Small Business Administration
Actions Needed to Provide More Timely Disaster Assistance Gao ID: GAO-06-860 July 28, 2006Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused more than $118 billion in estimated property damages across the Gulf Coast region in 2005. The Small Business Administration (SBA) helps individuals and businesses recover from disasters through its Disaster Loan Program. GAO initiated work to determine how well SBA provided victims of the Gulf Coast hurricanes with timely assistance. This report, the first of two, focuses primarily on the Disaster Credit Management System (DCMS) and disaster loan process. Here, GAO evaluates (1) what affected SBA's ability to provide timely disaster assistance and (2) actions SBA took after the disasters to improve its response to disaster victims. In conducting this study, GAO analyzed data on loan applications and assessed key aspects of SBA's acquisition and implementation of DCMS.
Although DCMS provided SBA with a number of benefits, several factors affected SBA's ability to provide timely disaster assistance to victims of the Gulf Coast hurricanes. First, the large volume of applications SBA processed greatly exceeded any previous disaster, including the 1994 Northridge earthquake--the largest single disaster SBA previously faced. Second, SBA primarily used this earthquake as the basis for planning the maximum user capacity for DCMS and did not consider information available from catastrophe risk modeling firms and disaster simulations, such as the likelihood and severity of damages from potential catastrophes, to help predict the expected application volume from such events. SBA's limited planning contributed to insufficient DCMS user capacity, which restricted the number of staff that could access the system and process the large volume of applications in a timely manner. SBA also did not receive the correct computer hardware from its contractor, and the agency did not completely stress test DCMS before implementation, which contributed to the system instability, outages, and slow response times initially experienced by SBA staff. As a result of these and other factors, SBA faced significant delays and backlogs in processing loan applications, as depicted in the figure below. This backlog peaked at more than 204,000 applications 4 months after Hurricane Katrina. As of May 27, 2006, SBA processed applications, on average, in about 74 days compared with its goal of within 21 days. Some of the actions SBA took after the Gulf Coast hurricanes helped to improve its response to disaster victims. For example, SBA addressed system-related issues by increasing the number of users that could access DCMS, and it plans to further increase the system's maximum user capacity. SBA implemented other initiatives that had limited success. For example, SBA made only a few loan guarantees under its Gulf Opportunity Pilot Loan Program for small businesses in communities affected by the disasters. SBA would benefit by expediting its planned business process reengineering efforts to analyze ways to more efficiently process loan applications, such as implementing a secure Internet-based application feature for home loan applicants.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-06-860, Small Business Administration: Actions Needed to Provide More Timely Disaster Assistance
This is the accessible text file for GAO report number GAO-06-860
entitled 'Small Business Administration: Actions Needed to Provide More
Timely Disaster Assistance' which was released on July 28, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Addressees:
July 2006:
Small Business Administration:
Actions Needed to Provide More Timely Disaster Assistance:
GAO-06-860:
GAO Highlights:
Highlights of GAO-06-860, a report to congressional addressees
Why GAO Did This Study:
Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused
more than $118 billion in estimated property damages across the Gulf
Coast region in 2005. The Small Business Administration (SBA) helps
individuals and businesses recover from disasters through its Disaster
Loan Program. GAO initiated work to determine how well SBA provided
victims of the Gulf Coast hurricanes with timely assistance. This
report, the first of two, focuses primarily on the Disaster Credit
Management System (DCMS) and disaster loan process. Here, GAO evaluates
(1) what affected SBA‘s ability to provide timely disaster assistance
and (2) actions SBA took after the disasters to improve its response to
disaster victims. In conducting this study, GAO analyzed data on loan
applications and assessed key aspects of SBA‘s acquisition and
implementation of DCMS.
What GAO Found:
Although DCMS provided SBA with a number of benefits, several factors
affected SBA‘s ability to provide timely disaster assistance to victims
of the Gulf Coast hurricanes. First, the large volume of applications
SBA processed greatly exceeded any previous disaster, including the
1994 Northridge earthquake”the largest single disaster SBA previously
faced. Second, SBA primarily used this earthquake as the basis for
planning the maximum user capacity for DCMS and did not consider
information available from catastrophe risk modeling firms and disaster
simulations, such as the likelihood and severity of damages from
potential catastrophes, to help predict the expected application volume
from such events. SBA‘s limited planning contributed to insufficient
DCMS user capacity, which restricted the number of staff that could
access the system and process the large volume of applications in a
timely manner. SBA also did not receive the correct computer hardware
from its contractor, and the agency did not completely stress test DCMS
before implementation, which contributed to the system instability,
outages, and slow response times initially experienced by SBA staff. As
a result of these and other factors, SBA faced significant delays and
backlogs in processing loan applications, as depicted in the figure
below. This backlog peaked at more than 204,000 applications 4 months
after Hurricane Katrina. As of May 27, 2006, SBA processed
applications, on average, in about 74 days compared with its goal of
within 21 days.
Some of the actions SBA took after the Gulf Coast hurricanes helped to
improve its response to disaster victims. For example, SBA addressed
system-related issues by increasing the number of users that could
access DCMS, and it plans to further increase the system‘s maximum user
capacity. SBA implemented other initiatives that had limited success.
For example, SBA made only a few loan guarantees under its Gulf
Opportunity Pilot Loan Program for small businesses in communities
affected by the disasters. SBA would benefit by expediting its planned
business process reengineering efforts to analyze ways to more
efficiently process loan applications, such as implementing a secure
Internet-based application feature for home loan applicants.
Figure: Backlog of Applicants in Loss Verification and Application
Processing:
[See PDf for Image]
Source: GAO analysis of SBA data.
[End of Figure]
What GAO Recommends:
GAO recommends four actions including reassessing DCMS‘s maximum user
capacity based on such things as lessons learned from the Gulf Coast
hurricanes, a review of information available from catastrophe risk
modeling firms and disaster simulations, and related cost
considerations. In comments on a draft of this report, SBA generally
agreed with our recommendations but said more credit should have been
given to its improvement efforts.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-860].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact William B. Shear at (202)
512-8678 or shearw@gao.gov
[End of Section]
Contents:
Letter:
Results in Brief:
Background:
Large Volume of Applications, Limited Planning, and Various System and
Processing Related Challenges Affected SBA's Ability to Provide Timely
Disaster Assistance:
SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees of
Success:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendixes:
Appendix I: Scope and Methodology:
Appendix II: SBA's Acquisition and Implementation of the Disaster
Credit Management System:
Appendix III: Comments from the Small Business Administration:
Appendix IV: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: Significant U.S. Natural Disasters (1988-2005):
Table 2: SBA Application Statistics for Gulf Coast Hurricanes and
Previous Disasters:
Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That
Improved Response to Disaster Victims:
Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had
Limited Success:
Figures:
Figure 1: SBA's Disaster Loan Process:
Figure 2: Number of Disaster Loan Applications Processed and Average
Staffing Levels by Month, September 2005 to May 2006:
Figure 3: FEMA IA Applicants' Current Location by State as of April 10,
2006:
Figure 4: Backlog of Applications in Loss Verification and Application
Processing:
Figure 5: Average Processing Time Frames for Approval and Decline
Decisions, October 2005 to May 2006:
Figure 6: Time Line of DCMS Activities:
Abbreviations:
ALCS: Automated Loan Control System:
COTS: commercial-off-the-shelf:
DAO: Disaster Area Office:
DCMS: Disaster Credit Management System:
FEMA: Federal Emergency Management Agency:
IA: Individual Assistance:
IHP: Individuals and Households Program:
IV&V: Independent Verification and Validation:
IRS: Internal Revenue Service:
ODA: Office of Disaster Assistance:
PDC: Processing and Disbursement Center:
SBA: Small Business Administration:
July 28, 2006:
Congressional Addressees:
In 2005, Hurricanes Katrina, Rita, and Wilma battered the U.S. Gulf
Coast region, causing more than $118 billion in estimated property
damages and over 1,400 deaths.[Footnote 1] As the federal government's
primary lender to victims of disasters, the Small Business
Administration (SBA) provides financial assistance through its Disaster
Loan Program to help homeowners, renters, and businesses of all sizes
recover from disasters such as earthquakes, hurricanes, and terrorist
attacks. In this capacity, SBA plays a crucial role in the long-term
recovery of the Gulf Coast region. Nine months following Hurricane
Katrina, SBA had approved more than 148,700 disaster assistance loans
totaling $9.7 billion to individuals and businesses that suffered
losses from the Gulf Coast hurricanes.[Footnote 2] However, Congress
and press reports have expressed concerns that SBA's response has been
slow, leaving many disaster victims without the timely assistance that
they needed.
