Small Business Administration: Actions Needed to Provide More	 
Timely Disaster Assistance (28-JUL-06, GAO-06-860).		 
                                                                 
Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes)  
caused more than $118 billion in estimated property damages	 
across the Gulf Coast region in 2005. The Small Business	 
Administration (SBA) helps individuals and businesses recover	 
from disasters through its Disaster Loan Program. GAO initiated  
work to determine how well SBA provided victims of the Gulf Coast
hurricanes with timely assistance. This report, the first of two,
focuses primarily on the Disaster Credit Management System (DCMS)
and disaster loan process. Here, GAO evaluates (1) what affected 
SBA's ability to provide timely disaster assistance and (2)	 
actions SBA took after the disasters to improve its response to  
disaster victims. In conducting this study, GAO analyzed data on 
loan applications and assessed key aspects of SBA's acquisition  
and implementation of DCMS.					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-860 					        
    ACCNO:   A57681						        
  TITLE:     Small Business Administration: Actions Needed to Provide 
More Timely Disaster Assistance 				 
     DATE:   07/28/2006 
  SUBJECT:   Disaster relief aid				 
	     Hurricane Katrina					 
	     Hurricanes 					 
	     Property losses					 
	     Small business					 
	     Loans						 
	     Property damages					 
	     Lending institutions				 
	     SBA Disaster Loan Program				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-860

     

     * Report to Congressional Addressees
          * July 2006
     * SMALL BUSINESS ADMINISTRATION
          * Actions Needed to Provide More Timely Disaster Assistance
     * Contents
          * Results in Brief
          * Background
          * Large Volume of Applications, Limited Planning, and Various
            System and Processing Related Challenges Affected SBA's Ability
            to Provide Timely Disaster Assistance
               * Large Volume of Loan Applications Affected SBA's Response to
                 Hurricane Victims
               * Limited Planning for DCMS User Capacity Reduced SBA's
                 Ability to Provide Timely Disaster Assistance
               * Ineffective Technical Support Affected the Stability of DCMS
                 and SBA's Ability to Provide Timely Disaster Assistance
               * SBA Did Not Completely Stress Test DCMS to Ensure It Could
                 Function at Maximum Capacity
               * Other Processing Related Challenges Affected SBA's Ability
                 to Provide Timely Disaster Assistance
               * As a Result of These Factors, SBA Did Not Significantly
                 Reduce Its Backlog of Applications until Several Months
                 after Hurricane Katrina
          * SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees
            of Success
               * SBA Took Actions to Address DCMS Instability and Other
                 System-Related Issues
               * SBA's Processing Changes and Other Initiatives Had Varied
                 Success
               * SBA May Be Able to Process Applications More Efficiently
          * Conclusions
          * Recommendations for Executive Action
          * Agency Comments and Our Evaluation
     * Scope and Methodology
     * SBA's Acquisition and Implementation of the Disaster Credit Management
       System
     * Comments from the Small Business Administration
     * GAO Contact and Staff Acknowledgments

                 United States Government Accountability Office

Report to Congressional Addressees

GAO

July 2006

                         SMALL BUSINESS ADMINISTRATION

           Actions Needed to Provide More Timely Disaster Assistance

                                       a

GAO-06-860

SMALL BUSINESS ADMINISTRATION

Actions Needed to Provide More Timely Disaster Assistance

  What GAO Found

Although DCMS provided SBA with a number of benefits, several factors
affected SBA's ability to provide timely disaster assistance to victims of
the Gulf Coast hurricanes. First, the large volume of applications SBA
processed greatly exceeded any previous disaster, including the 1994
Northridge earthquake-the largest single disaster SBA previously faced.
Second, SBA primarily used this earthquake as the basis for planning the
maximum user capacity for DCMS and did not consider information available
from catastrophe risk modeling firms and disaster simulations, such as the
likelihood and severity of damages from potential catastrophes, to help
predict the expected application volume from such events. SBA's limited
planning contributed to insufficient DCMS user capacity, which restricted
the number of staff that could access the system and process the large
volume of applications in a timely manner. SBA also did not receive the
correct computer hardware from its contractor, and the agency did not
completely stress test DCMS before implementation, which contributed to
the system instability, outages, and slow response times initially
experienced by SBA staff. As a result of these and other factors, SBA
faced significant delays and backlogs in processing loan applications, as
depicted in the figure below. This backlog peaked at more than 204,000
applications 4 months after Hurricane Katrina. As of May 27, 2006, SBA
processed applications, on average, in about 74 days compared with its
goal of within 21 days.

Some of the actions SBA took after the Gulf Coast hurricanes helped to
improve its response to disaster victims. For example, SBA addressed
system-related issues by increasing the number of users that could access
DCMS, and it plans to further increase the system's maximum user capacity.
SBA implemented other initiatives that had limited success. For example,
SBA made only a few loan guarantees under its Gulf Opportunity Pilot Loan
Program for small businesses in communities affected by the disasters. SBA
would benefit by expediting its planned business process reengineering
efforts to analyze ways to more efficiently process loan applications,
such as implementing a secure Internet-based application feature for home
loan applicants.

Backlog of Applications in Loss Verification and Application Processing

Applications(in thousands)

Months following Hurricane Katrina

Contents

  Letter 1

Results in Brief 2 Background 5 Large Volume of Applications, Limited
Planning, and Various System

and Processing Related Challenges Affected SBA's Ability to

Provide Timely Disaster Assistance 11 SBA's Actions after the Gulf Coast
Hurricanes Had Varying Degrees

of Success 26 Conclusions 32 Recommendations for Executive Action 33
Agency Comments and Our Evaluation 34

  Appendixes

Appendix I: Scope and Methodology 39 Appendix II: SBA's Acquisition and
Implementation of the Disaster Credit Management System 41 Appendix III:
Comments from the Small Business Administration 45 Appendix IV: GAO
Contact and Staff Acknowledgments 51

Table 1:

  Tables

Table 2: Table 3: Table 4:

Significant U.S. Natural Disasters (1988-2005) 6 SBA Application
Statistics for Gulf Coast Hurricanes and Previous Disasters 13 Other
Changes SBA Made after Gulf Coast Hurricanes That Improved Response to
Disaster Victims 28 Other Changes SBA Made after Gulf Coast Hurricanes
That Had Limited Success 30

Figure 1: SBA's Disaster Loan Process 8

  Figures

Figure 2: Number of Disaster Loan Applications Processed and

Average Staffing Levels by Month, September 2005 to May

2006 20 Figure 3: FEMA IA Applicants' Current Location by State as of

April 10, 2006 22 Figure 4: Backlog of Applications in Loss Verification
and

Application Processing 24 Figure 5: Average Processing Time Frames for
Approval and

Decline Decisions, October 2005 to May 2006 25 Figure 6: Time Line of DCMS
Activities 44

Contents

                                 Abbreviations

ALCS                  Automated Loan Control System                        
COTS                  commercial-off-the-shelf                             
DAO                   Disaster Area Office                                 
DCMS                  Disaster Credit Management System                    
FEMA                                   Federal Emergency Management Agency 
IA                    Individual Assistance                                
IHP                   Individuals and Households Program                   
IV&V                               Independent Verification and Validation 
IRS                   Internal Revenue Service                             
ODA                   Office of Disaster Assistance                        
PDC                   Processing and Disbursement Center                   
SBA                   Small Business Administration                        

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

July 28, 2006

Congressional Addressees:

In 2005, Hurricanes Katrina, Rita, and Wilma battered the U.S. Gulf Coast
region, causing more than $118 billion in estimated property damages and
over 1,400 deaths.1 As the federal government's primary lender to victims
of disasters, the Small Business Administration (SBA) provides financial
assistance through its Disaster Loan Program to help homeowners, renters,
and businesses of all sizes recover from disasters such as earthquakes,
hurricanes, and terrorist attacks. In this capacity, SBA plays a crucial
role in the long-term recovery of the Gulf Coast region. Nine months
following Hurricane Katrina, SBA had approved more than 148,700 disaster
assistance loans totaling $9.7 billion to individuals and businesses that
suffered losses from the Gulf Coast hurricanes.2 However, Congress and
press reports have expressed concerns that SBA's response has been slow,
leaving many disaster victims without the timely assistance that they
needed.

In January 2005, SBA began using its new Disaster Credit Management System
(DCMS) to process loan applications for all new disaster declarations. SBA
intended for DCMS to improve the quality and timeliness of its disaster
loan process and enhance its overall response to disasters compared with
SBA's previous system. However, after the Gulf Coast hurricanes, both
press reports and Congress were critical of DCMS, citing system outages
and slow response times as contributing to delays that disaster victims
experienced in receiving assistance. We have prepared this report under
the Comptroller General's authority to conduct evaluations on his own
initiative as part of a continued effort to assist Congress in reviewing
how well SBA provided victims of the Gulf Coast hurricanes with timely
assistance. In this report, we evaluate: (1) what affected SBA's ability
to provide timely disaster assistance and (2) the actions SBA took after
the disasters to improve its response to disaster victims. This report
focuses primarily on DCMS and the disaster loan process. We plan to issue
a subsequent report that focuses on other factors not related to DCMS or
the

1Preliminary estimates as reported by the National Oceanic and Atmospheric
Administration.

2In this report, we refer to Katrina, Rita, and Wilma collectively as the
Gulf Coast hurricanes.

                                Results in Brief

disaster loan process that may have affected SBA's ability to provide
timely assistance.3

In conducting this review, we visited the Gulf Coast region to observe
conditions and meet with federal, state, and local officials and victims
of the disasters. We obtained documents related to SBA's disaster lending
policy and procedures and SBA's acquisition and implementation of DCMS. We
also obtained and analyzed SBA's data on disaster loan applications
processed through May 27, 2006. In addition, we interviewed officials from
SBA's headquarters and its two Field Operations Centers in California and
Georgia, Customer Service Center in New York, and Processing and
Disbursement Center (PDC) in Texas. See appendix I for a detailed
description of our scope and methodology. We conducted our work between
November 2005 and July 2006 in accordance with generally accepted
government auditing standards.

