Small Business: SBA's 8(a) Information System Is Flawed and Does Not
Support the Program's Mission (Letter Report, 07/19/2000,
GAO/RCED-00-197).

The Small Business Administration's 8(a) program--the federal
government's primary vehicle for developing small businesses owned by
socially and economically disadvantaged persons--is not meeting client
expectations. First, SBA's efforts are not aligned with the needs or
expectations of 8(a) firms. Firms want SBA to provide more assistance
that will help them obtain contracts. SBA has stressed business
management skills, even though most firms joined the program to obtain
8(a) contracts. This misalignment of SBA efforts and 8(a) firms' needs
has been further compounded by the fact that most 8(a) contract dollars
go to a small number of firms. Second, SBA has no way to tell how well
the 8(a) program is working or know the full extent of business
development assistance provided to firms. SBA is unable to measure the
8(a) program's performance in such basic areas as the level of training
provided, whether such training matched firms' needs, or even the amount
of 8(a) contracts the firms obtained. GAO summarized these two reports
in testimony before Congress; see: Small Business: Expectations of Firms
in SBA's 8(a) Program Are Not Being Met, by Stanley J. Czerwinski,
Associate Director for Housing and Community Development Issues, before
the Senate Committee on Small Business. GAO/T-RCED-00-261, July 20 (15
pages).

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  RCED-00-197
     TITLE:  Small Business: SBA's 8(a) Information System Is Flawed
	     and Does Not Support the Program's Mission
      DATE:  07/19/2000
   SUBJECT:  Information systems
	     Data collection
	     Information resources management
	     Small business assistance
IDENTIFIER:  GSA Federal Procurement Data System
	     SBA Servicing and Contracting System
	     SBA Minority Enterprise Development Central Office
	     Repository
	     SBA 8(a) Program

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO/RCED-00-197

Resources, Community, and
Economic Development Division

B-285284

July 19, 2000

The Honorable Christopher S. Bond
Chairman, Committee on Small Business
United States Senate

Dear Mr. Chairman:

The Small Business Administration's (SBA) 8(a) program is a business
development and contracting program for small socially and economically
disadvantaged firms. Firms that are certified by SBA for participation in
the program are eligible to receive contracts that federal agencies set
aside for 8(a) firms and business development assistance from SBA in the
form of technical assistance and management training. In fiscal year 1999,
about 6,000 firms participated in the 8(a) program, and $6 billion in
federal contracts were awarded to participating firms. SBA developed and
maintains an information system for the program containing information about
the firms, such as the location, minority status, and gender of the owners,
and the government contracts awarded to the firms while they participate in
the program. SBA uses this information to report on the program's results to
the Congress, manage the program, and monitor the progress of 8(a) firms.

Concerned about the quality of the information used to manage the 8(a)
program, you asked us to examine selected processes and procedures to assess
the strengths and weaknesses of the information system as a management tool
for SBA. As agreed with your office, this report addresses the following
questions: (1) Does the system meet the information needs of SBA field and
headquarters staff? (2) What plans, if any, does SBA have for improving the
existing system?

The 8(a) information system, while intended to be a comprehensive tool
enabling SBA to monitor the program, does not meet the information needs of
headquarters or district officials. Potentially useful information, such as
the amount of training and assistance provided for participating firms, is
not captured as part of SBA's information-gathering process. This limits
SBA's ability to assess whether its efforts have an impact on the ultimate
performance goal of creating commercially viable and stable firms. In
addition, because of recent changes in the 8(a) contracting process, most
federal agencies are required to submit quarterly contracting data to SBA's
headquarters instead of submitting copies of contracts to SBA's district
offices. Some federal agencies have not submitted the quarterly information,
and some of the information that has been submitted has not been in a usable
format, so it has not been entered into the system or provided for the
district offices, according to SBA's headquarters officials. These problems
have severely undermined the completeness and accuracy of the information in
the system on contracts. For example, the total value of the contracts
awarded to participating firms is underrepresented by the system, on
average, by nearly $500 million annually, according to SBA. The system is so
difficult to use that most of the district offices we visited had devised
other methods--including maintaining redundant local systems--to obtain the
information they needed in a timely fashion.