In January 2005, SBA began using its new Disaster Credit Management
System (DCMS) to process loan applications for all new disaster
declarations. SBA intended for DCMS to improve the quality and
timeliness of its disaster loan process and enhance its overall
response to disasters compared with SBA's previous system. However,
after the Gulf Coast hurricanes, both press reports and Congress were
critical of DCMS, citing system outages and slow response times as
contributing to delays that disaster victims experienced in receiving
assistance. We have prepared this report under the Comptroller
General's authority to conduct evaluations on his own initiative as
part of a continued effort to assist Congress in reviewing how well SBA
provided victims of the Gulf Coast hurricanes with timely assistance.
In this report, we evaluate: (1) what affected SBA's ability to provide
timely disaster assistance and (2) the actions SBA took after the
disasters to improve its response to disaster victims. This report
focuses primarily on DCMS and the disaster loan process. We plan to
issue a subsequent report that focuses on other factors not related to
DCMS or the disaster loan process that may have affected SBA's ability
to provide timely assistance.[Footnote 3]
In conducting this review, we visited the Gulf Coast region to observe
conditions and meet with federal, state, and local officials and
victims of the disasters. We obtained documents related to SBA's
disaster lending policy and procedures and SBA's acquisition and
implementation of DCMS. We also obtained and analyzed SBA's data on
disaster loan applications processed through May 27, 2006. In addition,
we interviewed officials from SBA's headquarters and its two Field
Operations Centers in California and Georgia, Customer Service Center
in New York, and Processing and Disbursement Center (PDC) in Texas. See
appendix I for a detailed description of our scope and methodology. We
conducted our work between November 2005 and July 2006 in accordance
with generally accepted government auditing standards.
Results in Brief:
We identified several factors that affected SBA's ability to provide
timely disaster assistance to Gulf Coast hurricane victims. The sheer
volume of applications was a significant challenge to SBA. For example,
SBA mailed more than 2.1 million disaster loan applications and
received over 418,000 in return as of May 27, 2006, which greatly
exceeded the volume from any previous disaster, including the 1994
Northridge earthquake--the single largest disaster SBA previously
faced. Although DCMS provided a number of benefits compared with its
previous system and process, such as allowing certain manual tasks to
be performed electronically, SBA's limited planning for the maximum
number of concurrent users in DCMS reduced its ability to provide
timely disaster assistance. Specifically, SBA used the volume of
applications received during the Northridge earthquake and other
historical data as the basis for planning the maximum number of
concurrent users that DCMS could accommodate. SBA did not consider
information available from catastrophe risk modeling firms and disaster
simulations, such as the likelihood and severity of damages from
potential catastrophes, to help predict the expected application volume
from such events and the concurrent user capacity needed to process
expected volumes. Insurance companies and some government agencies use
this information to plan for catastrophic events. SBA's limited
planning contributed to insufficient DCMS user capacity, which
restricted the number of staff that could access the system and process
the large volume of applications in a timely manner. If SBA had
considered information available from catastrophe risk modeling firms
and disaster simulations in planning for DCMS, the agency may have
acquired additional capacity that would have enabled it to reduce its
backlog of applications sooner. In addition, SBA's hosting contractor
provided incorrect computer hardware and ineffective technical support,
which contributed to the initial system instability, outages, and slow
response times SBA staff experienced with DCMS following the Gulf Coast
hurricanes.[Footnote 4] We also found that SBA did not completely
stress test DCMS before implementation. If SBA had conducted complete
stress testing, the agency might have detected that it did not receive
the correct equipment and had an opportunity to address this issue
before implementing the system.[Footnote 5] As a result of these and
other processing-related challenges, SBA developed a large backlog of
applications during the initial months following Hurricane Katrina.
This backlog peaked at more than 204,000 applications 4 months after
Hurricane Katrina. As of May 27, 2006, SBA processed applications on
average in about 74 days, compared with its goal of within 21
days.[Footnote 6]
Some of the actions SBA took to improve its response to disaster
victims after the Gulf Coast hurricanes were more successful than
others. For example, SBA enhanced its ability to provide more timely
disaster assistance by addressing DCMS's instability issues.
Specifically, in October 2005, SBA obtained the computer hardware as
agreed to with its contractor and increased the processing capacity of
the system. By November 2005, SBA added a second work shift for its
loan processing staff to better balance DCMS's workload. In November
2005, SBA also began to utilize DCMS to conduct preprocessing decline
decisions faster for applicants with credit scores that indicated a
high degree of default risk under a pilot program;
this enabled these applicants to be referred to the Federal Emergency
Management Agency (FEMA) for possible grant assistance sooner. SBA
implemented other initiatives with limited success, including the Gulf
Opportunity Pilot Loan Program (GO Loan Program) in November 2005 that
provided an 85 percent guaranty to qualified lenders, such as banks
that made expedited loans available up to $150,000 under the agency's
7(a) loan program to small businesses located in communities affected
by the disasters. Because these lenders could charge interest rates
significantly higher than SBA's disaster loan rates, these loans were
not very attractive to disaster victims, and SBA guaranteed only 222
loans under the program. During the course of our work, we also
identified other potential opportunities to help SBA improve its loan
processing, such as implementing a secure Internet-based application
feature for home loan applications.
To provide more timely assistance to disaster victims in the future,
this report makes four recommendations designed to improve the
efficiency and effectiveness of DCMS and the disaster loan process.
Specifically, we recommend that the Administrator of SBA direct the
Office of Disaster Assistance (ODA) to (1) reassess DCMS's maximum user
capacity and related loan processing resource needs based on such
things as lessons learned from the Gulf Coast hurricanes, a review of
information available from catastrophe risk modeling firms and disaster
simulations, and related cost considerations; (2) improve management
controls over assessing contractor performance through inspections of
equipment purchases for DCMS; (3) conduct complete stress testing to
ensure that DCMS can function at planned for maximum user capacity
levels; and (4) expedite plans to resume business process reengineering
efforts to analyze the disaster loan process and identify ways to more
efficiently process loan applications.