Results in Brief

We identified several factors that affected SBA's ability to provide
timely disaster assistance to Gulf Coast hurricane victims. The sheer
volume of applications was a significant challenge to SBA. For example,
SBA mailed more than 2.1 million disaster loan applications and received
over 418,000 in return as of May 27, 2006, which greatly exceeded the
volume from any previous disaster, including the 1994 Northridge
earthquake-the single largest disaster SBA previously faced. Although DCMS
provided a number of benefits compared with its previous system and
process, such as allowing certain manual tasks to be performed
electronically, SBA's limited planning for the maximum number of
concurrent users in DCMS reduced its ability to provide timely disaster
assistance. Specifically, SBA used the volume of applications received
during the Northridge earthquake and other historical data as the basis
for planning the maximum number of concurrent users that DCMS could
accommodate. SBA did not consider information available from catastrophe
risk modeling firms and disaster simulations, such as the likelihood and
severity of damages from potential catastrophes, to help predict the
expected application volume from such

3The objectives of this subsequent review are to determine (1) the extent
to which SBA has a comprehensive disaster response plan and, if so, how it
affected the agency's ability to provide timely assistance to Gulf Coast
hurricane victims; (2) how work force transformation affected SBA's
ability to respond to victims; (3) how SBA's efforts to modify its
regulatory and programmatic authority compared with previous major
disasters; and (4) what outreach strategy SBA used to inform victims about
the disaster loan program.

    Page 2 GAO-06-860 SBA Diaster Loans

events and the concurrent user capacity needed to process expected
volumes. Insurance companies and some government agencies use this
information to plan for catastrophic events. SBA's limited planning
contributed to insufficient DCMS user capacity, which restricted the
number of staff that could access the system and process the large volume
of applications in a timely manner. If SBA had considered information
available from catastrophe risk modeling firms and disaster simulations in
planning for DCMS, the agency may have acquired additional capacity that
would have enabled it to reduce its backlog of applications sooner. In
addition, SBA's hosting contractor provided incorrect computer hardware
and ineffective technical support, which contributed to the initial system
instability, outages, and slow response times SBA staff experienced with
DCMS following the Gulf Coast hurricanes.4 We also found that SBA did not
completely stress test DCMS before implementation. If SBA had conducted
complete stress testing, the agency might have detected that it did not
receive the correct equipment and had an opportunity to address this issue
before implementing the system.5 As a result of these and other
processingrelated challenges, SBA developed a large backlog of
applications during the initial months following Hurricane Katrina. This
backlog peaked at more than 204,000 applications 4 months after Hurricane
Katrina. As of May 27, 2006, SBA processed applications on average in
about 74 days, compared with its goal of within 21 days.6

Some of the actions SBA took to improve its response to disaster victims
after the Gulf Coast hurricanes were more successful than others. For
example, SBA enhanced its ability to provide more timely disaster
assistance by addressing DCMS's instability issues. Specifically, in
October 2005, SBA obtained the computer hardware as agreed to with its
contractor and increased the processing capacity of the system. By
November 2005, SBA added a second work shift for its loan processing staff
to better balance DCMS's workload. In November 2005, SBA also began to
utilize

4SBA's hosting contractor provides services such as monitoring the DCMS
network and providing support for leased computer hardware.

5Stress testing refers to measuring a system's performance and
availability in times of particularly heavy or peak load.

6In this report, we refer to 21 days as the goal because SBA tells
disaster victims that it will try to make a decision on each completed
application within this time frame. According to SBA, the agency's
Government Performance and Results Act goal for fiscal year 2006 is to
process 85 percent of home loan applications within 14 days and 85 percent
of business applications within 16 days.

DCMS to conduct preprocessing decline decisions faster for applicants with
credit scores that indicated a high degree of default risk under a pilot
program; this enabled these applicants to be referred to the Federal
Emergency Management Agency (FEMA) for possible grant assistance sooner.
SBA implemented other initiatives with limited success, including the Gulf
Opportunity Pilot Loan Program (GO Loan Program) in November 2005 that
provided an 85 percent guaranty to qualified lenders, such as banks that
made expedited loans available up to $150,000 under the agency's 7(a) loan
program to small businesses located in communities affected by the
disasters. Because these lenders could charge interest rates significantly
higher than SBA's disaster loan rates, these loans were not very
attractive to disaster victims, and SBA guaranteed only 222 loans under
the program. During the course of our work, we also identified other
potential opportunities to help SBA improve its loan processing, such as
implementing a secure Internet-based application feature for home loan
applications.

To provide more timely assistance to disaster victims in the future, this
report makes four recommendations designed to improve the efficiency and
effectiveness of DCMS and the disaster loan process. Specifically, we
recommend that the Administrator of SBA direct the Office of Disaster
Assistance (ODA) to (1) reassess DCMS's maximum user capacity and related
loan processing resource needs based on such things as lessons learned
from the Gulf Coast hurricanes, a review of information available from
catastrophe risk modeling firms and disaster simulations, and related cost
considerations; (2) improve management controls over assessing contractor
performance through inspections of equipment purchases for DCMS; (3)
conduct complete stress testing to ensure that DCMS can function at
planned for maximum user capacity levels; and (4) expedite plans to resume
business process reengineering efforts to analyze the disaster loan
process and identify ways to more efficiently process loan applications.

We obtained written comments on a draft of this report from SBA's
Associate Administrator for Disaster Assistance. SBA generally agreed with
our recommendations and said that it intends to improve the delivery of
its program for events of all sizes. However, SBA disagreed with some of
the report findings and conclusions. Specifically, SBA disagreed with our
conclusions that it performed limited planning and that it would have been
better prepared to reduce the backlog of applications through the use of
catastrophe risk models rather than relying primarily on the Northridge
earthquake to establish its capacity needs. SBA also stated that we did
not sufficiently recognize the improvement it made before and after the
Gulf Coast hurricanes. Further, SBA challenged our finding regarding its
expedited approval process. We continue to believe that catastrophe risk
modeling firms and disaster simulations provide critical information, such
as the likelihood and severity of damages from potential catastrophes that
would have been useful in planning the maximum user capacity of DCMS. If
SBA had considered this information, it may have expanded the maximum user
requirement for DCMS and been better prepared to reduce the backlog of
loan applications more timely. We believe that our report provides a fair
and balanced presentation of SBA's performance during a difficult period
and that our recommendations are aimed at helping the agency to be more
prepared in the event of another large disaster. The last section of this
report provides a complete assessment of SBA's comments, and its letter is
presented in appendix III.

  Background
  
The Gulf Coast hurricanes collectively represented the most costly natural
disaster in recent U.S. history. As table 1 shows, the estimated property
damage from these hurricanes exceeded $118 billion, nearly five times
greater than the damage from the 1994 Northridge earthquake and more than
two and one-half times greater than the damage from the 2004 Florida
hurricanes. Hurricane Katrina was the first of these disasters, causing
fatalities and damage in southern Florida in late August 2005 before
striking the northern Gulf Coast region. This region received the brunt of
the storm, including extensive damage and significant loss of life in
Louisiana and Mississippi. Damage from Hurricane Katrina also extended
into the Florida panhandle, Georgia, and Alabama and covered approximately
90,000 square miles-an area larger than the size of Great Britain.
Hurricane Rita was the next disaster to strike the Gulf Coast region,
making landfall near the Texas and Louisiana border on September 24, 2005,
and causing a wide swath of damage from eastern Texas to Alabama, flooding
some areas in Louisiana that had already been impacted by Hurricane
Katrina about 1 month earlier. Hurricane Wilma was the last of these
disasters to strike the region, making landfall in southern Florida on
October 24, 2005, and inflicting widespread damage across the state.

            Table 1: Significant U.S. Natural Disasters (1988-2005)

Dollars in billions                      
Event                                               Year   Property damage 
Gulf Coast hurricanes                               2005         > $118.0a 
Severe drought/heat wave (central and               1988             59.3b 
eastern states)                                          
Florida hurricanesc                                 2004           > 46.2b 
Hurricane Andrew                                    1992              35.0 
Midwest flooding                                    1993              26.6 
Northridge earthquake                               1994             24.9b 
Hurricane Hugo                                      1989            > 12.9 
Severe drought (eastern, western, and               2002            > 10.8 
Great Plains states)                                     
Severe weather and flooding (southeast              1995             > 7.3 
and southwest states)                                    
Northern Plains flooding                            1997               4.4 
Southern California wildfires                       2003             > 2.6 

Source: National Oceanic and Atmospheric Administration, U.S. Geological
Survey.

Note: Damage amounts are adjusted to 2005 dollars using gross domestic
product price index. aPreliminary estimate. bEstimated damages. cIncludes
Hurricanes Charley, Frances, Ivan, and Jeanne.

The federal government provides funding and assistance after disasters
through a variety of agencies and programs. Congress created FEMA to
coordinate response and recovery efforts under presidential disaster
declarations. FEMA works with other federal, state, and local agencies to
assist victims after major disasters, and volunteer organizations such as
the American Red Cross also participate in these efforts. Following a
presidential disaster declaration, FEMA will open Disaster Recovery
Centers where disaster victims can meet with representatives, obtain
information about the recovery process, and register for federal disaster
assistance. Victims may also register with FEMA by telephone or via FEMA's
Internet site. FEMA provides housing assistance to disaster victims
through the Individuals and Households Program (IHP).7 Under the IHP, FEMA
can make grants available to repair or replace housing damaged in a

7FEMA also refers to the IHP program as Individual Assistance (IA).

disaster that is not covered by insurance. However, the IHP is a minimal
repair program that is designed to make the victim's home habitable and
functional, not to restore the home to its predisaster condition. When
disaster victims register for FEMA assistance, they are asked to provide
their approximate household income. If the applicant's income exceeds
certain thresholds, FEMA automatically refers them to SBA's Disaster Loan
Program.8

SBA's Disaster Loan Program is the primary federal program for funding
long-range recovery for private sector, nonfarm disaster victims and the
only form of SBA assistance not limited to small businesses. The Small
Business Act authorizes SBA to make available the following two types of
disaster loans:

     o Physical disaster loans-These loans are for permanent rebuilding and
       replacement of uninsured or underinsured disaster-damaged property.
       They are available to homeowners, renters, businesses of all sizes and
       nonprofit organizations. These loans are intended to repair or replace
       the disaster victim's damaged property to its predisaster condition.
     o Economic injury disaster loans-These loans provide small businesses
       with necessary working capital until normal operations resume after a
       disaster declaration. They cover operating expenses the business could
       have paid had the disaster not occurred. The act restricts economic
       injury disaster loans to small businesses only.

