Small Business Administration: Planning for Loan Monitoring System Has
Many Positive Features but Still Carries Implementation Challenges
(Testimony, 07/16/98, GAO/T-AIMD-98-233).

GAO discussed the Small Business Administration's (SBA) activities to
complete planning for its loan monitoring system, as required by the
Small Business Reauthorization Act of 1997, focusing on SBA's project
plan for completing the mandated actions.

GAO noted that: (1) SBA's project plan provides information in many key
areas to explain how it intends to complete the mandated actions; (2)
the plan delineates the project's goals and objectives, resource
requirements, quality standards and control systems, assumptions,
methodologies, work breakdown structure with a timetable for completion
of tasks, and estimated costs; (3) according to the project plan, SBA's
strategy for achieving these goals is to build on best industry
practices, reengineer inefficient business processes, and implement
contemporary technologies; (4) in support of these goals, SBA also
established objectives for the loan monitoring system; (5) SBA included
estimates of the personnel resources that it would need to execute the
project plan; (6) it estimated that 18 staff would be needed for the
first phase of the project, which addresses the completion of the
mandated actions, and that an additional three staff would be needed for
the development phase; (7) to address the quality standards and controls
to be used for the loan monitoring system project, the plan includes
work elements to establish systems development standards and procedures
and process change control procedures; (8) the plan recognizes that the
project includes a number of assumptions that may affect its success;
(9) it identifies seven key assumptions that SBA made but will need to
validate during the project; (10) the project plan also cites the
methodologies that SBA plans to use or is considering for key areas of
the project; (11) according to the project plan, SBA estimates that the
loan monitoring system will cost about $20 million to complete; (12)
while developing the project plan is a good start, SBA must still
successfully execute it to complete the eight mandated actions; (13) in
executing the plan, SBA will face formidable technical and management
challenges and risks; (14) SBA recognizes the need to establish defined
processes for software project management, and use them on this project;
(15) the loan monitoring system project will be using, for the first
time, methodologies it has selected for benchmarking, business process
reengineering, information technology architecture development, project
management, and systems development; (16) SBA plans to work concurrently
on an information technology architecture and the loan monitoring system
as separate projects; and (17) the extent to which SBA meets these
challenges and manages these risks will determine how well business
processes and systems requirements are defined, and the quality of
support for decisionmaking on the purchase or development of the needed
system.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-AIMD-98-233
     TITLE:  Small Business Administration: Planning for Loan Monitoring 
             System Has Many Positive Features but Still
             Carries Implementation Challenges
      DATE:  07/16/98
   SUBJECT:  Small business loans
             Loan accounting systems
             Systems design
             Information resources management
             Strategic information systems planning
IDENTIFIER:  SBA Loan Accounting System
             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER


Before the Subcommittee on Government Programs and Oversight,
Committee on Small Business, House of Representatives

For Release on Delivery
Expected at
2 p.m.
Thursday,
July 16, 1998

SMALL BUSINESS ADMINISTRATION -
PLANNING FOR LOAN MONITORING
SYSTEM HAS MANY POSITIVE FEATURES
BUT STILL CARRIES IMPLEMENTATION
CHALLENGES

Statement of Joel C.  Willemssen
Director, Civil Agencies Information Systems
Accounting and Information Management Division

GAO/T-AIMD-98-233

GAO/AIMD-98-233T


(511464)


Abbreviations
=============================================================== ABBREV

  SBA -

============================================================ Chapter 0

Mr.  Chairman and Members of the Subcommittee: 

We are pleased to be here today to discuss the Small Business
Administration's (SBA) activities to complete planning for its loan
monitoring system, as required by the Small Business Reauthorization
Act of 1997.  As we recently reported, SBA has prepared a project
plan for completing the eight actions mandated in the act.\1

My testimony today discusses our recent report and focuses on SBA's
project plan for completing the mandated actions.  While SBA has not
yet completed any of the mandated actions in the 6 months since the
act was passed, it has written a project plan that describes an
approach for addressing those actions that has many positive aspects. 
As SBA moves forward to execute the plan, however, it will face
several technical and management challenges and risks. 


--------------------
\1 Small Business Administration:  Mandated Planning for Loan
Monitoring System Is Not Complete (GAO/AIMD-98-214R, June 30, 1998). 