We obtained written comments on a draft of this report from SBA's
Associate Administrator for Disaster Assistance. SBA generally agreed
with our recommendations and said that it intends to improve the
delivery of its program for events of all sizes. However, SBA disagreed
with some of the report findings and conclusions. Specifically, SBA
disagreed with our conclusions that it performed limited planning and
that it would have been better prepared to reduce the backlog of
applications through the use of catastrophe risk models rather than
relying primarily on the Northridge earthquake to establish its
capacity needs. SBA also stated that we did not sufficiently recognize
the improvement it made before and after the Gulf Coast hurricanes.
Further, SBA challenged our finding regarding its expedited approval
process. We continue to believe that catastrophe risk modeling firms
and disaster simulations provide critical information, such as the
likelihood and severity of damages from potential catastrophes that
would have been useful in planning the maximum user capacity of DCMS.
If SBA had considered this information, it may have expanded the
maximum user requirement for DCMS and been better prepared to reduce
the backlog of loan applications more timely. We believe that our
report provides a fair and balanced presentation of SBA's performance
during a difficult period and that our recommendations are aimed at
helping the agency to be more prepared in the event of another large
disaster. The last section of this report provides a complete
assessment of SBA's comments, and its letter is presented in appendix
III.
Background:
The Gulf Coast hurricanes collectively represented the most costly
natural disaster in recent U.S. history. As table 1 shows, the
estimated property damage from these hurricanes exceeded $118 billion,
nearly five times greater than the damage from the 1994 Northridge
earthquake and more than two and one-half times greater than the damage
from the 2004 Florida hurricanes. Hurricane Katrina was the first of
these disasters, causing fatalities and damage in southern Florida in
late August 2005 before striking the northern Gulf Coast region. This
region received the brunt of the storm, including extensive damage and
significant loss of life in Louisiana and Mississippi. Damage from
Hurricane Katrina also extended into the Florida panhandle, Georgia,
and Alabama and covered approximately 90,000 square miles--an area
larger than the size of Great Britain. Hurricane Rita was the next
disaster to strike the Gulf Coast region, making landfall near the
Texas and Louisiana border on September 24, 2005, and causing a wide
swath of damage from eastern Texas to Alabama, flooding some areas in
Louisiana that had already been impacted by Hurricane Katrina about 1
month earlier. Hurricane Wilma was the last of these disasters to
strike the region, making landfall in southern Florida on October 24,
2005, and inflicting widespread damage across the state.
Table 1: Significant U.S. Natural Disasters (1988-2005):
Dollars in billions.
Event: Gulf Coast hurricanes;
Year: 2005;
Property damage: > $118.0[A].
Event: Severe drought/heat wave (central and eastern states);
Year: 1988;
Property damage: 59.3[B].
Event: Florida hurricanes[C];
Year: 2004;
Property damage: > 46.2[B].
Event: Hurricane Andrew;
Year: 1992;
Property damage: 35.0.
Event: Midwest flooding;
Year: 1993;
Property damage: 26.6.
Event: Northridge earthquake;
Year: 1994;
Property damage: 24.9[B].
Event: Hurricane Hugo;
Year: 1989;
Property damage: > 12.9.
Event: Severe drought (eastern, western, and Great Plains states);
Year: 2002;
Property damage: > 10.8.
Event: Severe weather and flooding (southeast and southwest states);
Year: 1995;
Property damage: > 7.3.
Event: Northern Plains flooding;
Year: 1997;
Property damage: 4.4.
Event: Southern California wildfires;
Year: 2003;
Property damage: > 2.6.
Source: National Oceanic and Atmospheric Administration, U.S.
Geological Survey.
Note: Damage amounts are adjusted to 2005 dollars using gross domestic
product price index.
[A] Preliminary estimate.
[B] Estimated damages.
[C] Includes Hurricanes Charley, Frances, Ivan, and Jeanne.
[End of table]
The federal government provides funding and assistance after disasters
through a variety of agencies and programs. Congress created FEMA to
coordinate response and recovery efforts under presidential disaster
declarations. FEMA works with other federal, state, and local agencies
to assist victims after major disasters, and volunteer organizations
such as the American Red Cross also participate in these efforts.
Following a presidential disaster declaration, FEMA will open Disaster
Recovery Centers where disaster victims can meet with representatives,
obtain information about the recovery process, and register for federal
disaster assistance. Victims may also register with FEMA by telephone
or via FEMA's Internet site. FEMA provides housing assistance to
disaster victims through the Individuals and Households Program
(IHP).[Footnote 7] Under the IHP, FEMA can make grants available to
repair or replace housing damaged in a disaster that is not covered by
insurance. However, the IHP is a minimal repair program that is
designed to make the victim's home habitable and functional, not to
restore the home to its predisaster condition. When disaster victims
register for FEMA assistance, they are asked to provide their
approximate household income. If the applicant's income exceeds certain
thresholds, FEMA automatically refers them to SBA's Disaster Loan
Program.[Footnote 8]
SBA's Disaster Loan Program is the primary federal program for funding
long-range recovery for private sector, nonfarm disaster victims and
the only form of SBA assistance not limited to small businesses. The
Small Business Act authorizes SBA to make available the following two
types of disaster loans:
* Physical disaster loans--These loans are for permanent rebuilding and
replacement of uninsured or underinsured disaster-damaged property.
They are available to homeowners, renters, businesses of all sizes and
nonprofit organizations. These loans are intended to repair or replace
the disaster victim's damaged property to its predisaster condition.
* Economic injury disaster loans--These loans provide small businesses
with necessary working capital until normal operations resume after a
disaster declaration. They cover operating expenses the business could
have paid had the disaster not occurred. The act restricts economic
injury disaster loans to small businesses only.
Under a presidential disaster declaration, SBA disaster assistance
staff members secure space within FEMA--established Disaster Recovery
Centers and begin meeting with victims to explain the agency's disaster
loan process, issue loan applications and, if requested, assist victims
in completing applications. Figure 1 illustrates SBA's disaster loan
process.
Figure 1: SBA's Disaster Loan Process:
[See PDF for image]
Source: GAO.
[End of figure]
During the application entry stage, SBA screens all incoming
applications to determine if they are acceptable.[Footnote 9] In
addition, SBA conducts a preliminary financial analysis of home loan
applications to determine whether the applicant's income falls below
the agency's minimum income thresholds or if repayment ability is
evident based on a review of the applicant's gross income and fixed
debts.[Footnote 10] SBA declines home loan applicants that do not meet
its minimum income requirements or demonstrate repayment ability. SBA
also obtains a credit bureau report for business and home loan
applicants, and SBA may decline an applicant based on information
contained in the report. SBA refers to denials made during the
application entry stage as preprocessing declines. SBA intended for
these declines to eliminate delays in notifying applicants about loan
denials. SBA will refer most home loan applicants denied a loan to FEMA
for possible grant assistance under a presidential disaster
declaration.[Footnote 11] After the application entry stage,
applications move to the loss verification stage, and SBA staff members
scan application documents into DCMS.[Footnote 12]
During the loss verification stage, loss verifiers conduct on-site
damage inspections for physical disaster loan applications to estimate
the cost of restoring damaged property to predisaster condition. Loss
verifiers use tablet personal computers with software tailored to
complete and submit reports electronically into DCMS. The verified loss
becomes the basis for the loan amount. Once the loss verification is
complete, an application moves to the application processing stage,
where loan officers check for duplication of benefits and assess the
applicant's credit history and ability to obtain credit
elsewhere.[Footnote 13] Loan officers also examine other applicant
eligibility criteria, including compliance with child support
obligations and history on other federal debt, such as student loans.