Under a presidential disaster declaration, SBA disaster assistance staff
members secure space within FEMA-established Disaster Recovery Centers and
begin meeting with victims to explain the agency's disaster loan process,
issue loan applications and, if requested, assist victims in completing
applications. Figure 1 illustrates SBA's disaster loan process.

8SBA provides the income thresholds to FEMA, which vary based on the
applicant's household size and are adjusted annually for inflation. For
example, SBA's minimum income threshold for fiscal year 2005 was $13,965
for a household size of one; the threshold increased to $14,355 for fiscal
year 2006. If the applicant's household income falls below the income
thresholds, FEMA will automatically refer them to its Other Needs
Assistance Program. This program provides financial assistance to
individuals and households who have other disaster-related necessary
expenses or serious needs, such as medical expenses.

Figure 1: SBA's Disaster Loan Process

                                  Source: GAO.

During the application entry stage, SBA screens all incoming applications
to determine if they are acceptable.9 In addition, SBA conducts a
preliminary financial analysis of home loan applications to determine
whether the applicant's income falls below the agency's minimum income
thresholds or if repayment ability is evident based on a review of the
applicant's gross income and fixed debts.10 SBA declines home loan
applicants that do not meet its minimum income requirements or demonstrate
repayment ability. SBA also obtains a credit bureau report for business
and home loan applicants, and SBA may decline an applicant based on
information contained in the report. SBA refers to denials made during the
application entry stage as preprocessing declines. SBA intended for these
declines to eliminate delays in notifying applicants about loan denials.
SBA will refer most home loan applicants denied a loan to FEMA for
possible grant assistance under a presidential disaster declaration.11
After the application entry stage, applications move to the loss
verification stage, and SBA staff members scan application documents into
DCMS.12

During the loss verification stage, loss verifiers conduct on-site damage
inspections for physical disaster loan applications to estimate the cost
of restoring damaged property to predisaster condition. Loss verifiers use
tablet personal computers with software tailored to complete and submit
reports electronically into DCMS. The verified loss becomes the basis for
the loan amount. Once the loss verification is complete, an application
moves to the application processing stage, where loan officers check for

9According to SBA's procedures, an acceptable application is one that has
a signed and reasonably completed application form and a fully completed
and signed Tax Information Authorization (Internal Revenue Service Form
8821) for each required taxpayer or entity. SBA returns unacceptable
applications and requests the information needed to make the application
acceptable.

10SBA does not conduct the preliminary financial analysis for home loan
applicants indicating that they (1) are the sole proprietor of a business;
(2) have household income which includes rents, farms, or other nonsalary
sources (not including disability, social security pension, etc.); or (3)
have household income in excess of $50,000. According to SBA officials,
the preliminary financial analysis is not a valid measure of repayment
ability for these individuals because their financial circumstances are
more complex or their income may be able to support a higher debt level.
In these cases, SBA officials stated that a more thorough financial
analysis is warranted, and these applications go through the normal
process.

11FEMA does not provide assistance to cover business-related losses.

12Economic injury loan applications move directly to the application
processing stage after application entry.

duplication of benefits and assess the applicant's credit history and
ability to obtain credit elsewhere.13 Loan officers also examine other
applicant eligibility criteria, including compliance with child support
obligations and history on other federal debt, such as student loans. Loan
officers use a financial analysis tool within DCMS to determine if the
applicant has the ability to repay the loan. As with preprocessing
declines, SBA generally refers home loan applicants denied a loan in
application processing to FEMA for possible grant assistance under
presidential disaster declarations.

For secured loans, legal staff members review the draft loan authorization
and agreement for sufficiency of collateral instruments and other legal
concerns.14 They also create a loan closing checklist-a list of the
requirements necessary to generate the loan closing and other legal
documents. Attorneys enter a legal concurrence into DCMS, which obligates
the loan funds through an interface with SBA's accounting system. Legal
support staff members prepare closing documents and mail them to the
applicant or nearest Disaster Recovery Center. SBA can make a maximum
initial disbursement, without collateral, of up to $10,000 for physical
disaster loans and $5,000 for economic injury disaster loans, once the
agency receives signed closing documents from the applicant. SBA can make
a maximum initial disbursement of up to $25,000 for physical disaster
loans with collateral-preferably real estate.15 SBA generally makes
subsequent disbursements on physical disaster loans based on the
applicant's needs and how they spent prior disbursements.

13SBA is required to determine whether applicants are able to obtain
financial assistance at reasonable rates and terms from nongovernment
sources prior to assigning an interest rate. A higher interest rate
applies for physical disaster loan applicants determined to have credit
elsewhere, and business physical disaster loan applicants are subject to a
maximum 3-year term for repayment. Economic injury disaster loan
applicants are not eligible for disaster loans if SBA determines they can
obtain credit elsewhere. For the Gulf Coast hurricanes, disaster victims
unable to obtain credit elsewhere were assessed an interest rate of 2.687
percent for home loans and 4 percent for business loans and nonprofit
organizations. Disaster victims that could obtain credit elsewhere were
assessed an interest rate of 5.375 percent for home loans, 6.557 percent
for business loans, and 4.75 percent for nonprofit organizations.

14According to SBA procedures, legal review staff members generally do not
review draft loan authorization and agreements for unsecured loans.

15For victims of the Gulf Coast hurricanes, SBA increased to $50,000, the
maximum initial disbursement for physical disaster loans with collateral.

  Large Volume of Applications, Limited Planning, and Various System and
  Processing Related Challenges Affected SBA's Ability to Provide Timely
  Disaster Assistance

DCMS replaced SBA's largely manual, paper-based loan process and its
Automated Loan Control System (ALCS), which it had used since the early
1990s. ALCS enabled SBA to track the movement of paper loan application
files from one stage of the process to another, but the manual loan
process required the movement and storage of large volumes of paper. In
December 1998, SBA began planning for a replacement disaster loan system.
SBA purchased a commercial-off-the-shelf package as the foundation for
DCMS in 2003 and had the package customized. SBA intended for DCMS to help
it move toward a paperless processing environment by automating many of
the functions staff members had performed manually, such as obtaining FEMA
referral data and credit bureau reports, as well as completing and
submitting loss verification reports from remote locations. SBA began a
phased implementation of DCMS in November 2004 at its former Niagara Falls
Disaster Area Office (DAO).16 In January 2005, SBA began using DCMS to
process loan applications for all new disaster declarations and by March
2006, SBA completed the migration of all data for disaster loan
applications processed since 2000 from ALCS to DCMS. According to SBA, the
cost for planning, acquiring, implementing, and operating DCMS totaled
about $32 million through April 2006. See appendix II for a more detailed
discussion of SBA's acquisition and implementation of DCMS.

Large Volume of Applications, Limited Planning, and Various System and Processing
Related Challenges Affected SBAï¿½s Ability to Provide Timely Disaster Assistance

We identified several factors that affected SBA's ability to provide
timely disaster assistance, including a large volume of applications that
exceeded any previous disaster. In addition, although DCMS allowed SBA to
streamline the disaster loan process, SBA focused only on its historical
experience and did not consider the possibility of a single or series of
disasters of the magnitude of the Gulf Coast hurricanes when planning the
system's maximum user requirements. SBA's limited planning contributed to
insufficient DCMS user capacity, which restricted the number of staff that
could access the system and process the large volume of applications in a
timely manner. Further, SBA did not completely stress test DCMS before
implementation to help ensure that it could function at its maximum

16SBA reorganized its Office of Disaster Assistance in 2005 as part of its
workforce transformation initiative. SBA centralized all loan processing
functions for account application and account processing at its former Ft.
Worth (Texas) DAO, which became its PDC. SBA consolidated field
operations, verification, congressional, and public information office
functions at its former Atlanta (Georgia) DAO and Sacramento (California)
DAO, which became its Field Operations Centers East and West. SBA
centralized all victim-related support functions at its former Niagara
Falls DAO, which became its Buffalo (New York) Customer Service Center.

    Large Volume of Loan Applications Affected SBA's Response to Hurricane
    Victims

user capacity and thus did not detect that the wrong processors had been
installed by its hosting contractor and that the system could not support
planned capacity. As a result of these and other processing-related
factors, SBA experienced significant backlogs and delays in processing
applications. Overall, SBA processed disaster loan applications in 74
days, on average, as of May 27, 2006, compared with its goal of within 21
days.

Large Volume of Loan Applications Affected SBAï¿½s Response to Hurricane
Victims

According to SBA officials, the large volume of disaster loan applications
it processed for victims of the Gulf Coast hurricanes was a significant
challenge. The volume of applications associated with these hurricanes
greatly exceeded any disaster in SBA's history. As table 2 shows, as of
May 27, 2006, SBA had issued more than 2.1 million applications to victims
affected by the Gulf Coast hurricanes. This represented almost four times
as many applications as SBA issued to victims of the Northridge
earthquake-the single largest disaster SBA had previously faced. In
addition, our analysis showed that SBA received a large influx of
applications during the initial months following Hurricane Katrina-at the
same time that SBA hired and trained a large number of temporary staff to
process applications received from victims of the disasters. Specifically,
SBA received about 280,000 applications during the first 3 months
following Hurricane Katrina, approximately 30,000 more applications than
SBA received over a period of about 1 year from victims of the Northridge
earthquake.

Table 2: SBA Application Statistics for Gulf Coast Hurricanes and Previous
Disasters

                                                   Applications  Applications 
Event                                                 issued     receiveda 
Gulf Coast hurricanesb                             2,152,793       418,157 
Florida hurricanesc (2004)                           869,577       179,025 
Northridge, California earthquake (1994)             566,260       250,402 
Hurricane Andrew, Florida (1992)                     110,539        40,568 
Upper Midwest floods (1997)                           46,968        18,752 
September 11 terrorist attacks (2001)                 66,893        25,825 

Source: SBA.

Note: According to SBA officials, in 1996, the agency implemented a
combined application for business physical disaster and economic injury
disaster loan applications from the same applicant. The number of
applications issued and received for Hurricane Andrew and the Northridge
earthquake has not been adjusted to reflect this change.

aRepresents applications accepted into DCMS. According to SBA, these
numbers exclude applications that SBA declined during the application
entry stage where the applicant did not meet the agency's minimum income
thresholds or demonstrate repayment ability.

bStatistics for Hurricanes Katrina, Rita, and Wilma as of May 27, 2006.

cIncludes Hurricanes Charley, Frances, Ivan, and Jeanne.