SBA plans to update the 8(a) information system as part of an agencywide
information systems modernization initiative. Although program officials
have recognized the need to update the system since 1996 and have planned
other update efforts, none of them resulted in substantial progress in
improving the information system. SBA has an agencywide information systems
modernization initiative under way, but planning for the modernization of
the 8(a) system will not be completed for some time, according to SBA. In
the meantime, SBA has begun to develop a strategic information technology
plan for the 8(a) program that combines and updates recommendations from the
agency's earlier business process reengineering studies, including efforts
to update the information system. These studies include an April 1999 review
that recommended that SBA (1) develop automated applications for firms
wishing to enter the program, (2) consolidate all program information
sources into one system, and (3) use another federal information system--the
Federal Procurement Data System--as a source for 8(a) contract data.

We provided SBA with a draft of this report for review and comment. SBA
concurred with the report's recommendations and provided technical
clarifications, which were incorporated as appropriate.

The Small Business Act, as amended, authorizes the 8(a) program to help
socially and economically disadvantaged small businesses gain access to the
economic mainstream of American society. Firms that enter the program are
eligible to receive 8(a) contracts from federal agencies without competition
from firms outside the program. Firms in the program may also receive
training and other assistance through SBA.

To be eligible for the 8(a) program, a firm must be a small business that is
at least 51- percent owned and controlled by one or more socially and
economically disadvantaged individuals. A firm is considered small if it
meets size standards established by SBA for its particular industry. Under
the program, certain ethnic groups such as African Americans and Hispanic
Americans are presumed to be socially disadvantaged. Other individuals can
be admitted to the program if they can adequately document that they are
disadvantaged. To meet the economically disadvantaged test, each individual
must have a net worth of less than $250,000, excluding his or her ownership
interest in the firm and personal residence. Also, a firm must generally
have been in business for at least 2 years and possess a reasonable prospect
for success as determined by SBA on the basis of the firm's operating
revenues and the firm owner's technical and management experience, among
other things.

Once a firm is accepted into the program, a business opportunity specialist
in the SBA district office that serves the geographical area where the
firm's principal place of business is located is assigned to service the
firm during its participation in the program. The business opportunity
specialist is responsible for, among other things, reviewing and approving
contract offerings, entering and updating financial and contracting
information in the 8(a) information system, assisting the firm with
preparing a business plan, conducting annual reviews of the firm's progress
in implementing its plan, and analyzing year-end financial statements for
certain compliance issues.

SBA's current 8(a) information system was developed in response to the Small
Business Act, as amended by the Business Opportunity Development Reform Act
of 1988, which required SBA to develop and implement a process for the
systematic collection of data on the operations of the 8(a) program and
report annually to the Congress.1 The mandate, among other things, required
SBA to report data on the demographics of participating firms and the dollar
value of the contracts the firms received, and to assess what additional
resources are needed to provide services for firms in the program. SBA
encountered numerous problems in developing the system, which was originally
scheduled to be complete in 1990. Our previous work criticized the agency
for not following federal regulations and guidelines for defining the
requirements of the system in relation to the agency's mission and users'
needs. 2

When SBA's information system was implemented in 1995--5 years after SBA's
original projection--SBA described it as a comprehensive tool that would
enable the agency to monitor the assistance provided for, the contracts
awarded to, and the progress made with business development. The system,
referred to as SACS/MEDCOR, is made up of two parts: the Servicing and
Contracting System (SACS) and the Minority Enterprise Development Central
Office Repository (MEDCOR). Basic information about 8(a) firms, including
such demographic data as the location, minority status, and gender of the
owners, is stored in SACS, while data about proposed and awarded contracts
resides in MEDCOR.

SACS/MEDCOR is maintained at the district-office level, and information is
transmitted periodically to a centralized location for headquarters' use.
Data on firms applying to the program are initially entered into another
8(a) information system and are then transferred to SACS/MEDCOR when the
firms are accepted into the program. Figure 1 illustrates how data are
entered into SACS/MEDCOR from the point of a firm's application to enter the
program.