Loan officers use a financial analysis tool within DCMS to determine if
the applicant has the ability to repay the loan. As with preprocessing
declines, SBA generally refers home loan applicants denied a loan in
application processing to FEMA for possible grant assistance under
presidential disaster declarations.
For secured loans, legal staff members review the draft loan
authorization and agreement for sufficiency of collateral instruments
and other legal concerns.[Footnote 14] They also create a loan closing
checklist--a list of the requirements necessary to generate the loan
closing and other legal documents. Attorneys enter a legal concurrence
into DCMS, which obligates the loan funds through an interface with
SBA's accounting system. Legal support staff members prepare closing
documents and mail them to the applicant or nearest Disaster Recovery
Center. SBA can make a maximum initial disbursement, without
collateral, of up to $10,000 for physical disaster loans and $5,000 for
economic injury disaster loans, once the agency receives signed closing
documents from the applicant. SBA can make a maximum initial
disbursement of up to $25,000 for physical disaster loans with
collateral--preferably real estate.[Footnote 15] SBA generally makes
subsequent disbursements on physical disaster loans based on the
applicant's needs and how they spent prior disbursements.
DCMS replaced SBA's largely manual, paper-based loan process and its
Automated Loan Control System (ALCS), which it had used since the early
1990s. ALCS enabled SBA to track the movement of paper loan application
files from one stage of the process to another, but the manual loan
process required the movement and storage of large volumes of paper. In
December 1998, SBA began planning for a replacement disaster loan
system. SBA purchased a commercial-off-the-shelf package as the
foundation for DCMS in 2003 and had the package customized. SBA
intended for DCMS to help it move toward a paperless processing
environment by automating many of the functions staff members had
performed manually, such as obtaining FEMA referral data and credit
bureau reports, as well as completing and submitting loss verification
reports from remote locations. SBA began a phased implementation of
DCMS in November 2004 at its former Niagara Falls Disaster Area Office
(DAO).[Footnote 16] In January 2005, SBA began using DCMS to process
loan applications for all new disaster declarations and by March 2006,
SBA completed the migration of all data for disaster loan applications
processed since 2000 from ALCS to DCMS. According to SBA, the cost for
planning, acquiring, implementing, and operating DCMS totaled about $32
million through April 2006. See appendix II for a more detailed
discussion of SBA's acquisition and implementation of DCMS.
Large Volume of Applications, Limited Planning, and Various System and
Processing Related Challenges Affected SBA's Ability to Provide Timely
Disaster Assistance:
We identified several factors that affected SBA's ability to provide
timely disaster assistance, including a large volume of applications
that exceeded any previous disaster. In addition, although DCMS allowed
SBA to streamline the disaster loan process, SBA focused only on its
historical experience and did not consider the possibility of a single
or series of disasters of the magnitude of the Gulf Coast hurricanes
when planning the system's maximum user requirements. SBA's limited
planning contributed to insufficient DCMS user capacity, which
restricted the number of staff that could access the system and process
the large volume of applications in a timely manner. Further, SBA did
not completely stress test DCMS before implementation to help ensure
that it could function at its maximum user capacity and thus did not
detect that the wrong processors had been installed by its hosting
contractor and that the system could not support planned capacity. As a
result of these and other processing-related factors, SBA experienced
significant backlogs and delays in processing applications. Overall,
SBA processed disaster loan applications in 74 days, on average, as of
May 27, 2006, compared with its goal of within 21 days.
Large Volume of Loan Applications Affected SBA's Response to Hurricane
Victims:
According to SBA officials, the large volume of disaster loan
applications it processed for victims of the Gulf Coast hurricanes was
a significant challenge. The volume of applications associated with
these hurricanes greatly exceeded any disaster in SBA's history. As
table 2 shows, as of May 27, 2006, SBA had issued more than 2.1 million
applications to victims affected by the Gulf Coast hurricanes. This
represented almost four times as many applications as SBA issued to
victims of the Northridge earthquake--the single largest disaster SBA
had previously faced. In addition, our analysis showed that SBA
received a large influx of applications during the initial months
following Hurricane Katrina--at the same time that SBA hired and
trained a large number of temporary staff to process applications
received from victims of the disasters. Specifically, SBA received
about 280,000 applications during the first 3 months following
Hurricane Katrina, approximately 30,000 more applications than SBA
received over a period of about 1 year from victims of the Northridge
earthquake.
Table 2: SBA Application Statistics for Gulf Coast Hurricanes and
Previous Disasters:
Event: Gulf Coast hurricanes[B];
Applications issued: 2,152,793;
Applications received[A]: 418,157.
Event: Florida hurricanes[C] (2004);
Applications issued: 869,577;
Applications received[A]: 179,025.
Event: Northridge, California earthquake (1994);
Applications issued: 566,260;
Applications received[A]: 250,402.
Event: Hurricane Andrew, Florida (1992);
Applications issued: 110,539;
Applications received[A]: 40,568.
Event: Upper Midwest floods (1997);
Applications issued: 46,968;
Applications received[A]: 18,752.
Event: September 11 terrorist attacks (2001);
Applications issued: 66,893;
Applications received[A]: 25,825.
Source: SBA.
Note: According to SBA officials, in 1996, the agency implemented a
combined application for business physical disaster and economic injury
disaster loan applications from the same applicant. The number of
applications issued and received for Hurricane Andrew and the
Northridge earthquake has not been adjusted to reflect this change.
[A] Represents applications accepted into DCMS. According to SBA, these
numbers exclude applications that SBA declined during the application
entry stage where the applicant did not meet the agency's minimum
income thresholds or demonstrate repayment ability.
[B] Statistics for Hurricanes Katrina, Rita, and Wilma as of May 27,
2006.
[C] Includes Hurricanes Charley, Frances, Ivan, and Jeanne.
[End of table]
SBA officials told us that the large volume of applications that it
mailed and received resulted in part from the large number of referrals
FEMA made to SBA's Disaster Loan Program without applying SBA's income
thresholds, specifically for disaster victims who registered for
disaster assistance via FEMA's Internet site and did not report any
income. According to a FEMA official, disaster victims who register via
FEMA's Internet site can select the "Income Unavailable/Refused" option
if they do not wish to or cannot provide their income. The official
stated that these individuals are advised that selecting this option
will result in an SBA referral. The FEMA official also stated that, per
an SBA request, FEMA refers all applicants who claim self-employment as
their primary source of income to SBA's Disaster Loan Program,
regardless of their income, because the income tests are not a valid
measure of repayment ability for self-employed applicants. In both
cases, FEMA's registration system automatically fills $0 as the
disaster victim's income and refers these individuals to SBA's Disaster
Loan Program. The FEMA official stated that about 17 percent of the
individuals referred to SBA for Hurricanes Katrina and Rita refused to
provide their income, and another 17 percent indicated that they were
self-employed. SBA officials referred to these cases as "$0 income"
referrals.
In February 2006, SBA's Office of Inspector General issued an advisory
memorandum, stating that many $0 income referrals ultimately failed
SBA's criteria for disaster loan eligibility and were processed as
declines.[Footnote 17] SBA's Office of Inspector General added that
these referrals impacted SBA by:
* increasing the cost incurred by SBA in mailing loan applications to
disaster victims that normally would not be referred to SBA's Disaster
Loan Program;
* delaying response times for those applicants who did qualify for
SBA's Disaster Loan Program;
* lowering SBA's disaster loan approval rates;
and:
* increasing the transaction flow through DCMS, which was near maximum
capacity.