SBA officials told us that the large volume of applications that it mailed
and received resulted in part from the large number of referrals FEMA made
to SBA's Disaster Loan Program without applying SBA's income thresholds,
specifically for disaster victims who registered for disaster assistance
via FEMA's Internet site and did not report any income. According to a
FEMA official, disaster victims who register via FEMA's Internet site can
select the "Income Unavailable/Refused" option if they do not wish to or
cannot provide their income. The official stated that these individuals
are advised that selecting this option will result in an SBA referral. The
FEMA official also stated that, per an SBA request, FEMA refers all
applicants who claim self-employment as their primary source of income to
SBA's Disaster Loan Program, regardless of their income, because the
income tests are not a valid measure of repayment ability for
self-employed applicants. In both cases, FEMA's registration system
automatically fills $0 as the disaster victim's income and refers these
individuals to SBA's Disaster Loan Program. The FEMA official stated that
about 17 percent of the individuals referred to SBA for Hurricanes Katrina
and Rita refused to provide their income, and another 17 percent indicated
that they were self-employed. SBA officials referred to these cases as "$0
income" referrals.

    Limited Planning for DCMS User Capacity Reduced SBA's Ability to Provide
    Timely Disaster Assistance

In February 2006, SBA's Office of Inspector General issued an advisory
memorandum, stating that many $0 income referrals ultimately failed SBA's
criteria for disaster loan eligibility and were processed as declines.17
SBA's Office of Inspector General added that these referrals impacted SBA
by

     o increasing the cost incurred by SBA in mailing loan applications to
       disaster victims that normally would not be referred to SBA's Disaster
       Loan Program;
     o delaying response times for those applicants who did qualify for SBA's
       Disaster Loan Program;
     o lowering SBA's disaster loan approval rates; and
     o increasing the transaction flow through DCMS, which was near maximum
       capacity.

SBA's Office of Inspector General recommended that SBA improve its
screening processes within DCMS when processing $0 income referrals and
work with FEMA to reduce unnecessary online disaster referrals. In
commenting on a draft of the advisory memorandum, SBA agreed that it
should work with FEMA to improve their joint screening process prior to
referral and issuing an SBA disaster loan application.

Limited Planning for DCMS User Capacity Reduced SBAï¿½s Ability to Provide
Timely Disaster Assistance

DCMS provided SBA with a number of benefits compared with its previous
system, such as the capability to complete loss verification reports and
other processing-related tasks electronically. However, SBA planned DCMS's
maximum user capacity based solely on the volume of applications it
received from victims of the Northridge earthquake and its other
historical data; it did not consider the information available from
catastrophe risk modeling firms or disaster simulations such as the
likelihood and severity of damages from potential catastrophes. Although
agencies are not specifically required to consider such information in
developing their system's user capacity requirements, this information
could have helped SBA predict the volume of loan applications to expect
and the necessary user capacity needed to process such a volume. SBA

17SBA Office of Inspector General, "Disaster Application Referrals with $0
Income from FEMA Online Registration Have Increased Costs and the Demand
for SBA Resources," Advisory Memorandum 06-12 (Feb. 17, 2006).

Page 14 GAO-06-860 SBA Diaster Loans

officials acknowledged that they could have considered this information in
planning DCMS's user capacity requirements but lacked the funding to do
so. SBA's limited planning and other system and processing related issues
diminished the agency's ability to provide disaster assistance in a timely
manner.

Many insurance companies and government agencies currently use computer
programs offered by several modeling firms to estimate the financial
consequences of various natural catastrophe scenarios. Risk modeling
firms, which have existed since the late 1980s, rely on sophisticated
mathematical modeling techniques and large databases containing
information on past catastrophes, population densities, construction
techniques, and other relevant information to assess the severity of
potential catastrophes so that other organizations can plan accordingly.
For example, one modeling firm recently estimated that 1.5 million people
were vulnerable to an earthquake on the San Andreas Fault in the San
Francisco area and that an earthquake similar to the 1906 earthquake would
cause an estimated $260 billion in damages to residential and commercial
properties. This study also noted that the U.S. Geological Survey
estimated that there was a 21 percent probability of a major earthquake on
this fault occurring before 2032.18 Another modeling firm study of a
strong hurricane striking the densely populated Northeast region estimated
this event could cause more than $200 billion in economic losses,
including significant damage from flooding to properties and
infrastructure in lower Manhattan and Long Island.19 While SBA would not
utilize this information the way insurance companies do to assess the
financial consequences of potential disasters, catastrophe risk modeling
firms provide important information on the severity of damages from such
events. This information could be helpful in estimating the potential
number of loan applications that SBA could receive for processing and the
concurrent user capacity necessary to process such applications in a
timely manner if such an event were to occur.

Government agencies and other organizations also participate in disaster
simulation exercises to prepare for their response to natural disasters.
While SBA would not use this disaster simulation information to plan a

18Risk Management Solutions, "The 1906 San Francisco Earthquake and Fire:
Perspectives on a Modern Super Cat" (2006).

19AIR Worldwide Corporation, "Insuring and Mitigating the Risk of
Large-Scale Natural Disasters" (2006).

Page 15 GAO-06-860 SBA Diaster Loans

    Ineffective Technical Support Affected the Stability of DCMS and SBA's
    Ability to Provide Timely Disaster Assistance

response to victims' immediate needs, the estimated number of buildings
damaged and number of people evacuated provides important information that
can be considered in planning the user capacity of a disaster loan system.
For example, FEMA brought together numerous officials from local, state,
federal, and volunteer organizations to conduct an exercise referred to as
Hurricane Pam in July 2004. This exercise used realistic weather and
damage information developed by the National Weather Service, the U.S.
Army Corps of Engineers, the Louisiana State University Hurricane Center,
and other state and federal agencies to help officials develop joint
response plans for a catastrophic hurricane in Louisiana. This fictional
hurricane brought sustained winds of 120 miles per hour, up to 20 inches
of rain in parts of southeast Louisiana, and storm surge that topped
levees in the New Orleans area. Hurricane Pam, as projected, destroyed
between 500,000 and 600,000 buildings and forced the evacuation of more
than 1 million residents from the New Orleans area.

In planning the maximum user capacity for DCMS, SBA relied solely on the
volume of applications it received from victims of the Northridge
earthquake and its other historical data, such as the average number of
applications processed for the previous 5 years. SBA did not plan for the
likelihood of a single disaster or series of disasters of the magnitude of
the Gulf Coast hurricanes. If SBA had considered the information available
from catastrophe risk modeling firms or disaster simulations, such as the
likelihood and potential damages from catastrophic events, to help it
predict the volume of loan applications that might be expected and the
user capacity needed to process this volume, the agency may have acquired
additional capacity that would have enabled it to reduce its backlog of
applications sooner. SBA's limited planning contributed to insufficient
DCMS user capacity, which restricted the number of staff that could access
the system and process the large volume of applications in a timely
manner.

Ineffective Technical Support Affected the Stability of DCMS and SBAï¿½s
Ability to Provide Timely Disaster Assistance

SBA experienced instability with DCMS during the initial months following
Hurricane Katrina, as users experienced outages, difficulties connecting
to the system, and slow response times in completing loan processing
tasks. For example, our review of DCMS system logs showed that between
September and December 2005 SBA experienced the following incidents:

     o 19 incidents where DCMS was not available to all system users due to
       an unscheduled outage, and
     o 26 incidents where DCMS was not available to various units due to an
       unscheduled outage.

SBA officials told us that the longest period of time DCMS was unavailable
to users due to an unscheduled outage was 1 business day. These
unscheduled outages and other system-related issues slowed productivity
and affected SBA's ability to provide timely disaster assistance; however,
we could not determine the specific impact on the agency's time frames for
processing disaster loan applications received from Gulf Coast hurricane
victims.

According to SBA officials, ineffective technical support contributed to
the system instability experienced by users, as its hosting contractor did
not properly monitor the DCMS network as contractually required and did
not make the agency aware of incidents that could make the system unstable
prior to DCMS users being affected. In addition, SBA officials told us
that its hosting contractor did not provide the agency with the correct
computer hardware for DCMS as contractually required, which further
contributed to the instability users initially experienced with the system
and reduced processing power by about one-third. Specifically, in
developing DCMS, SBA planned for a maximum capacity of 1,500 concurrent
users. SBA officials told us that they discovered that DCMS was operating
near 100 percent capacity in September 2005 before the agency had reached
its maximum user capacity. At that time, SBA discovered that the hosting
contractor had not provided the agency with the correct computer hardware
required per its contract in order to support 1,500 concurrent users.

However, SBA did not verify that its hosting contractor provided the
agency with the correct computer hardware specified in its contract.
Federal procurement policies require agencies to have trained and
experienced officials available to judge whether contractors are
performing according to contract terms and conditions, particularly when
contracting for highly specialized or technical services.20 In addition,
SBA's internal procurement procedures require that the agency inspect each
item or service provided under a contract, report capital equipment
acquisitions immediately-including computer equipment, and provide a
serial number for capital equipment acquisitions for tracking purposes.
SBA officials did

20Office of Management and Budget, "Management Oversight of Service
Contracting," Policy Letter No. 93-1 (May 18, 1994).

Page 17 GAO-06-860 SBA Diaster Loans

    SBA Did Not Completely Stress Test DCMS to Ensure It Could Function at
    Maximum Capacity

not have an explanation for why the agency did not verify that the hosting
contractor provided the correct computer hardware. If SBA had verified
this equipment as required, the agency might have discovered this issue
prior to the Gulf Coast hurricanes and been able to take the appropriate
corrective action.

SBA Did Not Completely Stress Test DCMS to Ensure It Could Function at
Maximum Capacity

Prior to implementation, SBA did not completely stress test DCMS to ensure
that the system could operate effectively at maximum capacity, which
contributed to the initial system instability SBA experienced. In 2003,
SBA began testing various aspects of DCMS, including the core application
interfaces and additional components such as loss verification and
scanning. Although SBA conducted performance testing for DCMS, we found
that the agency only stress tested the system for up to 120 concurrent
users due to limitations with the hardware in the testing environment. The
testing environment simulated an increasing number of concurrent users and
exercised different functional scenarios, but the hardware used in the
simulation reached its capacity earlier than anticipated. Even if the
testing environment functioned as planned, an estimate showed that DCMS
could accommodate approximately 600 concurrent users at this
time-significantly less than the system's planned maximum capacity of
1,500.

