SBA Loan Monitoring System: Substantial Progress Yet Key Risks and
Challenges Remain (Letter Report, 04/25/2000, GAO/AIMD-00-124).

Pursuant to a congressional request, GAO reviewed the Small Business
Administration's (SBA) progress in performing planning actions for its
loan monitoring system.

GAO noted that: (1) SBA had made substantial progress in completing the
eight planning actions mandated by the Small Business Reauthorization
Act of 1997 but still had to complete work for some actions and
implement key functions to effectively manage the development of the
loan monitoring system; and (2) this report transmits GAO's
recommendations to assist SBA in completing work for the eight planning
actions and in strengthening its information technology management
practices.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  AIMD-00-124
     TITLE:  SBA Loan Monitoring System: Substantial Progress Yet Key
	     Risks and Challenges Remain
      DATE:  04/25/2000
   SUBJECT:  Small business loans
	     Strategic information systems planning
	     Internal controls
	     ADP procurement
	     Information resources management
	     Performance measures
	     Systems conversions
	     Systems design
	     Loan accounting systems
IDENTIFIER:  SBA Loan Monitoring System

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************

GAO/AIMD-00-124

Appendix I: GAO's February 29, 2000, Testimony

8

Appendix II: Comments From the Small Business Administration

27

35

BPR business process reengineering

COTS commercial-off-the-shelf software

IEEE Institute of Electrical and Electronics Engineers, Inc.

SBA Small Business Administration

Accounting and Information
Management Division

B-284931

April 25, 2000

The Honorable Aida Alvarez
Administrator, Small Business Administration

Dear Madam Administrator:

On February 29, 2000, we testified before the Subcommittee on Government
Programs and Oversight, House Committee on Small Business, on the Small
Business Administration's (SBA) progress in performing planning actions for
its loan monitoring system.1 We testified that SBA had made substantial
progress in completing the eight planning actions mandated by the Small
Business Reauthorization Act of 1997 but still had to complete work for some
actions and implement key functions to effectively manage the development of
the loan monitoring system.

This report transmits our recommendations to assist SBA in completing work
for the eight planning actions and in strengthening its information
technology management practices. We are sending this report to you because
of the significant investment that SBA plans to make in developing the loan
monitoring system, and because of the key role of the loan monitoring system
in SBA's modernization. Our testimony is reprinted in appendix I. We
performed our work from August 1999 through February 28, 2000, in accordance
with generally accepted government auditing standards.

SBA's Chief Operating Officer provided us with comments on a draft of this
report. These comments are discussed in the "Agency Comments" section and
reprinted in appendix II.

We recommend that the Administrator, Small Business Administration, take a
series of actions to ensure that SBA completes the steps mandated by the
act, as stated in our February 29, 2000, testimony. Specifically, we
recommend that the Administrator

ï¿½ complete the analyses of benefits and costs of alternatives being
considered for each business process identified through SBA's business
reengineering effort, and complete an implementation plan for the new
business processes;

ï¿½ perform benefit-cost analyses for systems alternatives to increase the
probability that SBA will obtain a system that meets its needs at the lowest
cost;

ï¿½ develop the information architecture's rules and standards for
interoperability and maintainability of interrelated systems;

ï¿½ identify high-level requirements for all internal reports and define
detailed input and output data elements necessary for the timely generation
of reports;

ï¿½ complete the definition of specific data quality standards, develop a
schedule of planned actions to improve data quality in the current systems,
and implement data quality measures;

ï¿½ define system capacity and performance requirements for the systems
requirements documentation;

ï¿½ develop an acquisition strategy that ensures that a sound justification
exists for pursuing custom-developed functions; and

ï¿½ continue to refine the cost-to-completion estimate following the
completion of the benefit-cost analysis of alternatives and selection of the
best alternatives for implementation, and develop a lifecycle cost estimate
for the system and its components.

As also stated in our February 29, 2000, testimony, the implementation of
project management processes and capabilities is essential for a major
systems development acquisition. We therefore recommend that the
Administrator ensure the implementation of key functions to effectively
manage the development of the loan monitoring system. Specifically, to
strengthen project management processes and controls, we recommend that the
Administrator

ï¿½ implement project tracking and oversight capabilities;

ï¿½ finalize and implement configuration management processes;

ï¿½ acquire independent verification and validation for the loan monitoring
system project;

ï¿½ establish an internal quality assurance function; and

ï¿½ address the security challenge posed by Internet-based access to loan
monitoring system functions and data, complete the security architecture,
and update the security operating procedure.

As you know, the head of a federal agency is required by 31 U.S.C. 720 to
submit a written statement on the actions taken on these recommendations to
the Senate Committee on Governmental Affairs and the House Committee on
Government Reform, not later than 60 days after the date of this report. A
written statement must also be sent to the House and Senate Committees on
Appropriations with the agency's first request for appropriations made more
than 60 days after the date of this report.

In commenting on a draft of this report, the Chief Operating Officer stated
that SBA generally agreed with the recommendations. She added that SBA
action had now been completed in part on five of our recommendations with
the revision of the analysis of benefits-costs to address each business
process, completion of the benefit-cost analysis of system alternatives,
completion of the information technology architecture, revision of the
systems requirements to include high-level system capacity and performance
requirements, and update of the security operating procedure. She also noted
that SBA had initiated or planned actions for the remaining recommendations.

We are sending copies of this report to Senator Christopher S. Bond,
Chairman, and Senator John F. Kerry, Ranking Minority Member, Senate
Committee on Small Business; Representative James M. Talent, Chairman, and
Representative Nydia M. Velazquez, Ranking Minority Member, House Committee
on Small Business; and Representative Roscoe G. Bartlett, Chairman, and
Danny K. Davis, Ranking Minority Member, Subcommittee on Government Programs
and Oversight, House Committee on Small Business. We are also sending copies
of this report to The Honorable
Jacob J. Lew, Director, Office of Management and Budget. Copies will also be
made available to others upon request.

Should you or your staff have any questions concerning this report, please
contact me at (202) 512-6253. I can also be reached by e-mail at
[email protected].

Sincerely yours,
Joel C. Willemssen
Director, Civil Agencies Information Systems

GAO's February 29, 2000, Testimony

Comments From the Small Business Administration

The following is GAO's comment on the Small Business Administration's March
29, 2000, letter.

Our testimony considered the products cited by SBA. The testimony, included
in appendix I to this report, lists status of products for mandated actions
that were analyzed as part of our evaluation of SBA's planning actions for
the loan monitoring system.

Related GAO Products

Small Business Administration: Enhancements Needed for Loan Monitoring
System Benchmark Study (GAO/AIMD-99-165 , May 14, 1999).

Small Business Administration: Planning for Loan Monitoring System Has Many
Positive Features But Still Carries Implementation Challenges
(GAO/T-AIMD-98-233 , July 16, 1998).

Small Business Administration: Mandated Planning For Loan Monitoring System
Is Not Complete (GAO/AIMD-98-214R , June 30, 1998).

Small Business Administration: Better Planning and Controls Needed For
Information Systems (GAO/AIMD-97-94 , June 27, 1997).

(511841)
  

1. SBA Loan Monitoring System: Substantial Progress Yet Key Risks and
Challenges Remain (GAO/T-AIMD-00-113 , February 29, 2000).
*** End of document. ***