SBA's Office of Inspector General recommended that SBA improve its
screening processes within DCMS when processing $0 income referrals and
work with FEMA to reduce unnecessary online disaster referrals. In
commenting on a draft of the advisory memorandum, SBA agreed that it
should work with FEMA to improve their joint screening process prior to
referral and issuing an SBA disaster loan application.
Limited Planning for DCMS User Capacity Reduced SBA's Ability to
Provide Timely Disaster Assistance:
DCMS provided SBA with a number of benefits compared with its previous
system, such as the capability to complete loss verification reports
and other processing-related tasks electronically. However, SBA planned
DCMS's maximum user capacity based solely on the volume of applications
it received from victims of the Northridge earthquake and its other
historical data; it did not consider the information available from
catastrophe risk modeling firms or disaster simulations such as the
likelihood and severity of damages from potential catastrophes.
Although agencies are not specifically required to consider such
information in developing their system's user capacity requirements,
this information could have helped SBA predict the volume of loan
applications to expect and the necessary user capacity needed to
process such a volume. SBA officials acknowledged that they could have
considered this information in planning DCMS's user capacity
requirements but lacked the funding to do so. SBA's limited planning
and other system and processing related issues diminished the agency's
ability to provide disaster assistance in a timely manner.
Many insurance companies and government agencies currently use computer
programs offered by several modeling firms to estimate the financial
consequences of various natural catastrophe scenarios. Risk modeling
firms, which have existed since the late 1980s, rely on sophisticated
mathematical modeling techniques and large databases containing
information on past catastrophes, population densities, construction
techniques, and other relevant information to assess the severity of
potential catastrophes so that other organizations can plan
accordingly. For example, one modeling firm recently estimated that 1.5
million people were vulnerable to an earthquake on the San Andreas
Fault in the San Francisco area and that an earthquake similar to the
1906 earthquake would cause an estimated $260 billion in damages to
residential and commercial properties. This study also noted that the
U.S. Geological Survey estimated that there was a 21 percent
probability of a major earthquake on this fault occurring before
2032.[Footnote 18] Another modeling firm study of a strong hurricane
striking the densely populated Northeast region estimated this event
could cause more than $200 billion in economic losses, including
significant damage from flooding to properties and infrastructure in
lower Manhattan and Long Island.[Footnote 19] While SBA would not
utilize this information the way insurance companies do to assess the
financial consequences of potential disasters, catastrophe risk
modeling firms provide important information on the severity of damages
from such events. This information could be helpful in estimating the
potential number of loan applications that SBA could receive for
processing and the concurrent user capacity necessary to process such
applications in a timely manner if such an event were to occur.
Government agencies and other organizations also participate in
disaster simulation exercises to prepare for their response to natural
disasters. While SBA would not use this disaster simulation information
to plan a response to victims' immediate needs, the estimated number of
buildings damaged and number of people evacuated provides important
information that can be considered in planning the user capacity of a
disaster loan system. For example, FEMA brought together numerous
officials from local, state, federal, and volunteer organizations to
conduct an exercise referred to as Hurricane Pam in July 2004. This
exercise used realistic weather and damage information developed by the
National Weather Service, the U.S. Army Corps of Engineers, the
Louisiana State University Hurricane Center, and other state and
federal agencies to help officials develop joint response plans for a
catastrophic hurricane in Louisiana. This fictional hurricane brought
sustained winds of 120 miles per hour, up to 20 inches of rain in parts
of southeast Louisiana, and storm surge that topped levees in the New
Orleans area. Hurricane Pam, as projected, destroyed between 500,000
and 600,000 buildings and forced the evacuation of more than 1 million
residents from the New Orleans area.
In planning the maximum user capacity for DCMS, SBA relied solely on
the volume of applications it received from victims of the Northridge
earthquake and its other historical data, such as the average number of
applications processed for the previous 5 years. SBA did not plan for
the likelihood of a single disaster or series of disasters of the
magnitude of the Gulf Coast hurricanes. If SBA had considered the
information available from catastrophe risk modeling firms or disaster
simulations, such as the likelihood and potential damages from
catastrophic events, to help it predict the volume of loan applications
that might be expected and the user capacity needed to process this
volume, the agency may have acquired additional capacity that would
have enabled it to reduce its backlog of applications sooner. SBA's
limited planning contributed to insufficient DCMS user capacity, which
restricted the number of staff that could access the system and process
the large volume of applications in a timely manner.
Ineffective Technical Support Affected the Stability of DCMS and SBA's
Ability to Provide Timely Disaster Assistance:
SBA experienced instability with DCMS during the initial months
following Hurricane Katrina, as users experienced outages, difficulties
connecting to the system, and slow response times in completing loan
processing tasks. For example, our review of DCMS system logs showed
that between September and December 2005 SBA experienced the following
incidents:
* 19 incidents where DCMS was not available to all system users due to
an unscheduled outage, and:
* 26 incidents where DCMS was not available to various units due to an
unscheduled outage.
SBA officials told us that the longest period of time DCMS was
unavailable to users due to an unscheduled outage was 1 business day.
These unscheduled outages and other system-related issues slowed
productivity and affected SBA's ability to provide timely disaster
assistance; however, we could not determine the specific impact on the
agency's time frames for processing disaster loan applications received
from Gulf Coast hurricane victims.
According to SBA officials, ineffective technical support contributed
to the system instability experienced by users, as its hosting
contractor did not properly monitor the DCMS network as contractually
required and did not make the agency aware of incidents that could make
the system unstable prior to DCMS users being affected. In addition,
SBA officials told us that its hosting contractor did not provide the
agency with the correct computer hardware for DCMS as contractually
required, which further contributed to the instability users initially
experienced with the system and reduced processing power by about one-
third. Specifically, in developing DCMS, SBA planned for a maximum
capacity of 1,500 concurrent users. SBA officials told us that they
discovered that DCMS was operating near 100 percent capacity in
September 2005 before the agency had reached its maximum user capacity.
At that time, SBA discovered that the hosting contractor had not
provided the agency with the correct computer hardware required per its
contract in order to support 1,500 concurrent users.
However, SBA did not verify that its hosting contractor provided the
agency with the correct computer hardware specified in its contract.
Federal procurement policies require agencies to have trained and
experienced officials available to judge whether contractors are
performing according to contract terms and conditions, particularly
when contracting for highly specialized or technical services.[Footnote
20] In addition, SBA's internal procurement procedures require that the
agency inspect each item or service provided under a contract, report
capital equipment acquisitions immediately--including computer
equipment, and provide a serial number for capital equipment
acquisitions for tracking purposes. SBA officials did not have an
explanation for why the agency did not verify that the hosting
contractor provided the correct computer hardware. If SBA had verified
this equipment as required, the agency might have discovered this issue
prior to the Gulf Coast hurricanes and been able to take the
appropriate corrective action.