SACS/MEDCOR, while intended to be a comprehensive tool enabling SBA to
monitor the progress with business development, the contract awards, and the
program performance, does not meet the information needs of 8(a)
headquarters or district officials. The system does not allow for the
tracking of training or assistance provided for firms, making it difficult
to assess the program's effectiveness. Also, recent changes in the 8(a)
contracting process have made the contract information in the system
unusable. In addition, the system is so difficult to use that most of the
district offices we visited had devised other methods--including maintaining
redundant local systems--to obtain the information they needed in a timely
fashion. Other problems, such as data validation weaknesses caused by the
removal of edit checks from the system and unclear security procedures, also
exist.

SBA does not currently have a method for systematically tracking the
training and assistance that 8(a) firms receive. SBA's Deputy Assistant
Administrator for Technology within the office that oversees the 8(a)
program said that SBA had planned for its information system to track
assistance provided through SBA's management assistance program but that
this part of the system was never used because the management assistance
program's appropriation declined about the time the system was implemented.
Also, according to SBA, the system was obsolete by the time it was
implemented because the program's emphasis shifted from client-specific
technical assistance, accomplished under task orders, to classroom-type
executive training, provided by recognized educational institutions. If
information on training and assistance is needed, the 8(a) program manager
said headquarters would send an information request to the district offices.
However, SBA's district office officials in Atlanta, Dallas/Fort Worth, New
York City, and San Francisco told us that they do not have a centralized
system to track the training or assistance that they or others provide for
8(a) firms. SBA's District Office officials in Washington, D.C., said that
since SBA does not have a centralized system to track the training or
assistance provided for 8(a) firms, they maintain a spreadsheet with this
information.

SBA managers said that the lack of a system to track and assess the results
of business development activities creates a weakness in the program because
it is difficult to assess the program's effectiveness. The officials said
that the system's inability to record this type of training and assistance
could lead to an underaccounting of the benefits that firms receive from the
program. For example, a district manager noted a case in which an 8(a) firm
received considerable assistance developing its marketing and other
capabilities. This firm, through the auspices of the district office, later
negotiated and won a contract with a commercial firm. This outcome could not
be credited within the system because (1) staff have no way of recording the
training and assistance provided for firms other than in informal notations
and (2) the contract awarded to the firm was not an 8(a) contract, so the
award information could not be noted in the system.

SBA has piloted a system--the Business Assessment Tool--for use by district
business opportunity specialists to help define the developmental needs of
8(a) firms. The assessment tool was designed to match information from a
series of 58 questions used to assess a firm's developmental assistance
needs for the business training and counseling resources provided by SBA and
other service providers. The tool also provided a mechanism for tracking
training and assistance. In July 1999, SBA piloted the Business Assessment
Tool at 14 SBA district offices, where it was used to assess 53 firms. SBA
officials said that the tool, which is not integrated into SBA's current
information system, is being reassessed because the pilot showed that it
could be made more user friendly. For example, if a business opportunity
specialist was not able to complete all the entries in one session, the
system would not save the entries already completed.

Information System's Completeness and Accuracy

Headquarters and district staff maintained that they could no longer ensure
that the 8(a) contract award information in the system is complete and
accurate. District and headquarters staff have been responsible for entering
data on 8(a) contracts. These entries can take place at various points: (1)
when a contract requirement is sent to SBA for approval, (2) when a contract
is actually awarded, and (3) when a contract is modified. This process is
illustrated in figure 2.

District staff cite a marked decrease--estimated at up to 50 percent at one
district office--in the notification of contract awards and modifications
from contracting agencies during fiscal year 1999. SBA officials estimated
that the 8(a) contracting amounts are underrepresented in SACS/MEDCOR, on
average, by nearly $500 million annually when compared with data from the
Federal Procurement Data System (FPDS). According to SBA officials, the
cause of this decrease is a recent change in the way that contracting
agencies interact with and report back to SBA when contracts are awarded.
Though agencies must report information on contracts of over $25,000 to
FPDS, which is maintained by the General Services Administration, they are
no longer required to provide SBA's district offices with copies of 8(a)
contracts when contracts are awarded. Rather, most agencies are required to
provide SBA's headquarters with contract information on a quarterly basis.3
However, some agencies have not provided the information, and some of the
information that has been provided has not been in a usable format, so it
has not been entered into the system or provided for the district offices,
according to headquarters officials.