According to leading information technology organizations, to be
effective, practices for testing software should be planned and conducted
in a structured and disciplined environment.21 Typically, this involves
testing increasingly larger increments of a system until the complete
system and all of its functionality are tested and accepted. It also
involves stress testing and fully demonstrating the effectiveness and
accuracy of the system. Additionally, SBA's internal systems development
manual requires that the agency determine testing and acceptance criteria
that must be met for a system to be accepted as "fit for use" by the user
or sponsoring organization and requires user or sponsoring organization
approval of all acceptance criteria. Further, the manual identifies how
acceptance testing is to be conducted and reported to determine whether
the system meets its requirements upon completion of its development. In
doing limited stress testing of DCMS, SBA did not completely follow its
own requirements or

21For more information, see GAO, Aviation Security: Secure Flight
Development and Testing Under Way, but Risks Should Be Managed as System
Is Further Developed, GAO- 05-356 (Washington, D.C.: Mar. 28, 2005).

Page 18 GAO-06-860 SBA Diaster Loans

    Other Processing Related Challenges Affected SBA's Ability to Provide Timely
    Disaster Assistance

industry best practices for systems testing. When these requirements are
not met, there is potential risk that the implemented system will not meet
the system requirements. If SBA had conducted complete stress testing, the
agency might have detected that it did not receive the correct equipment
and had an opportunity to address this issue before implementing DCMS.

Other Processing Related Challenges Affected SBAï¿½s Ability to Provide Timely
Disaster Assistance

Because of the unpredictable nature of disasters and the cost of
maintaining staff that it might not need, SBA hires and trains a large
number of temporary staff to help process loan applications following any
large scale disaster, such as the Gulf Coast hurricanes. SBA also has a
disaster reserve corps, a group of experienced individuals it relies upon
who have worked with the agency in responding to previous disasters and
are trained in its disaster loan process. SBA officials told us that it
generally took approximately 30 days for loan officers without prior SBA
experience to become fully productive. This slows processing during the
initial months following a disaster, as loan officers become familiar with
SBA's disaster loan process and DCMS. In response to the Gulf Coast
hurricanes, SBA also had to secure additional space and equipment to
support loan processing. According to SBA officials, this process took
approximately 30 to 60 days. As figure 2 shows, as the average number of
loan processing staff increased, SBA generally processed more applications
than it did during the first 2 months following Hurricane Katrina.

Figure 2: Number of Disaster Loan Applications Processed and Average
Staffing Levels by Month, September 2005 to May 2006

Applications processed (in thousands) Staff

      100 3,500

3,000

80

      2,500

60

2,000

      1,500

40

      1,000

20

500

0

0

1 2 3 4 5 6 789 Months after Hurricane Katrina

Average number of staff

Applications processed Source: GAO analysis of SBA data.

Because SBA normally relies on temporary staff to help process loan
applications after large disasters, it might be unrealistic to expect the
agency to process a large volume of applications quickly during the
initial period following such disasters.

The geographic dispersion of disaster victims-in particular for Hurricanes
Katrina and Rita-also affected SBA's ability to provide timely disaster
assistance. Figure 3 illustrates the location of displaced applicants
affected by these disasters that registered for FEMA IA. These applicants
relocated to all 50 states, with the largest concentrations in Louisiana,
Mississippi, and Texas. SBA officials told us that FEMA referred many of
these applicants to its Disaster Loan Program, and their widespread
geographic dispersion made it more challenging to provide timely disaster
assistance. Loan officers we met with also told us that contacting
applicants to discuss the status of their loan application was difficult
in some cases-particularly during the initial months following the
disasters, as some applicants had moved or changed employment several
times since applying for disaster assistance. Thus, SBA did not always
have an applicant's most current information, which slowed the processing
of their application.

Figure3: FEMA IA Applicants' Current Location by State as of April 10,
2006

Sources: Copyright (c) Corel Corp. All rights reserved (map) and FEMA
(data).

Note: These are applicants that registered for Hurricanes Katrina and Rita
only.

    As a Result of These Factors, SBA Did Not Significantly Reduce Its Backlog
    of Applications until Several Months after Hurricane Katrina

Our analysis showed that it took SBA several months to significantly
reduce the backlog of applications that developed in various stages of its
disaster loan process because of the large volume of applications, limited
planning for DCMS, and other processing-related challenges. For example,
SBA did not clear the backlog in the application entry stage until nearly
3 months following Hurricane Katrina. SBA nearly cleared the backlog in
the loss verification stage 8 months after the disaster when the backlog
was reduced to less than 1,800 applications. However, at that time, SBA
still needed to complete loan processing for about 25,000 applications.

As figure 4 shows, SBA's backlog in the loss verification and application
processing stages increased significantly during the first 3 months
following Hurricane Katrina as SBA began receiving a large volume of
applications from victims of the other hurricanes. These backlogs combined
peaked at over 204,000 applications in late December 2005. Figure 4 also
shows that, individually, SBA's backlog in the loss verification stage
peaked at almost 129,200 applications about 3 months following Hurricane
Katrina, and the backlog in the application processing stage peaked at
more than 121,700 applications nearly 6 months after the disaster. As a
result of the backlogs, victims of the Gulf Coast hurricanes waited about
74 days on average for SBA to process their loan applications, compared
with the agency's goal of within 21 days.

Figure 4: Backlog of Applications in Loss Verification and Application
Processing Applications(in thousands)

      Months following Hurricane Katrina

Total

Loss verification

Application processing Source: GAO analysis of SBA data.

Figure 5 shows SBA's average processing time frames for approval and
decline decisions made between mid-October 2005 and May 2006 compared with
its goal of within 21 days. Although SBA began to reduce the total backlog
in loss verification and application processing in late December 2005,
average processing time frames for approval and decline decisions
generally increased through May 2006 because of the average age of
applications in the backlog. For example, SBA reduced the backlog in
application processing to less than 4,500 by late May 2006; however,
average processing time frames were still significantly higher than its
goal because loan applications had been in the application processing
queue for a long time-about 63 days on average.

Figure 5: Average Processing Time Frames for Approval and Decline
Decisions, October 2005 to May 2006 Days100

Approvals

80

60

Declines

40

Goal

20

0

      22 29 5 12 19 26 3 10 17 24 31 7 14 21 284 11 1825 4 11 1825 1 815 22 29 6
      13 20 27 October

November

December January

                                    February

March

April

May

                                Week-ending date

2006

Source: GAO analysis of SBA data for 2005 Gulf Coast hurricanes.

SBA's processing average for approvals does not include additional time
frames for loan closings and initial disbursements. For example, SBA
received signed closing documents from borrowers about 35 days, on
average, after making the approval, as of May 27, 2006. According to SBA
officials, delays in closing loans were mostly the result of factors
beyond their control. For example, SBA officials stated that they
scheduled loan closings at the convenience of the borrower. These
officials added that because of the displacement of Gulf Coast hurricane
victims, SBA had closed about 50 percent of disaster loans by mail, a
higher percentage than previous disasters, which generally takes more time
than closings done in person. SBA officials also stated that there were a
significant number of disaster victims who had not returned to the
affected area and who had expressed uncertainty about rebuilding their
homes and businesses. As a result, these victims had been reluctant to
quickly close on their loans. SBA's disaster lending procedures generally
require applicants to close loans within 60 days of the date on the loan
authorization and agreement. These procedures also allow SBA to accept
loan closing documents after 60

  SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees of Success

days on a discretionary basis. SBA officials told us they had allowed Gulf
Coast hurricane victims additional time to determine if they really wanted
the loan. To facilitate loan closings, SBA officials also told us they
used staff to conduct follow-up calls with borrowers after closing
documents were mailed.

In addition, our analysis of an SBA data extract further showed that the
agency made an initial disbursement for approved loans on average about 9
days after the receipt of closing documents. As of May 27, 2006-9 months
after Hurricane Katrina-SBA had disbursed about $1.4 billion or 14 percent
of the $9.7 billion approved loan dollars. As of the same date, about
73,000 approved loans had not been fully disbursed to disaster victims. As
with loan closings, SBA officials stated that the length of time it took
to disburse disaster loans was primarily determined by the borrower. SBA's
disaster lending procedures require borrowers to arrange for and obtain
all loan funds within 12 months from the date of the loan agreement.
However, SBA officials told us that it might be difficult for some
disaster victims to meet this requirement. In our subsequent report on
SBA's response to the Gulf Coast hurricanes, we plan to discuss the
perspectives of disaster victims related to the disaster loan process.

SBAï¿½s Actions after the Gulf Coast Hurricanes Had Varying Degrees of
Success

Although SBA took several actions after the Gulf Coast hurricanes to
improve its response to disaster victims, our analysis showed that some of
these actions were more successful at reducing the backlog of loan
applications than others. For example, SBA increased the number of
concurrent users that could access DCMS by acquiring additional computer
hardware and adding a second work shift for loan processing staff to
better balance the system's workload. In addition, SBA initiatives to
relax filing requirements for applicants whose business records were
destroyed and establish a satellite office to process disaster loans at
its former Sacramento DAO allowed SBA to improve its response to disaster
victims. However, SBA did not experience as much success with its
initiatives to expedite small business financing to communities affected
by the disasters and use private sector banks to process disaster loan
applications. As a result, some of SBA's initiatives did not significantly
reduce the backlog of loan applications or the time victims waited for SBA
to process their disaster loan applications.

    SBA Took Actions to Address DCMS Instability and Other System-Related Issues

As previously discussed, SBA initially experienced instability and other
issues with DCMS. However, the agency took actions to address these
issues. In October 2005, SBA obtained the computer hardware, as agreed to
with its contractor, that increased DCMS's capacity to about 2,000
concurrent users. SBA also obtained additional support from its hosting
contractor, at no additional cost, to ensure adequate monitoring of the
DCMS network. By November 2005, because DCMS continued to operate near its
maximum capacity, SBA added a second shift for loan processing staff at
its Fort Worth processing facility to better balance DCMS's workload.
According to SBA officials, DCMS had been stable since January 2006, and
users reported having a greater comfort level and more success in
processing applications using the system. The officials added that the
hosting contractor had provided better oversight over DCMS compared with
the initial months following Hurricane Katrina. In April 2006, SBA
officials advised us that the agency had not made any payments to its
hosting contractor since August 2005 because it did not satisfy contract
requirements, and negotiations were under way to determine the amount of
any subsequent payments.