SBA Did Not Completely Stress Test DCMS to Ensure It Could Function at
Maximum Capacity:
Prior to implementation, SBA did not completely stress test DCMS to
ensure that the system could operate effectively at maximum capacity,
which contributed to the initial system instability SBA experienced. In
2003, SBA began testing various aspects of DCMS, including the core
application interfaces and additional components such as loss
verification and scanning. Although SBA conducted performance testing
for DCMS, we found that the agency only stress tested the system for up
to 120 concurrent users due to limitations with the hardware in the
testing environment. The testing environment simulated an increasing
number of concurrent users and exercised different functional
scenarios, but the hardware used in the simulation reached its capacity
earlier than anticipated. Even if the testing environment functioned as
planned, an estimate showed that DCMS could accommodate approximately
600 concurrent users at this time--significantly less than the system's
planned maximum capacity of 1,500.
According to leading information technology organizations, to be
effective, practices for testing software should be planned and
conducted in a structured and disciplined environment.[Footnote 21]
Typically, this involves testing increasingly larger increments of a
system until the complete system and all of its functionality are
tested and accepted. It also involves stress testing and fully
demonstrating the effectiveness and accuracy of the system.
Additionally, SBA's internal systems development manual requires that
the agency determine testing and acceptance criteria that must be met
for a system to be accepted as "fit for use" by the user or sponsoring
organization and requires user or sponsoring organization approval of
all acceptance criteria. Further, the manual identifies how acceptance
testing is to be conducted and reported to determine whether the system
meets its requirements upon completion of its development. In doing
limited stress testing of DCMS, SBA did not completely follow its own
requirements or industry best practices for systems testing. When these
requirements are not met, there is potential risk that the implemented
system will not meet the system requirements. If SBA had conducted
complete stress testing, the agency might have detected that it did not
receive the correct equipment and had an opportunity to address this
issue before implementing DCMS.
Other Processing Related Challenges Affected SBA's Ability to Provide
Timely Disaster Assistance:
Because of the unpredictable nature of disasters and the cost of
maintaining staff that it might not need, SBA hires and trains a large
number of temporary staff to help process loan applications following
any large scale disaster, such as the Gulf Coast hurricanes. SBA also
has a disaster reserve corps, a group of experienced individuals it
relies upon who have worked with the agency in responding to previous
disasters and are trained in its disaster loan process. SBA officials
told us that it generally took approximately 30 days for loan officers
without prior SBA experience to become fully productive. This slows
processing during the initial months following a disaster, as loan
officers become familiar with SBA's disaster loan process and DCMS. In
response to the Gulf Coast hurricanes, SBA also had to secure
additional space and equipment to support loan processing. According to
SBA officials, this process took approximately 30 to 60 days. As figure
2 shows, as the average number of loan processing staff increased, SBA
generally processed more applications than it did during the first 2
months following Hurricane Katrina.
Figure 2: Number of Disaster Loan Applications Processed and Average
Staffing Levels by Month, September 2005 to May 2006:
[See PDF for image]
Source: GAO analysis of SBA data.
[End of figure]
Because SBA normally relies on temporary staff to help process loan
applications after large disasters, it might be unrealistic to expect
the agency to process a large volume of applications quickly during the
initial period following such disasters.
The geographic dispersion of disaster victims--in particular for
Hurricanes Katrina and Rita--also affected SBA's ability to provide
timely disaster assistance. Figure 3 illustrates the location of
displaced applicants affected by these disasters that registered for
FEMA IA. These applicants relocated to all 50 states, with the largest
concentrations in Louisiana, Mississippi, and Texas. SBA officials told
us that FEMA referred many of these applicants to its Disaster Loan
Program, and their widespread geographic dispersion made it more
challenging to provide timely disaster assistance. Loan officers we met
with also told us that contacting applicants to discuss the status of
their loan application was difficult in some cases--particularly during
the initial months following the disasters, as some applicants had
moved or changed employment several times since applying for disaster
assistance. Thus, SBA did not always have an applicant's most current
information, which slowed the processing of their application.
Figure 3: FEMA IA Applicants' Current Location by State as of April 10,
2006:
[See PDF for image]
Source: Copyright Corel Corp. All rights reserved (map) and FEMA
(data).
[End of figure]
Note: These are applicants that registered for Hurricanes Katrina and
Rita only.
As a Result of These Factors, SBA Did Not Significantly Reduce Its
Backlog of Applications until Several Months after Hurricane Katrina:
Our analysis showed that it took SBA several months to significantly
reduce the backlog of applications that developed in various stages of
its disaster loan process because of the large volume of applications,
limited planning for DCMS, and other processing-related challenges. For
example, SBA did not clear the backlog in the application entry stage
until nearly 3 months following Hurricane Katrina. SBA nearly cleared
the backlog in the loss verification stage 8 months after the disaster
when the backlog was reduced to less than 1,800 applications. However,
at that time, SBA still needed to complete loan processing for about
25,000 applications.
As figure 4 shows, SBA's backlog in the loss verification and
application processing stages increased significantly during the first
3 months following Hurricane Katrina as SBA began receiving a large
volume of applications from victims of the other hurricanes. These
backlogs combined peaked at over 204,000 applications in late December
2005. Figure 4 also shows that, individually, SBA's backlog in the loss
verification stage peaked at almost 129,200 applications about 3 months
following Hurricane Katrina, and the backlog in the application
processing stage peaked at more than 121,700 applications nearly 6
months after the disaster. As a result of the backlogs, victims of the
Gulf Coast hurricanes waited about 74 days on average for SBA to
process their loan applications, compared with the agency's goal of
within 21 days.
Figure 4: Backlog of Applications in Loss Verification and Application
Processing:
[See PDF for image]
Source: GAO analysis of SBA data.
[End of figure]
Figure 5 shows SBA's average processing time frames for approval and
decline decisions made between mid-October 2005 and May 2006 compared
with its goal of within 21 days. Although SBA began to reduce the total
backlog in loss verification and application processing in late
December 2005, average processing time frames for approval and decline
decisions generally increased through May 2006 because of the average
age of applications in the backlog. For example, SBA reduced the
backlog in application processing to less than 4,500 by late May 2006;
however, average processing time frames were still significantly higher
than its goal because loan applications had been in the application
processing queue for a long time--about 63 days on average.
Figure 5: Average Processing Time Frames for Approval and Decline
Decisions, October 2005 to May 2006:
[See PDF for image]
Source: GAO analysis of SBA data for 2005 Gulf Coast hurricanes.
[End of figure]
SBA's processing average for approvals does not include additional time
frames for loan closings and initial disbursements. For example, SBA
received signed closing documents from borrowers about 35 days, on
average, after making the approval, as of May 27, 2006. According to
SBA officials, delays in closing loans were mostly the result of
factors beyond their control. For example, SBA officials stated that
they scheduled loan closings at the convenience of the borrower. These
officials added that because of the displacement of Gulf Coast
hurricane victims, SBA had closed about 50 percent of disaster loans by
mail, a higher percentage than previous disasters, which generally
takes more time than closings done in person. SBA officials also stated
that there were a significant number of disaster victims who had not
returned to the affected area and who had expressed uncertainty about
rebuilding their homes and businesses. As a result, these victims had
been reluctant to quickly close on their loans. SBA's disaster lending
procedures generally require applicants to close loans within 60 days
of the date on the loan authorization and agreement. These procedures
also allow SBA to accept loan closing documents after 60 days on a
discretionary basis. SBA officials told us they had allowed Gulf Coast
hurricane victims additional time to determine if they really wanted
the loan. To facilitate loan closings, SBA officials also told us they
used staff to conduct follow-up calls with borrowers after closing
documents were mailed.