   BACKGROUND
---------------------------------------------------------- Chapter 0:1

SBA's need to monitor activities of lenders that help deliver its
programs has increased significantly in recent years.  One reason is
that the reported volume of loans processed by lenders almost doubled
between 1992 and 1997, from about $24 billion to about $46 billion. 
A second reason is that SBA shifted to lenders the responsibility for
key loan origination, servicing, and liquidation functions during
this same time period.  In 1993, SBA district offices reviewed the
creditworthiness of about 84 percent of lenders' requests for loan
guarantees, with the remainder being processed under a preferred
lender program.  At that time, SBA also serviced and liquidated all
loans that went into default.  By 1997, preferred lenders processed
about 52 percent of the loans and, starting in 1998, lenders became
responsible for servicing and liquidating all loans they make under
the 7(a) program, which constitutes about 80 percent of SBA's loan
portfolio.\2

To improve its ability to monitor lenders' loan servicing and
liquidation actions, SBA asked for $18 million in its fiscal year
1998 budget request.  According to SBA, these funds were to be used
for (1) recruiting expertise in lender oversight, (2) establishing
financial performance goals for private-sector partners, (3) creating
a database for lender and portfolio management, and (4) developing an
information system for timely and accurate reporting to agency
management. 

After reviewing SBA's basis for this request, we reported in June
1997 that the agency had not undertaken the essential planning needed
to develop the proposed loan monitoring system.\3 The Congress
subsequently enacted provisions in the Small Business Reauthorization
Act of 1997 that required the SBA Administrator to

     "perform and complete the planning needed to serve as the basis
     for funding the development and implementation of the
     computerized loan monitoring system, including--

     (1) fully defining the system requirement using on-line,
     automated capabilities to the extent feasible;

     (2) identifying all data inputs and outputs necessary for timely
     report generation;

     (3) benchmark loan monitoring business processes and systems
     against comparable industry processes and, if appropriate,
     simplify or redefine work processes based on these benchmarks;

     (4) determine data quality standards and control systems for
     ensuring information accuracy;

     (5) identify an acquisition strategy and work increments to
     completion;

     (6) analyze the benefits and costs of alternatives and use to
     demonstrate the advantage of the final project;

     (7) ensure that the proposed information system is consistent
     with the agency's information architecture; and

     (8) estimate the cost to system completion, identifying the
     essential cost element."

The act also required SBA, within 6 months of enactment, to submit a
report to the Congress and to us on its progress in carrying out
these mandated actions.  As required, SBA submitted its report on
June 2, 1998. 

We were required by the act to evaluate and report on SBA's
compliance with the act within 28 days of receipt of SBA's report. 
On June 30, 1998, we reported that SBA had formed a team for the loan
monitoring system in December 1997, but it had not yet completed any
of the eight mandated actions.  We noted that SBA's report included a
project plan, laying out its approach for addressing these actions. 
Work on the first of the required planning actions was begun in May
1998 and, according to the project plan, SBA will complete work on
the last of the eight mandated actions in August 1999. 

In conducting our review, we analyzed SBA's systems development and
related information resources management policies and procedures,
reviewed SBA's activities to prepare for undertaking the required
planning actions, and reviewed and analyzed SBA's June 2, 1998,
report to the Congress on its progress in carrying out the eight
required actions that was issued pursuant to the Small Business
Reauthorization Act of 1997.  Our work was performed from December
1997 through June 1998, in accordance with generally accepted
government auditing standards. 


--------------------
\2 The program authorized under Section 7(a) of the Small Business
Act is the agency's primary vehicle for providing small businesses
with access to credit. 

\3 Small Business Administration:  Better Planning and Controls
Needed for Information Systems (GAO/AIMD-97-94, June 27, 1997). 


   SBA'S PROJECT PLAN FOR
   COMPLETING THE MANDATED ACTIONS
---------------------------------------------------------- Chapter 0:2

SBA's project plan provides information in many key areas to explain
how it intends to complete the mandated actions.  The plan delineates
the project's goals and objectives, resource requirements, quality
standards and control systems, assumptions, methodologies, work
breakdown structure with a timetable for completion of tasks, and
estimated costs. 

SBA established four goals for the loan monitoring system project: 

  -- Have high-quality, timely data necessary to perform roles such
     as the management of risk, collection of fees from recipients,
     and reporting to internal and external entities. 

  -- Enforce uniform practices for loan making and reporting that
     will result in equal access by all eligible small businesses. 

  -- Have business processes that support a streamlined workforce,
     use appropriate work flows, use best practices of both the
     government and private sectors, and include the ability to cope
     with both upward and downward changes in demand and resource
     availability. 