In preparation for the 2006 hurricane season, SBA awarded a new contract
in April 2006 for up to $54 million to its integration contractor to
provide project management and information technology support for DCMS
over the next 5 years. This contractor will continue to upgrade the system
to support increased loan processing activity by implementing software
changes and hardware upgrades, providing ongoing support to DCMS users,
and supporting all information technology operations associated with the
system under the contract. In addition, SBA has plans to increase DCMS's
maximum user capacity to at least 8,000 concurrent users by the summer of
2006. However, we could not determine how SBA selected this number or
whether the agency considered the information available from catastrophe
risk modeling firms or disaster simulations in determining the planned for
increase in maximum user capacity. To facilitate this planned capacity
increase, SBA added on to and extended the contract with its hosting
contractor in February 2006. Although SBA had experienced problems with
the initial oversight provided by this hosting contractor, according to
agency officials, the contractor's performance had improved. For example,
the contractor had dedicated a project manager to this effort. Because of
these improvements and the contractor's familiarity with SBA's needs,
agency officials decided that the contractor could provide a hardware
solution for the expanded capacity within the agency's time frames.

    SBA's Processing Changes and Other Initiatives Had Varied Success

After the Gulf Coast hurricanes, SBA made several changes to its disaster
loan process and implemented other initiatives intended to improve its
response to victims. While some of these initiatives improved SBA's
ability to process large numbers of disaster loan applications, others did
not. For example, in October 2005, SBA established a satellite office to
process disaster loans at its former Sacramento DAO.22 SBA increased the
number of loan processing staff in this Sacramento satellite office from
approximately 40 in late August 2005 to more than 250 by February 2006.
According to SBA, 8 months after Hurricane Katrina, the Sacramento
satellite office had processed about 95,500 home and 4,800 business
applications through DCMS for Gulf Coast hurricane victims.23 Table 3
describes other SBA changes or initiatives that improved its response to
disaster victims by making the application process easier or referring
some applicants to FEMA for grant assistance sooner.

    Table3: Other Changes SBA Made after Gulf Coast Hurricanes That Improved
                          Response to Disaster Victims

Name                          Date          Description                    
Revised filing requirements   October 2005  Reduced filing requirements    
for business applicationsa                  for all business applicants,   
                                               such as tax returns for past   
                                               three years and monthly sales  
                                               analysis because these records 
                                               may have been destroyed. This  
                                               initiative enabled victims to  
                                               file their applications        
                                               sooner.                        
Alternate loss verification   October 2005  Authorized loss verification   
methods                                     staff to perform verifications 
                                               for home loan applicants using 
                                               third party documentation in   
                                               certain areas and to verify    
                                               property damages without the   
                                               applicant being present in     
                                               certain cases.                 
Revised preprocessing decline November 2005 Used DCMS to automatically     
procedures                                  decline applicants with credit 
                                               scores indicating a high       
                                               degree of default risk to      
                                               refer applicants to FEMA for   
                                               possible grant assistance      
                                               sooner than the normal         
                                               process.                       

Source: GAO analysis of SBA data.

aChange made for Hurricanes Katrina and Rita only.

22SBA had planned to phase out loan processing operations at this office
by the end of October 2005, as it became the Field Operations Center West
under SBA's transformation initiative.

23SBA also used the Sacramento satellite office to process about 10,700
home loan applications for smaller disaster declarations.

Page 28 GAO-06-860 SBA Diaster Loans

In contrast to these actions, SBA implemented other initiatives that had
more limited success. For example, in November 2005, SBA implemented the
GO Loan Program. SBA intended for this program to expedite small business
financing for communities severely impacted by Hurricanes Katrina and
Rita. This program provided an 85 percent guaranty to qualified lending
partners, such as banks, that agreed to make expedited loans available
under the agency's 7(a) loan program up to $150,000 to small businesses
located in communities affected by the disasters. Under the GO Loan
Program, small businesses applied directly to qualified lenders, who
evaluated their creditworthiness and determined if they required an SBA
guaranty to make the loan. SBA agreed to make a decision on whether to
apply a guaranty to the loan within 24 hours. While SBA prescribed the
maximum interest rate lenders could charge, the lender and borrower
negotiated the actual rate. For loans of $50,000 or less, lenders could
charge a maximum interest rate of 6.5 percentage points over the prime
rate and a maximum rate of 4.5 percentage points over the prime rate for
loans over $50,000. Thus, lenders could charge disaster victims interest
rates that were significantly higher under the GO Loan Program than the
rates SBA charged under the Disaster Loan Program. For example, a disaster
victim applying for a $60,000 GO Loan could have been charged an interest
rate up to 11.5 percent in November 2005 when the prime rate was 7
percent. In contrast, a business owner not able to obtain credit elsewhere
would have received a 4 percent rate under the Disaster Loan Program. SBA
only guaranteed 222 GO Loans totaling $19 million through May 2006. The
higher interest rates lenders could charge under the GO Loan Program made
these loans less attractive than SBA disaster loans and likely contributed
to the small number of loans made under the program.

In December 2005, SBA implemented a pilot program to expedite the
processing of disaster loan applications. Under this program, DCMS made
automatic approval recommendations for applicants with credit scores
indicating that they were less likely to default on a loan, and loan
officers did not have to conduct the lengthy repayment analysis for these
applications. According to SBA, loan officers processed 8 to 10 home loan
applications per day, on average, under the pilot program-about twice as
many applications as under the normal process. However, loan officers did
not review DCMS-generated approval recommendations until after the loss
verification stage under the program. In addition, when SBA implemented
the pilot program, the agency faced a significant backlog of 115,000
applications in the loss verification stage, and these applications had
been in the queue for 39 days on average.24 As a result, SBA's data showed
that the agency actually took longer to process expedited approvals
compared with SBA's average processing time frames for all approvals.
Specifically, SBA processed expedited approvals in about 104 days on
average between December 2005 and April 2006, compared with 94 days for
all approvals processed through the end of April 2006. If SBA had
implemented this initiative sooner when the backlog in loss verification
was not so large or if the agency had implemented an expedited loss
verification process for these applications, the pilot program may have
been more effective in reducing the amount of time disaster victims waited
for a decision on their application. Table 4 describes other SBA actions
or initiatives that did not significantly reduce the backlog of loan
applications because they were either not implemented in a timely manner
or did not fully incorporate the use of DCMS to process applications.

  Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had Limited
                                    Success

Name                        Date           Description                     
Give a Lending Hand         November 2005  Requested volunteers from the   
Initiative                                 business lending community to   
                                              help process business disaster  
                                              loan applications. SBA hired    
                                              only 14 individuals under the   
                                              initiative.                     
District office processing  January 2006   Used district office staff to   
of disaster home loan                      manually process home loan      
applications                               applications using paper copies 
                                              of the loan applications. This  
                                              was a labor and time intensive  
                                              process because district office 
                                              staff did not have access to    
                                              DCMS, and SBA's Fort Worth PDC  
                                              staff had to compile and ship   
                                              files, make corrections to      
                                              files returned, and input       
                                              completed decisions into DCMS.  
Presolicitation notice for  January 2006   Issued a presolicitation notice 
loss verification servicesa February 2006  for contractors to perform loss 
Disaster Loan Partners                     verifications nearly 5 months   
                                              after Hurricane Katrina. SBA    
                                              decided not to issue a          
                                              solicitation because the agency 
                                              had significantly reduced the   
                                              backlog of applications in loss 
                                              verification by February 2006.  
                                              Solicited proposals from local  
                                              banks and other entities to     
                                              process disaster loan           
                                              applications. Similar proposal  
                                              made by private sector banking  
                                              association in October 2005.    
                                              According to SBA, the agency    
                                              decided to make three separate  
                                              awards but received requests    
                                              for debriefings from several    
                                              unsuccessful entities. SBA      
                                              determined it could not move    
                                              forward on awarding specific    
                                              task orders under the           
                                              initiative until the agency     
                                              conducted the debriefings, and  
                                              the protests were resolved.     

Source: GAO analysis of SBA data.

aChange made for Hurricanes Katrina and Rita only.

24Applications for Hurricanes Katrina and Rita only.

    SBA May Be Able to Process Applications More Efficiently

DCMS provided SBA with opportunities to help the agency move toward a
paperless processing environment by automating many of the functions the
agency previously performed manually, such as obtaining FEMA referral data
and credit bureau reports as well as completing and submitting loss
verification reports from remote locations. SBA officials also told us
that DCMS improved its ability to process disaster loans, and the agency
would have experienced even greater processing delays using its previous
system and loan process. However, we found other potential opportunities
during our review that might help SBA to process loans more efficiently
and move closer to its goal of processing loan applications within 21 days
when faced with disasters.

For example, SBA may be able to increase the efficiency of its application
entry process by implementing a secure Internet-based application feature
for home loan applicants. Currently, SBA accepts only paper loan
application documents from disaster victims, and data-entry staff manually
input application data into DCMS. According to the Direct Loan Systems
Requirements issued by the Joint Financial Management Improvement Program,
federal agency loan systems "should provide for an electronic application
process using various media, such as a secure Internet application."25 SBA
could reduce the number of paper application documents it receives, the
number of documents it subsequently scans into DCMS, and the resources and
time required to input application data by capturing much of this
information electronically. According to SBA officials, DCMS has the
capability to interface with a secure Internet-based application feature
where this data could be captured electronically. However, SBA did not
attempt to add this functionality after the Gulf Coast hurricanes because
of the instability it initially experienced with DCMS. SBA officials added
that the agency concentrated its efforts on expanding the capacity of DCMS
and would examine adding this functionality to the system in the future.

25The Joint Financial Management Improvement Program is a joint and
cooperative initiative to improve financial management practices in the
government and was authorized under the Budget and Accounting Procedures
Act of 1950. The program promotes strategies and guides financial
management improvement across government; reviews and coordinates central
agencies' activities and policy promulgations; and acts as a catalyst and
clearinghouse for sharing and disseminating information. See JFMIP Direct
Loan System Requirement: June 1999.