In addition, our analysis of an SBA data extract further showed that
the agency made an initial disbursement for approved loans on average
about 9 days after the receipt of closing documents. As of May 27,
2006--9 months after Hurricane Katrina--SBA had disbursed about $1.4
billion or 14 percent of the $9.7 billion approved loan dollars. As of
the same date, about 73,000 approved loans had not been fully disbursed
to disaster victims. As with loan closings, SBA officials stated that
the length of time it took to disburse disaster loans was primarily
determined by the borrower. SBA's disaster lending procedures require
borrowers to arrange for and obtain all loan funds within 12 months
from the date of the loan agreement. However, SBA officials told us
that it might be difficult for some disaster victims to meet this
requirement. In our subsequent report on SBA's response to the Gulf
Coast hurricanes, we plan to discuss the perspectives of disaster
victims related to the disaster loan process.
SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees of
Success:
Although SBA took several actions after the Gulf Coast hurricanes to
improve its response to disaster victims, our analysis showed that some
of these actions were more successful at reducing the backlog of loan
applications than others. For example, SBA increased the number of
concurrent users that could access DCMS by acquiring additional
computer hardware and adding a second work shift for loan processing
staff to better balance the system's workload. In addition, SBA
initiatives to relax filing requirements for applicants whose business
records were destroyed and establish a satellite office to process
disaster loans at its former Sacramento DAO allowed SBA to improve its
response to disaster victims. However, SBA did not experience as much
success with its initiatives to expedite small business financing to
communities affected by the disasters and use private sector banks to
process disaster loan applications. As a result, some of SBA's
initiatives did not significantly reduce the backlog of loan
applications or the time victims waited for SBA to process their
disaster loan applications.
SBA Took Actions to Address DCMS Instability and Other System-Related
Issues:
As previously discussed, SBA initially experienced instability and
other issues with DCMS. However, the agency took actions to address
these issues. In October 2005, SBA obtained the computer hardware, as
agreed to with its contractor, that increased DCMS's capacity to about
2,000 concurrent users. SBA also obtained additional support from its
hosting contractor, at no additional cost, to ensure adequate
monitoring of the DCMS network. By November 2005, because DCMS
continued to operate near its maximum capacity, SBA added a second
shift for loan processing staff at its Fort Worth processing facility
to better balance DCMS's workload. According to SBA officials, DCMS had
been stable since January 2006, and users reported having a greater
comfort level and more success in processing applications using the
system. The officials added that the hosting contractor had provided
better oversight over DCMS compared with the initial months following
Hurricane Katrina. In April 2006, SBA officials advised us that the
agency had not made any payments to its hosting contractor since August
2005 because it did not satisfy contract requirements, and negotiations
were under way to determine the amount of any subsequent payments.
In preparation for the 2006 hurricane season, SBA awarded a new
contract in April 2006 for up to $54 million to its integration
contractor to provide project management and information technology
support for DCMS over the next 5 years. This contractor will continue
to upgrade the system to support increased loan processing activity by
implementing software changes and hardware upgrades, providing ongoing
support to DCMS users, and supporting all information technology
operations associated with the system under the contract. In addition,
SBA has plans to increase DCMS's maximum user capacity to at least
8,000 concurrent users by the summer of 2006. However, we could not
determine how SBA selected this number or whether the agency considered
the information available from catastrophe risk modeling firms or
disaster simulations in determining the planned for increase in maximum
user capacity. To facilitate this planned capacity increase, SBA added
on to and extended the contract with its hosting contractor in February
2006. Although SBA had experienced problems with the initial oversight
provided by this hosting contractor, according to agency officials, the
contractor's performance had improved. For example, the contractor had
dedicated a project manager to this effort. Because of these
improvements and the contractor's familiarity with SBA's needs, agency
officials decided that the contractor could provide a hardware solution
for the expanded capacity within the agency's time frames.
SBA's Processing Changes and Other Initiatives Had Varied Success:
After the Gulf Coast hurricanes, SBA made several changes to its
disaster loan process and implemented other initiatives intended to
improve its response to victims. While some of these initiatives
improved SBA's ability to process large numbers of disaster loan
applications, others did not. For example, in October 2005, SBA
established a satellite office to process disaster loans at its former
Sacramento DAO.[Footnote 22] SBA increased the number of loan
processing staff in this Sacramento satellite office from approximately
40 in late August 2005 to more than 250 by February 2006. According to
SBA, 8 months after Hurricane Katrina, the Sacramento satellite office
had processed about 95,500 home and 4,800 business applications through
DCMS for Gulf Coast hurricane victims.[Footnote 23] Table 3 describes
other SBA changes or initiatives that improved its response to disaster
victims by making the application process easier or referring some
applicants to FEMA for grant assistance sooner.
Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That
Improved Response to Disaster Victims:
Name: Revised filing requirements for business applications[A];
Date: October 2005;
Description: Reduced filing requirements for all business applicants,
such as tax returns for past three years and monthly sales analysis
because these records may have been destroyed. This initiative enabled
victims to file their applications sooner.
Name: Alternate loss verification methods;
Date: October 2005;
Description: Authorized loss verification staff to perform
verifications for home loan applicants using third party documentation
in certain areas and to verify property damages without the applicant
being present in certain cases.
Name: Revised preprocessing decline procedures;
Date: November 2005;
Description: Used DCMS to automatically decline applicants with credit
scores indicating a high degree of default risk to refer applicants to
FEMA for possible grant assistance sooner than the normal process.
Source: GAO analysis of SBA data.
[A] Change made for Hurricanes Katrina and Rita only.
[End of table]
In contrast to these actions, SBA implemented other initiatives that
had more limited success. For example, in November 2005, SBA
implemented the GO Loan Program. SBA intended for this program to
expedite small business financing for communities severely impacted by
Hurricanes Katrina and Rita. This program provided an 85 percent
guaranty to qualified lending partners, such as banks, that agreed to
make expedited loans available under the agency's 7(a) loan program up
to $150,000 to small businesses located in communities affected by the
disasters. Under the GO Loan Program, small businesses applied directly
to qualified lenders, who evaluated their creditworthiness and
determined if they required an SBA guaranty to make the loan. SBA
agreed to make a decision on whether to apply a guaranty to the loan
within 24 hours. While SBA prescribed the maximum interest rate lenders
could charge, the lender and borrower negotiated the actual rate. For
loans of $50,000 or less, lenders could charge a maximum interest rate
of 6.5 percentage points over the prime rate and a maximum rate of 4.5
percentage points over the prime rate for loans over $50,000. Thus,
lenders could charge disaster victims interest rates that were
significantly higher under the GO Loan Program than the rates SBA
charged under the Disaster Loan Program. For example, a disaster victim
applying for a $60,000 GO Loan could have been charged an interest rate
up to 11.5 percent in November 2005 when the prime rate was 7 percent.
In contrast, a business owner not able to obtain credit elsewhere would
have received a 4 percent rate under the Disaster Loan Program. SBA
only guaranteed 222 GO Loans totaling $19 million through May 2006. The
higher interest rates lenders could charge under the GO Loan Program
made these loans less attractive than SBA disaster loans and likely
contributed to the small number of loans made under the program.