District staff said that on occasion, they have become aware of contracts
only because of incidental contacts with the firms they monitor--when issues
arise between the contractor and the contracting agency--or as a part of
their ongoing effort to maintain complete and accurate information for their
files. District officials said they cannot readily produce accurate reports
on the number of contracts awarded to 8(a) firms in their district. In fact,
staff in one district office said they had been questioned by their district
office director about why the number of contracts awarded to firms in their
district had decreased dramatically when in fact the information system
lacked data on an estimated 50 percent of the contracts awarded.
Nevertheless, staff in every district we visited said that they spend time
entering contracting data into the system.

Recognizing this shortcoming, SBA began using FPDS data in mid-fiscal year
2000 to prepare its fiscal year 1999 report to the Congress. However,
difficulties that SBA encountered in matching its demographic information on
firms to the contract information on 8(a) firms coming from FPDS caused SBA
to miss its April 30 deadline for providing the Congress with its fiscal
year 1999 report. SBA must connect FPDS data with information on 8(a) firms
in its database in order to report on the mix of program participants and
their success in winning contract awards. According to SBA, this matching
entailed considerable staff effort. Also, without the linkages, the data
cannot be broken down by district offices; hence, headquarters and district
management do not have accurate numbers on the contract awards facilitated
by each office. One SBA official noted that from at least half to perhaps
all of one staff person's time is required over the course of the year to
produce the annual report.

Our review of the current system uncovered additional data quality problems.
We called 100 randomly selected firms to verify firms' addresses and found
that about 10 percent of the data examined on these firms were inaccurate or
incomplete. In addition, when we examined selected data from SACS/MEDCOR to
test for logic and consistency among related data elements, we found
anomalies in the data. For example, whereas each 8(a) firm has a single
designated chief executive officer (CEO)--and may have multiple
partners--the database showed that some firms did not have a CEO designated
and others had multiple CEO designations. A knowledgeable SBA official told
us that one reason for the data quality problems is that SACS/MEDCOR has a
limited ability for edit checks on data and that even district offices known
for quality data entry practices had been found to have data quality
difficulties, such as duplicated information for some firms.

Using the system to track a firm over time can also be problematic. For
example, if a firm changes its name--prompted, for example, by a new
owner--SBA staff, when entering the firm's new name into the system, must
remember to manually record the firm's previous name in a "history" file if
a historical link is to be maintained in SACS/MEDCOR. Without this manual
intervention, no record of the firm under its prior name would exist within
the system. The lack of an automated process to record name change histories
could impair the ability of SBA staff to manage or investigate their firms'
status in the program.

The current 8(a) information system does not meet the needs of district
office staff, and as a result, district offices have developed redundant
local systems. In a 1997 report, an SBA contractor said that in its survey
of district offices, one district office said that SACS/MEDCOR "does not
benefit workers (not a useful tool);" staff from another district said
SACS/MEDCOR is "too complicated" and "cumbersome" and "does not help the BOS
[business opportunity specialist]." Other districts had similar complaints.
Four of the five district offices we visited--which together, are
responsible for approximately 30 percent of the 8(a) firms in the
program--had instituted some procedure to cope with their difficulties with
entering, retrieving, or processing information. The office strategies
ranged from establishing a specific staff position to develop specialized
reports and assist business opportunity specialists and contracting officers
in their use of the system to developing and maintaining redundant local
systems that staff found easier and more versatile to use. Although
individualized reports and queries can be produced from SACS/MEDCOR through
separate reporting software, some district staff had difficulty with the
software or did not use it. District staff also noted that they did not find
the standard reports available in the current system useful for their
management needs.

Another problem with the current system is that the numbering scheme for
contracts does not match the contracting agencies' contract numbers, thereby
making it difficult for district staff to enter information pertaining to
the contracts. When district staff enter a new contract offer into
SACS/MEDCOR, the system automatically assigns a "requirements" number. This
number is used to uniquely identify the contract offer (and later, the
awarded contract and any associated contract modifications). If SBA's
requirements number is not provided by the contracting agency on its award
letter, district staff must explore SACS/MEDCOR for the associated data or,
as a last resort, call the contracting agency and request that staff there
look up the SBA number and provide it.