SBA officials told us that, prior to the Gulf Coast hurricanes, the agency
initiated a business process reengineering effort within ODA to reevaluate
the disaster loan process. As part of this effort, ODA planned to (1)
determine what type financial analysis would be performed for applicants
with credit scores indicating a high degree of default risk, (2) design a
streamlined loan application (both paper and electronic), and (3) identify
policy and legislative changes required to implement the new process.
However, ODA postponed this effort after the Gulf Coast hurricanes because
of the resources needed to meet the demands of the disaster loan program.
Business process reengineering can help organizations identify, analyze,
and redesign their core business processes with the aim of achieving
dramatic improvements in critical performance measures such as cost,
quality, service, and speed. According to SBA officials, it has plans to
resume this effort in 2006 in order to identify ways to more efficiently
process disaster loan applications and to maximize the benefits of DCMS.

Conclusions

The Gulf Coast hurricanes presented SBA with unprecedented challenges
that, in combination, led to significant backlogs and delays in processing
disaster loan applications. For example, SBA faced the largest volume of
disaster loan applications in its history, as the United States
experienced three extremely destructive natural disasters over a period of
about 2 months. This large volume was due in part to the large number of
applicants automatically referred to SBA by FEMA's Internet site, many of
whom ultimately did not qualify for disaster loans. We also agree that SBA
should improve its screening process within DCMS when processing "$0
income" referrals and continue to work with FEMA to reduce unnecessary
online disaster referrals, as recommended by SBA's Office of Inspector
General. In addition, various system and processing-related issues also
challenged SBA, such as a new disaster loan system that was not designed
to effectively respond to a disaster of this magnitude and that was unable
to operate at the planned maximum capacity. Moreover, SBA based the
maximum number of concurrent users for DCMS solely on its historical
experience rather than considering information available from catastrophe
risk modeling firms and disaster simulations, such as the likelihood and
severity of damages from potential catastrophes to help predict the volume
of applications that it might expect from such events. While SBA has plans
to greatly expand its capacity of concurrent users for DCMS and should be
more capable of processing larger volumes of loan applications once it
achieves this increased capacity, it is not clear how the agency
determined the new maximum number of concurrent users and whether this new
capacity will be appropriate to handle future large scale disasters like
the Gulf Coast hurricanes. If SBA had considered information available
from catastrophe risk modeling firms and disaster simulations to help
predict the volume of loan applications it could expect to receive, SBA
could have made better informed decisions and might have acquired
additional capacity that could have enabled SBA to reduce the backlog of
applications in a more timely manner. Such an analysis would also better
position SBA to determine its loan processing capacity for future
disasters. SBA's limited planning was further exacerbated by the lack of
complete stress testing and the ineffective technical support provided by
the hosting contractor. If SBA had appropriately stress tested the system
before implementation, it might have discovered before the Gulf Coast
hurricanes struck that it had received the incorrect computer hardware.
Going forward, SBA would benefit from improving its process for verifying
that the equipment provided by contractors meets all required
specifications.

While some of SBA's initiatives improved its response to disaster victims,
other efforts did not help the agency significantly reduce the large
backlog of applications because they were either not implemented in a
timely manner, not attractive to the applicant, or did not fully
incorporate the use of DCMS to process applications. If some of these
initiatives had been implemented soon after the Gulf Coast hurricanes
struck, they might have enhanced SBA's ability to process a large volume
of loan applications in a timely manner. In addition, DCMS has the
capability to interface with an Internet-based application feature that
could reduce the resources and time required to input application data for
home loan applicants by capturing much of this information electronically.
As the 2006 Atlantic hurricane season has already begun, SBA would benefit
by expediting its plans to resume its business processing reengineering
efforts to analyze ways to more efficiently process loan applications,
including an evaluation of implementing an Internet-based application
feature.

Recommendations for Executive Action

In order to provide more timely disaster assistance in the future, we
recommend that the Administrator of SBA direct the Office of Disaster
Assistance to take the following four actions:

o  reassess DCMS's maximum user capacity and related loan processing
resource needs based on such things as lessons learned from the Gulf Coast
hurricanes, a review of information available from catastrophe risk
modeling firms and disaster simulations, and related cost considerations;

     o conduct complete stress testing to ensure that DCMS can function at
       planned for maximum user capacity levels;
     o improve management controls over assessing contractor performance
       through inspections of all equipment purchased or leased to support
       DCMS; and
     o expedite plans to resume business process reengineering efforts to
       analyze the disaster loan process and identify ways to more
       efficiently process loan applications including an evaluation of the
       feasibility of implementing a secure Internet-based application
       feature for home loan applicants.

  Agency Comments and Our Evaluation
  
We provided SBA with a draft of this report for review and comment. The
Associate Administrator for Disaster Assistance provided written comments
that are presented in appendix III. In these comments, SBA provided
additional context regarding the magnitude of the disasters and the impact
on the Disaster Loan Program. SBA stated that it generally agreed with our
recommendations and intended to improve the delivery of the Disaster Loan
Program for events of all sizes. However, SBA disagreed with the following
four findings and conclusions in our draft.

First, SBA disagreed with our conclusions that it performed limited
planning and that it would have been better prepared to reduce the backlog
of applications through the use of catastrophe risk models rather than
relying primarily on the Northridge earthquake to establish its capacity
needs. As we noted in our report, SBA planned the maximum user capacity
for DCMS based on the volume of applications it received from victims of
the Northridge earthquake-the single largest disaster SBA had previously
faced-and did not anticipate the likelihood of a single disaster or series
of disasters of the magnitude of the Gulf Coast hurricanes. We continue to
believe that catastrophe risk modeling firms and disaster simulations
provide critical information, such as the likelihood and severity of
damages from potential catastrophes. Combined with other elements of a
comprehensive planning process, such information would have been useful in
planning the maximum user capacity of DCMS. If SBA had considered this
information, the agency may have concluded that the likelihood of large
scale disasters exceeding the magnitude of the Northridge earthquake was
significant enough to expand its maximum concurrent user requirement. This
additional capacity would have better prepared SBA to reduce the backlog
of loan applications more rapidly because additional staff in all phases
of the loan application process would have been able to access DCMS.

Second, SBA stated in its comments that our draft report does not include
an analysis of the difference between using DCMS and ALCS-SBA's previous
system. SBA also highlighted in its comment letter many of the benefits
offered by DCMS. While it was not in the scope of our work to conduct a
comparative analysis of ALCS and DCMS, our report recognized some of the
benefits realized by adopting DCMS. For example, we noted that ALCS
tracked the movement of paper loan application files from one stage of the
loan process to another and required the movement and storage of large
volumes of paper. We also noted that DCMS helped SBA move toward a
paperless processing environment by automating many of the functions staff
members had performed manually using ALCS such as obtaining FEMA referral
data and credit bureau reports, as well as completing and submitting loss
verification reports from remote locations.

Third, SBA stated that the draft report does not indicate that the
specific computer components, which the hosting contractor incorrectly
provided, were processing chips that were embedded subcomponents of the
computer servers, which SBA personnel could only detect by opening and
dismantling the computer hardware. We agree that the hardware was embedded
in the computer servers and could have been verified by physical
inspection. SBA conducted such an inspection in September 2005. However,
alternative ways of verifying the computer hardware were possible. For
example, SBA staff could have used its system utilities to view details of
the hardware and operating system after the processors were installed and
may have detected the incorrect processors and taken corrective actions in
a more timely manner.

Finally, SBA took issue with our finding that it actually took longer to
process expedited approvals under a pilot program, compared with its
average processing time frames for all approvals. SBA stated that our
interpretation of the data was misleading because it did not adjust for
the length of time an application was in the loss verification inventory
before being assigned to the loan department for processing. We disagree
that our interpretation of the data was misleading because all physical
disaster loan applications had to go through loss verification before a
decision was made, regardless of whether the application was part of the
expedited pilot program. While the expedited approval pilot program may
have reduced the amount of time for loan officers to complete the
underwriting decision, our intent, consistent with our overall objective,
was to show the total time disaster victims waited for SBA to make a
decision on their application. This includes the time an application is in
other stages of the disaster loan process, such as application entry and
loss verification. As we noted in our report, SBA implemented the pilot
program when the agency faced a significant backlog of 115,000
applications in the loss verification stage, and these applications had
been in the queue for 39 days on average. SBA's data showed that the
agency actually took longer to process expedited approvals, about 104 days
on average, compared with 94 days on average for all approvals. We
continue to believe that it is appropriate to consider the total
processing time frames when comparing applications approved under the
pilot program with all approved applications.

SBA also provided other technical corrections and comments, which have
been incorporated in this report, where appropriate.

We are sending copies of this report to appropriate congressional
committees, the Administrator of the Small Business Administration, and
other interested parties and will make copies available to others upon
request. In addition, the report will be available at no charge on the GAO
Web site at http://www.gao.gov.

If you or your staff have any questions regarding this report, please
contact me at (202) 512-8678 or [email protected]. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on the
last page of this report. GAO staff who made major contributions to this
report are listed in appendix IV.

William B. Shear

Director, Financial Markets and Community Investment

List of Addressees

The Honorable William Thad Cochran Chair Committee on Appropriations
United States Senate

The Honorable Susan M. Collins Chair The Honorable Joseph I. Lieberman
Ranking Minority Member Committee on Homeland Security

and Governmental Affairs United States Senate

The Honorable Olympia J. Snowe Chair The Honorable John F. Kerry Ranking
Minority Member Committee on Small Business and Entrepreneurship United
States Senate

The Honorable Richard C. Shelby Chair The Honorable Barbara A. Mikulski
Ranking Minority Member Subcommittee on Commerce, Justice, and Science
Committee on Appropriations Unites States Senate

The Honorable Tom Davis Chair The Honorable Henry A. Waxman Ranking
Minority Member Committee on Government Reform House of Representatives
The Honorable Donald Manzullo Chair The Honorable Nydia M. Velazquez
Ranking Minority Member Committee on Small Business House of
Representatives

The Honorable Frank R. Wolf Chair The Honorable Alan B. Mollohan Ranking
Minority Member Subcommittee on Science, State, Justice, Commerce,

and Related Agencies Committee on Appropriations House of Representatives

The Honorable Dianne Feinstein United States Senate

The Honorable Mary L. Landrieu United States Senate 

Appendix I

Scope and Methodology

In this report, we evaluate: (1) what affected the Small Business
Administration's (SBA) ability to provide timely disaster assistance and
(2) the actions SBA took after the disasters to improve its response to
disaster victims. This report focuses primarily on the Disaster Credit
Management System (DCMS) and the disaster loan process. We visited the
Gulf Coast region to observe conditions and meet with federal, state, and
local officials and victims of the disasters. We also interviewed
officials from the Office of Disaster Assistance at SBA's headquarters and
officials from the Processing and Disbursement Center in Texas, Field
Operations Centers East and West in Georgia and California, Customer
Service Center in New York, DCMS Operations Center in Virginia, and
Georgia District Office. We reviewed SBA's standard operating procedures
for approving, declining, and withdrawing disaster loans. In addition, we
reviewed documents related to the agency's response to the Gulf Coast
hurricanes, congressional testimony, and other program documentation.