  -- Have a computer infrastructure that supports efficient and user
     friendly information exchanges within SBA and among SBA and
     external entities, and that can enhance SBA's program delivery
     and its ability to carry out its oversight functions. 

According to the project plan, SBA's strategy for achieving these
goals is to build on "best industry practices," reengineer
inefficient business processes, and implement contemporary
technologies.  In support of these goals, SBA also established
objectives for the loan monitoring system; they include the following
functionality: 

  -- on-line update by lenders of disbursements, payments, unilateral
     servicing actions, and requests for SBA approvals, as necessary;

  -- waiting-to-be-processed queues for action by service center
     personnel;

  -- electronic (digital) signatures to identify and verify who takes
     and approves actions;

  -- electronic notification of actions via external e-mail or lender
     notification queues;

  -- on-line exception reporting to notify SBA of potential problems,
     such as "neglected" loans, poor credit analysis, and slow lender
     servicing or reporting;

  -- data analysis tools for management information, such as lender
     and loan trend identification, and end-user query and reporting;

  -- a centralized electronic file to replace on-site paper loan
     folders;

  -- integrated interactive voice response allowing borrowers and
     lenders to receive status data;

  -- on-line electronic collateral file with a centralized storage
     site for paper collateral documentation;

  -- centralized, automated generation of uniform commercial code
     filing documents;

  -- expanded use of auto-dial for collections; and

  -- sophisticated industry models to analyze and manage credit risk
     and portfolio performance. 

SBA included estimates of the personnel resources that it would need
to execute the project plan.  It estimated that 18 staff would be
needed for the first phase of the project, which addresses the
completion of the mandated actions, and that an additional three
staff would be needed for the development phase.  The project plan
also describes the types of skills needed--such as programming,
systems architecture, and database administration--to manage and
execute the project. 

To address the quality standards and controls to be used for the loan
monitoring system project, the plan includes work elements to
establish systems development standards and procedures and process
change control procedures.  The plan also describes the quality
control process that SBA plans to use to identify compliance with
standards, and defines how the compliance findings will be reported. 

The plan recognizes that the project includes a number of assumptions
that may affect its success.  It identifies seven key assumptions
that SBA made but will need to validate during the project.  For
example, SBA assumed that the agency's information technology
architecture\4 will be completed before it is needed to support this
project, and that agreements with benchmarking partners will be
timely and structured to meet SBA's needs. 

The project plan also cites the methodologies that SBA plans to use
or is considering for key areas of the project.  These include
methodologies for project planning and management, benchmarking,
reengineering, systems development, software acquisition, risk
management, and development of an information technology
architecture.  In some areas, such as software acquisition, SBA is
comparing its current methodologies with industry best practices to
select the methodologies that will be used for the project.  In other
areas, such as benchmarking, SBA did not have a methodology; it has
now either selected a new methodology or is in the process of
selecting one for these areas. 

Included in the project plan is a work breakdown structure that lists
the work elements from the start of the project through completion. 
These elements include the individual steps necessary to complete the
mandated actions and the steps planned for the subsequent system
design, development or acquisition, and implementation.  The work
elements for completing the mandated actions are sequenced, beginning
with benchmarking and ending with the identification of an
acquisition strategy to support a make-or-buy decision.  The project
plan recognizes that the project will not have enough information to
fully evaluate the make or buy issue until it has completed
benchmarking, business process reengineering, requirements gathering
and analysis, and benefits and costs analyses. 

According to the project plan, SBA estimates that the loan monitoring
system will cost about $20 million to complete.  In addition to the
automated system, this estimate includes the costs of staffing;
developing training; developing lender performance standards;
establishing subsidy rate analysis processes; and making
infrastructure improvements, such as buying communications hardware
and software.  The project plan specifies that SBA will refine the
cost estimates after the systems requirements have been defined and
the alternatives analyzed. 


--------------------
\4 SBA is conducting a separate project to develop an information
technology architecture and expects to complete it in time to support
the loan monitoring system project. 


   CHALLENGES AND RISKS IN
   EXECUTING SBA'S PROJECT PLAN
---------------------------------------------------------- Chapter 0:3

While developing the project plan is a good start, SBA must still
successfully execute it to complete the eight mandated actions.  In
executing the plan, SBA will face formidable technical and management
challenges and risks, including

  -- establishing software project management capability while
     undertaking its largest information technology project ever;

  -- using methodologies and practices for the first time while
     conducting a large, complex project; and

  -- implementing the loan monitoring system project without having
     an information technology architecture in place. 