The nature of SACS/MEDCOR--software and data located at both the
headquarters- and district-office levels--creates a situation in which the
data on 8(a) firms and contracts are only as secure as the measures taken at
both levels to protect it. The SACS/MEDCOR application software and data
collected on 8(a) firms are resident on the local network servers in the 67
district offices, and the data are uploaded periodically (generally once a
week) to SBA's headquarters, where the national data are stored and can be
accessed by headquarters staff. Data are input and maintained at both the
district offices and the 8(a) headquarters office, and each office
determines how to control access. Therefore, data that are input at each
location are only as secure as the security measures--including access
controls--at that location. Access should be limited to only the data and
functions that individual staff need to perform their assigned duties.4
However, at several of the district offices we visited, business opportunity
specialists could review and change system data for any firm in the
district.

In a recent review of agencywide security measures, we found that "SBA has
not developed procedures to deal with risk assessments and to provide a
framework for managing risk and monitoring the adequacy of controls.
Standard Operating Procedures are obsolete."5 SBA recently developed
standard operating procedures for agencywide security issues. However, these
procedures do not address the 8(a) program specifically, and the program is
operating under Standard Operating Procedures established in 1990 before the
system was developed.

Plans to Modernize It As Part of an Agencywide Effort

While efforts to update the information system were planned beginning in
1996, and program officials recognize that the current system is outdated,
no substantial improvement has been made to the system. For example, an
effort to automate the 8(a) application process was piloted in October 1996
but never adopted. Another effort to streamline and automate the annual
review process performed by district business opportunity specialists has
also not been completed. According to program managers, this lack of
progress is due in large part to the frequent changes in the 8(a) program's
leadership. As shown in figure 3, the office under which the program is
administered has been managed by five different Associate Deputy
Administrators during the 4-year period from March 1996 to March 2000. Each
time the Associate Deputy Administrator changed, there were corresponding
management changes in the career-level managers of the 8(a) program.
According to program officials, these leadership changes have contributed to
an environment in which progress on the information system, as well as on
the 8(a) program overall, has languished. In addition, according to SBA's
Deputy Assistant Administrator for Technology within the office that
oversees the 8(a) program, SACS/MEDCOR was developed collaboratively by the
8(a) program office and SBA's information resource management office;
however, the system was not developed in adherence with Federal Information
Processing Standards. In his opinion, such adherence to established software
development standards would have reduced or eliminated the problems with
software development continuity caused by management turnover.

SBA is in the process of modernizing its information systems across the
entire agency; however, the modernization of the 8(a) system will not begin
for some time. The SBA modernization is planned in three phases:

� Phase 1 of the initiative will focus on the Loan Monitoring System, which
aids in loan monitoring and oversight.

� Phase 2 is intended to modernize SBA's financial management, human
resource, and procurement systems.

� Phase 3 will focus on government contracting, entrepreneurial development,
and minority enterprise development--all functions that are part of the 8(a)
program. SBA plans to start the planning activities for phase 3 in 2002.

While SBA has not yet entered phase 3 of the modernization initiative,
managers of the 8(a) program are moving ahead with plans to consolidate and
update recommendations from previous studies of the system requirements for
the 8(a) business development program. One study, performed by SETA
Corporation for SBA and delivered on April 26, 1999, presented the basis for
a revised information system to support core 8(a) business functions. It
identified user requirements and specifications for a recommended system,
including (1) using automated applications to enter the 8(a) program, (2)
consolidating all 8(a) information sources into one system, and (3) using
the FPDS as a source for 8(a) contract data. Although the study identified
user requirements, researchers did not talk with district office officials,
who are the system's primary users.

The information system used in the 8(a) program is not providing the timely,
accurate, complete, and appropriate information needed at the headquarters
and district office levels to manage the program. District staff find the
system cumbersome and difficult to use. Contracting data are so incomplete
that the data cannot be used to provide meaningful management reports at
either the headquarters or district level. Also, the system does not mirror
the 8(a) program's stated goal of creating commercially viable and stable
firms because no mechanism is in place to easily track the training received
by firms or the assistance provided by district business opportunity or
contract specialists that may result in additional contracts for the firms.
Therefore, such activities cannot be readily measured in any meaningful way,
and the success of individual activities, or of individual field offices,
cannot be measured in an efficient manner. Although SBA is in the process of
modernizing its information systems, the modernization of the 8(a) system
will not begin for some time.