We reviewed documents related to SBA's acquisition and implementation of
DCMS. In addition, we discussed the acquisition process with officials
from SBA's DCMS Operations Center, which provides technical and program
management support for the system. We also reviewed SBA's standards for
system development and compared the acquisition process for DCMS with
industry standards for effective information technology acquisition.
Further, we interviewed officials from SBA's Office of Inspector General
and reviewed their reports related to the implementation of DCMS and SBA's
Disaster Loan Program. We did not conduct a comparative analysis of DCMS
and ALCS-SBA's previous system-as part of our work. To obtain the
perspectives of system users, we interviewed loan processing staff at
various SBA locations. We also obtained SBA's total costs for planning,
acquiring, and implementing DCMS through April 2006. However, we did not
audit the reported costs and thus cannot attest to their accuracy or
completeness.

We obtained documents related to the performance of DCMS, including system
status reports, troubleshooting reports, and system change requests. We
reviewed these documents to assess the extent to which system-related
problems detailed in the documents affected SBA's ability to provide
timely disaster assistance. In addition, we obtained various reports on
SBA's disaster lending activity for victims of Hurricanes Katrina, Rita,
and Wilma. We used these reports to calculate descriptive statistics on
the number of applications mailed and received, the number and amount of
approved loans, the backlog of applications in various stages, and other
characteristics for applications processed through May 27, 2006. For

Appendix I Scope and Methodology

comparative purposes, we also obtained summary statistical reports related
to SBA's disaster lending for past significant disasters. We also obtained
data extracts from DCMS of disaster loan applications SBA received from
victims of Hurricanes Katrina, Rita, and Wilma for various dates. We used
the extracts to calculate average time frames for various stages of the
disaster loan process.

In assessing the reliability of SBA's data, we reviewed documents such as
the DCMS Privacy Act Assessment and met with appropriate SBA officials. To
increase our confidence in the reliability of SBA's data, we compared
information from selected hard copy application files with the information
recorded in DCMS. We also performed various tests of the information in
the data extracts we obtained to ensure the completeness of the data. We
concluded that SBA's data were sufficiently reliable for the purposes of
our report.

To evaluate actions SBA took after the disasters to improve its response
to disaster victims, we reviewed documents related to changes SBA made to
DCMS and changes SBA planned to make to the system. We discussed these
changes with officials from SBA's DCMS Operations Center. In addition, we
obtained and reviewed documents related to changes SBA made to the
disaster loan process and other initiatives intended to improve SBA's
response to disaster victims. We discussed these changes and initiatives
with the appropriate SBA officials and obtained data on the impact of
these efforts where available.

We reviewed documents related to the Federal Emergency Management Agency's
(FEMA) Individuals and Households Program, which makes assistance
available to victims of major disasters. We also contacted FEMA to obtain
additional information regarding the agency's process for referring
applicants to SBA's Disaster Loan Program.

We performed our work in Atlanta, Ga.; Buffalo, N.Y.; Fort Worth, Tex.;
New Orleans and Metarie, La.; Sacramento, Calif.; Bay St. Louis, Biloxi,
Gulfport, and Waveland, Miss.; Herndon, Va.; and Washington, D.C. We
conducted our work between November 2005 and July 2006 in accordance with
generally accepted government auditing standards.

Appendix II

SBA's Acquisition and Implementation of the Disaster Credit Management System

Since the early 1990s, SBA utilized its Automated Loan Control System to
track the movement of paper application files from each stage of the
process until it made a decision on the application, disbursed funds for
approved applications, and transferred the application file to servicing.
SBA also obtained data manually from external data sources, including
FEMA, the Internal Revenue Service (IRS), and the credit reporting
agencies. In December 1998, after using a significant number of resources
in response to victims of Hurricane Georges, which struck Puerto Rico that
previous September, SBA began an effort to modernize its manual and
paper-based disaster loan process.

SBA intended for its new disaster loan system to support: (1) a
"paperless" electronic loan application and loan process, (2) loan
processing from any location where the system is implemented, (3) multiple
interaction methods between loan applicants and the Office of Disaster
Assistance (e.g., by Internet or telephone), and (4) access to external
data sources. The modernization effort entailed the following actions:

     o documenting SBA's current loan process and proposed future loan
       process;
     o performing requirements analysis, conducting a
       commercial-off-the-shelf (COTS) market survey, and developing a
       business case; and
     o acquiring, customizing, and implementing the system.

In March 1999, SBA completed a business process reengineering study to
document the current process and proposed future process. In August 2000,
SBA completed the initial development of the new system requirements.
Subsequently, SBA contracted for a COTS survey of products meeting its
requirements and leveraging its other information technology resources.
The survey identified two products that met a significant number of SBA's
requirements, with some customization and integration of additional
products needed to meet all requirements.

After the contractor completed the survey, SBA's information technology
investment review board required the agency to complete a business case
analysis for the proposed disaster loan system. SBA's analysis involved
researching the existing requirements, evaluating potential alternatives,
and providing a recommendation. In March 2001, SBA completed the analysis,
which evaluated three alternatives: (1) develop a custom solution,

(2) acquire a COTS product, or (3) stay with the current environment. SBA

determined that the COTS product represented the best solution after
considering the costs and time frames associated with each alternative.

In June 2002, a SBA contractor developed more specific requirements for
the project because a considerable amount of time had passed since the
first survey and because of the uniqueness of certain aspects of the
disaster loan process, such as loss verification and a check for
duplication of benefits. Later that year, SBA contracted for a separate
COTS survey that utilized the Carnegie Mellon University's Software
Engineering Institute process for evaluating COTS products.1 SBA evaluated
products from 10 different vendors, and after narrowing the selection to
two products, received vendor demonstrations in January 2003. In March
2003, the contractor recommended a COTS product for SBA to use as the
foundation for the Disaster Credit Management System (DCMS).

In September 2003, SBA completed an analysis of the DCMS design to
identify potential gaps between the recommended COTS product and the
requirements for the system. For example, SBA recognized that the COTS
product did not have the functionality to perform loss verification
activities; therefore, SBA decided to implement a custom loss verification
application and link the application to the core system. This ensured that
loss verification data would automatically synchronize with DCMS.

In 2003, SBA also began to test various aspects of its new system. In
November 2003, the agency began testing the core application, interfaces,
and additional components (loss verification, scanning, etc.). User
validation readiness testing was conducted between December 2003 and March
2004. In October 2004, SBA contracted for an Independent Verification and
Validation (IV&V) of an initial release of DCMS. An IV&V can help provide
reasonable assurance that a system satisfies its intended use and user
needs, and its use is recognized as an industry best practice. The IV&V
conducted for DCMS found that the system was supported by strong
requirements, test plans, test cases, and other supporting

1The Software Engineering Institute has identified specific processes and
practices that have proven successful in fostering quality software
development. The processes and practices identified focus on software
development and acquisition activities. The institute has constructed
models for developing and acquiring software, developing and implementing
software process improvement programs, and integrating hardware and
software. The institute created the models to provide general guidance for
software development and acquisition activities that programs can tailor
to meet their needs (See GAO, Defense Acquisitions: Stronger Management
Practices Are Needed to Improve DOD's Software-Intensive Weapon
Acquisitions, GAO-04-393 (Washington, D.C.: Mar. 1, 2004).

Appendix II SBA's Acquisition and Implementation of the Disaster Credit
Management System

documentation. In addition, the IV&V found that DCMS was developed with a
high level of user involvement. However, the IV&V did not evaluate
performance testing, including tests to help ensure that the system could
function at its maximum user capacity, because these tests were not
completed until December 2004 after the agency had begun implementation.
This performance testing was conducted with only up to 120 concurrent
users due to problems with the hardware associated with the testing
environment. If the testing environment had functioned as planned, it was
estimated the system could accommodate approximately 600 concurrent users.

SBA used a phased approach for implementing DCMS. In November 2004, SBA
first implemented DCMS in its Niagara Falls, New York, Disaster Area
Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas,
and Sacramento, California DAO. SBA also began using DCMS to process
applications for all new disaster declarations. As figure 6 illustrates,
SBA's process of moving from its former manual, paper-based disaster loan
process to a more automated process using DCMS took about 6 years. SBA's
costs for planning, acquiring, implementing, and operating DCMS totaled
about $32 million through April 2006.

Appendix II SBA's Acquisition and Implementation of the Disaster Credit
Management System

                     Figure 6: Time Line of DCMS Activities

                                  Source: GAO.

Appendix III

Comments from the Small Business Administration

Appendix IV

                     GAO Contact and Staff Acknowledgments

  GAO Contact
  
  William B. Shear, (202) 512-8678, [email protected]

  Staff Acknowledgments
  
In addition to the individual named above, Daniel Blair, Assistant
Director; 
Barbara Oliver, Assistant Director; Bernice Benta; Tania Calhoun; Marshall
Hamlett; Marc Molino; David Pittman; Jennifer Popovic; Rhonda Rose; and
Eric Trout made key contributions to this report.

                 (250263) Page 51 GAO-06-860 SBA Diaster Loans

  GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts GAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

                             Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:  

 Web site: www.gao.gov/fraudnet/fraudnet.htm

  E-mail: [email protected]

Federal Programs Automated answering system: (800) 424-5454 or (202)
512-7470

Congressional
Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Relations
Washington, D.C. 20548

Public Affairs
  
Paul Anderson, Managing Director, [email protected] (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***