      ESTABLISHING SOFTWARE
      PROJECT MANAGEMENT
      CAPABILITY
-------------------------------------------------------- Chapter 0:3.1

SBA recognizes the need to establish defined processes for software
project management and use them on this project.  Research by the
Software Engineering Institute has shown that defined and repeatable
processes for managing software acquisition or development are
critical to an organization's ability to consistently deliver
high-quality information systems on time and within budget.  These
critical management processes include project planning, requirements
management, software project tracking and oversight, software quality
assurance, software configuration management, and change control
management.\5

If SBA cannot implement disciplined software development and
acquisition processes for this project, it risks building or buying a
system that does not effectively meet its requirements, is delivered
late or over budget, or does not perform as specified. 


--------------------
\5 Definitions of these processes were obtained from the Software
Engineering Institute's Capability Maturity Model for Software,
Version 1.1. 


      USING METHODOLOGIES AND
      PRACTICES FOR THE FIRST TIME
-------------------------------------------------------- Chapter 0:3.2

The loan monitoring system project team will be using, for the first
time, methodologies it has selected for benchmarking, business
process reengineering, information technology architecture
development, project management, and systems development.  Each of
these methodologies is complex and will require staff with the
necessary skills and abilities for rigorous implementation.  The
staff currently on the project management team will need to develop
the skills and abilities to use the new methodologies as they execute
this large undertaking.  SBA may also need to hire staff with the
necessary skills and abilities to use the new methodologies, and hire
contractors with the necessary expertise to support the project team. 

Successfully learning and employing several new methodologies
simultaneously will present a considerable technical and management
challenge.  If the team is not up to the task, the project may not
achieve its intended results. 


      IMPLEMENTING THE PROJECT
      WITHOUT AN INFORMATION
      TECHNOLOGY ARCHITECTURE
-------------------------------------------------------- Chapter 0:3.3

SBA plans to work concurrently on an information technology
architecture and the loan monitoring system as separate projects.\6
The act requires SBA to ensure that the loan monitoring system is
consistent with the architecture.  An information technology
architecture provides a comprehensive "construction plan" or
"blueprint" that systematically details the breadth and depth of an
organization's mission-based mode of operation.  An architecture
provides details first in logical terms, such as defining business
functions, providing high-level descriptions of information systems
and their interrelationships, and specifying information flows; and
second in technical terms, such as specifying hardware, software,
data, communications, security, and performance characteristics.  By
enforcing an information technology architecture to guide and
constrain a modernization program, an agency can preclude
inconsistent systems design and development decisions, and the
resulting suboptimal performance and added cost. 

SBA has started developing an information technology architecture by
documenting its current computing environment.  It plans to continue
developing the architecture while the loan monitoring system project
is underway.  As stated earlier, SBA assumes that the information
technology architecture will be completed before it is needed to
support this project.  If both logical and technical components of
the architecture are not completed as scheduled, the loan monitoring
system project will likely be delayed and plans may need to be
revised because, as required by the act, the plans must be consistent
with the information technology architecture. 


--------------------
\6 The Clinger-Cohen Act of 1996 gives the Chief Information Officer
of an executive agency the responsibility of developing, maintaining,
and facilitating the implementation of a sound and integrated
information technology architecture.  An information technology
architecture is sometimes referred to as a systems architecture. 


-------------------------------------------------------- Chapter 0:3.4

In conclusion, the extent to which SBA meets these challenges and
manages these risks will determine how well business processes and
systems requirements are defined, and the quality of support for
decision-making on the purchase or development of the needed system. 
Because this system is a critical part of SBA's modernization, its
senior officials must closely monitor progress in implementing the
project plan and ensure that appropriate steps are taken to mitigate
the significant risks involved.  SBA should complete all of the eight
actions mandated by the Small Business Reauthorization Act of 1997
before buying hardware or systems.  In particular, SBA should ensure
that (1) the project has the active participation and support of
senior program managers and staff, (2) a disciplined software
development and acquisition processes is implemented for this
project, (3) project staff are adequately trained and supported by
contractors with expertise in the methodologies used for this
project, and (4) the information architecture is adequately developed
and used to guide the requirements for the loan monitoring system. 

Mr.  Chairman, this concludes my statement.  I would be happy to
respond to any questions that you or other members of the
Subcommittee may have at this time. 

*** End of document. ***