We recommend that the Administrator of the Small Business Administration
ensure that her staff, upon entering the planning phase of the 8(a)
information systems modernization effort, design an integrated information
system that

� provides a method for collecting data on appropriate performance measures,
focusing on the assistance provided for 8(a) firms in addition to the number
of 8(a) contracts awarded;

� takes advantage of the links to existing federal contract information
sources, such as the Federal Procurement Data System, to minimize (1) the
reporting responsibilities of contracting agencies and (2) data entry duties
required at the district office level;

� is designed in light of current software and data management development
procedures and business processes and allows maximum flexibility and ease of
use by all levels of staff; and

� is protected at all levels by appropriate security controls, which are
specifically addressed in up-to-date Standard Operating Procedures.

In the interim, SBA should not continue to require 8(a) district staff to
enter contracting information into the current system.

We provided SBA with a draft of our report for review and comment. SBA
concurred with the report's recommendations and did not take exception to
the factual accuracy of the report. SBA provided additional information to
clarify certain points, including, its initial development of a strategic
information technology plan for the Office of Government Contracting and
Minority Enterprise Development; the changing nature of the 8(a) program
since SACS/MEDCOR was deployed; and the use of data from the Federal
Procurement Data System for reporting to the Congress. We have incorporated
this additional information within the report as appropriate and have
included SBA's comments in appendix 1.

To provide information on the history of the current 8(a) information
system, we interviewed SBA's headquarters and district office officials. SBA
was unable to provide much documentation on the development of its current
system, so we relied extensively on documents that we had retained in our
files from previous reviews of the 8(a) information system, our previous
reports on the 8(a) program, and legislative history information and
regulations.

To determine whether the system meets the information needs of SBA's
headquarters and district office staff, we interviewed headquarters and
district office officials, collected and analyzed documents and studies, and
obtained and assessed the 8(a) SACS/MEDCOR database. We interviewed business
opportunity specialists and contracting officers and their managers at five
district offices: Dallas/Fort Worth; New York City; San Francisco;
Washington, D.C.; and Atlanta. We selected the district offices on the basis
of the number of 8(a) firms they oversee and the geographic location of the
offices. These five offices oversee more than 30 percent of the firms in the
SACS/MEDCOR file that SBA provided us with at the beginning of our review.
We collected and analyzed documents, such as the user manuals for
SACS/MEDCOR, and studies performed by contractors that outline
recommendations for system changes. We also performed electronic data
testing on SACS/MEDCOR to determine the accuracy, completeness, and
reasonableness of key data elements.

To determine what plans, if any, SBA has for improving the system, we
interviewed SBA officials and obtained documentation for their plans. We
also used information collected on our other reviews of SBA's overall
information system modernization.

We performed our review from January through July 2000 in accordance with
generally accepted government auditing standards.

As arranged with your office, unless you publicly release its contents
earlier, we plan no further distribution of this report until 30 days from
the date of this letter. At that time, we will send copies to the Honorable
John F. Kerry, Ranking Minority Member of the Committee; other interested
congressional committees; the Honorable Aida Alvarez, Administrator, Small
Business Administration; and other interested parties. Copies will be made
available to others upon request.

If you or your staff have any questions about this report, please contact me
at (202) 512-7631. Key contributors to this report were Susan Campbell, Andy
Clinton, Curtis Groves, Barbara Johnson, and Kirk Menard.

Sincerely yours,
Stanley J. Czerwinski
Associate Director,
Housing, Community Development, and
Telecommunications Issues

Comments From the Small Business Administration

(385840)

  

1. See sec. 7(j)(16) of the Small Business Act, as added by sec. 408 of the
1988 Reform Act (15 U.S.C. 636(j)(16)).

2. See Small Business: Problems Continue With SBA's Minority Business
Development Program (GAO/RCED-93-145 , Sept. 17, 1993) and Small Business:
SBA Cannot Assess the Success of Its Minority Business Development Program
(GAO/T-RCED-94-278 , July 27, 1994).

3. SBA plans this quarterly reporting to be an interim measure until the
agency can convert to using FPDS.

4. See Federal Information System Controls Audit Manual, vol. 1
(GAO/AIMD-12.19.6, Jan. 1999).

5. See Information Technology Management: SBA Needs to Establish Policies
and Procedures for Key IT Processes (GAO/AIMD-00-170 , May 31, 2000).
*** End of document ***