation of these activities; and • the enterprise architecture segments related to the IIPs are managed appropriately, including the development, prioritization, and maintenance of the segments. In addition, we are recommending that SBA clarify the responsibilities of the executive bodies responsible for the IIPs and ensure they provide the appropriate oversight of the project’s progress. Specifically, these executive bodies should conduct and document executive review and approval of the LMAS modernization’s risk management approach, target segment architectures, and cost and schedule baselines. In written comments on the draft of this report, the Small Business Administration’s Assistant Administrator, Office of Congressional and Legislative Affairs, stated that SBA generally agreed with our recommendations. The Assistant Administrator also asked that we clarify two points. First, he stated that the costs of the LMAS modernization had not increased, and that the figures we included from an October 2010 report to Congress included only contractor costs while the figures from a March 2011 report included both contractor and government costs. However, neither the original request nor SBA’s response specifically indicate that the costs discussed included only contractor costs. Further, this lack of clarity on the projected cost of the modernization reinforces the need for an approved cost and schedule baseline that can be used to evaluate program progress, as discussed in our briefing. Page 6 GAO-12-395T Second, the Assistant Administrator stated that SBA’s executive oversight bodies reviewed the LMAS modernization’s overall schedule and cost estimates through both formal and informal discussions, including executive-level meetings in August and September 2010. We considered this information in our initial assessment. However, we do not believe that the records he cites demonstrate that SBA is maintaining current cost or schedule baselines because the approved project cost estimates are inconsistent with estimates subsequently reported to Congress and neither of the meetings’ minutes included project-level schedule estimates. The Assistant Administrator stated that SBA is considering formalizing the additional reviews that are currently undocumented. We agree that fully documenting decisions about the projects’ costs and schedules would improve SBA’s ability to manage the improvement projects. In conclusion, Mr. Chairman, while SBA has made progress in modernizing its loan accounting system, cost increases and schedule slippage raise concerns about SBA’s ability to complete the modernization as planned. More consistent application of basic information management techniques and stronger executive oversight could help SBA arrest or reverse these conditions. Mr. Chairman, this concludes my prepared statement. I would be pleased to answer any questions you or other Members of the Committee may have. If you have questions concerning this statement, please contact David A. GAO Contact and Powner, Director, Information Technology Management Issues, at (202) Staff 512-9286. Other individuals who made key contributions include James R. Sweetman (Assistant Director), Eric Costello, Franklin Jackson, Lee Acknowledgments McCracken, Meredith Raymond, and Karl Seifert. (311281) Page 7 GAO-12-395T This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO’s Mission The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no Obtaining Copies of cost is through GAO’s website (www.gao.gov). Each weekday afternoon, GAO Reports and GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, Testimony go to www.gao.gov and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov. Contact: To Report Fraud, Waste, and Abuse in Website: www.gao.gov/fraudnet/fraudnet.htm E-mail: firstname.lastname@example.org Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, email@example.com, (202) 512- Congressional 4400, U.S. Government Accountability Office, 441 G Street NW, Room Relations 7125, Washington, DC 20548 Chuck Young, Managing Director, firstname.lastname@example.org, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Please Print on Recycled Paper.
Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization
Published by the Government Accountability Office on 2012-02-08.
Below is a raw (and likely hideous) rendition of the original report. (PDF)