In December 2005, SBA implemented a pilot program to expedite the
processing of disaster loan applications. Under this program, DCMS made
automatic approval recommendations for applicants with credit scores
indicating that they were less likely to default on a loan, and loan
officers did not have to conduct the lengthy repayment analysis for
these applications. According to SBA, loan officers processed 8 to 10
home loan applications per day, on average, under the pilot program--
about twice as many applications as under the normal process. However,
loan officers did not review DCMS-generated approval recommendations
until after the loss verification stage under the program. In addition,
when SBA implemented the pilot program, the agency faced a significant
backlog of 115,000 applications in the loss verification stage, and
these applications had been in the queue for 39 days on
average.[Footnote 24] As a result, SBA's data showed that the agency
actually took longer to process expedited approvals compared with SBA's
average processing time frames for all approvals. Specifically, SBA
processed expedited approvals in about 104 days on average between
December 2005 and April 2006, compared with 94 days for all approvals
processed through the end of April 2006. If SBA had implemented this
initiative sooner when the backlog in loss verification was not so
large or if the agency had implemented an expedited loss verification
process for these applications, the pilot program may have been more
effective in reducing the amount of time disaster victims waited for a
decision on their application. Table 4 describes other SBA actions or
initiatives that did not significantly reduce the backlog of loan
applications because they were either not implemented in a timely
manner or did not fully incorporate the use of DCMS to process
applications.
Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had
Limited Success:
Name: Give a Lending Hand Initiative;
Date: November 2005;
Description: Requested volunteers from the business lending community
to help process business disaster loan applications. SBA hired only 14
individuals under the initiative.
Name: District office processing of disaster home loan applications;
Date: January 2006;
Description: Used district office staff to manually process home loan
applications using paper copies of the loan applications. This was a
labor and time intensive process because district office staff did not
have access to DCMS, and SBA's Fort Worth PDC staff had to compile and
ship files, make corrections to files returned, and input completed
decisions into DCMS.
Name: Presolicitation notice for loss verification services[A];
Date: January 2006;
Description: Issued a presolicitation notice for contractors to perform
loss verifications nearly 5 months after Hurricane Katrina. SBA decided
not to issue a solicitation because the agency had significantly
reduced the backlog of applications in loss verification by February
2006.
Name: Disaster Loan Partners;
Date: February 2006;
Description: Solicited proposals from local banks and other entities to
process disaster loan applications. Similar proposal made by private
sector banking association in October 2005. According to SBA, the
agency decided to make three separate awards but received requests for
debriefings from several unsuccessful entities. SBA determined it could
not move forward on awarding specific task orders under the initiative
until the agency conducted the debriefings, and the protests were
resolved.
Source: GAO analysis of SBA data.
[A] Change made for Hurricanes Katrina and Rita only.
[End of table]
SBA May Be Able to Process Applications More Efficiently:
DCMS provided SBA with opportunities to help the agency move toward a
paperless processing environment by automating many of the functions
the agency previously performed manually, such as obtaining FEMA
referral data and credit bureau reports as well as completing and
submitting loss verification reports from remote locations. SBA
officials also told us that DCMS improved its ability to process
disaster loans, and the agency would have experienced even greater
processing delays using its previous system and loan process. However,
we found other potential opportunities during our review that might
help SBA to process loans more efficiently and move closer to its goal
of processing loan applications within 21 days when faced with
disasters.
For example, SBA may be able to increase the efficiency of its
application entry process by implementing a secure Internet-based
application feature for home loan applicants. Currently, SBA accepts
only paper loan application documents from disaster victims, and data-
entry staff manually input application data into DCMS. According to the
Direct Loan Systems Requirements issued by the Joint Financial
Management Improvement Program, federal agency loan systems "should
provide for an electronic application process using various media, such
as a secure Internet application."[Footnote 25] SBA could reduce the
number of paper application documents it receives, the number of
documents it subsequently scans into DCMS, and the resources and time
required to input application data by capturing much of this
information electronically. According to SBA officials, DCMS has the
capability to interface with a secure Internet-based application
feature where this data could be captured electronically. However, SBA
did not attempt to add this functionality after the Gulf Coast
hurricanes because of the instability it initially experienced with
DCMS. SBA officials added that the agency concentrated its efforts on
expanding the capacity of DCMS and would examine adding this
functionality to the system in the future.
SBA officials told us that, prior to the Gulf Coast hurricanes, the
agency initiated a business process reengineering effort within ODA to
reevaluate the disaster loan process. As part of this effort, ODA
planned to (1) determine what type financial analysis would be
performed for applicants with credit scores indicating a high degree of
default risk, (2) design a streamlined loan application (both paper and
electronic), and (3) identify policy and legislative changes required
to implement the new process. However, ODA postponed this effort after
the Gulf Coast hurricanes because of the resources needed to meet the
demands of the disaster loan program. Business process reengineering
can help organizations identify, analyze, and redesign their core
business processes with the aim of achieving dramatic improvements in
critical performance measures such as cost, quality, service, and
speed. According to SBA officials, it has plans to resume this effort
in 2006 in order to identify ways to more efficiently process disaster
loan applications and to maximize the benefits of DCMS.
Conclusions:
The Gulf Coast hurricanes presented SBA with unprecedented challenges
that, in combination, led to significant backlogs and delays in
processing disaster loan applications. For example, SBA faced the
largest volume of disaster loan applications in its history, as the
United States experienced three extremely destructive natural disasters
over a period of about 2 months. This large volume was due in part to
the large number of applicants automatically referred to SBA by FEMA's
Internet site, many of whom ultimately did not qualify for disaster
loans. We also agree that SBA should improve its screening process
within DCMS when processing "$0 income" referrals and continue to work
with FEMA to reduce unnecessary online disaster referrals, as
recommended by SBA's Office of Inspector General. In addition, various
system and processing-related issues also challenged SBA, such as a new
disaster loan system that was not designed to effectively respond to a
disaster of this magnitude and that was unable to operate at the
planned maximum capacity. Moreover, SBA based the maximum number of
concurrent users for DCMS solely on its historical experience rather
than considering information available from catastrophe risk modeling
firms and disaster simulations, such as the likelihood and severity of
damages from potential catastrophes to help predict the volume of
applications that it might expect from such events. While SBA has plans
to greatly expand its capacity of concurrent users for DCMS and should
be more capable of processing larger volumes of loan applications once
it achieves this increased capacity, it is not clear how the agency
determined the new maximum number of concurrent users and whether this
new capacity will be appropriate to handle future large scale disasters
like the Gulf Coast hurricanes. If SBA had considered information
available from catastrophe risk modeling firms and disaster simulations
to help predict the volume of loan applications it could expect to
receive, SBA could have made better informed decisions and might have
acquired additional capacity that could have enabled SBA to reduce the
backlog of applications in a more timely manner. Such an analysis would
also better position SBA to determine its loan processing capacity for
future disasters. SBA's limited planning was further exacerbated by the
lack of complete stress testing and the ineffective technical support
provided by the hosting contractor. If SBA had appropriately stress
tested the system before implementation, it might have discovered
before the Gulf Coast hurricanes struck that it had received the
incorrect computer hardware. Going forward, SBA would benefit from
improving its process for verifying that the equipment provided by
contractors meets all required specifications.
While some of SBA's initiatives improved its response to disaster
victims, other efforts did not help the agency significantly reduce the
large backlog of applications because they were either not implemented
in a timely manner, not attractive to the applicant, or did not fully
incorporate the use of DCMS to process applications. If some of these
initiatives had been implemented soon after the Gulf Coast hurricanes
struck, they might have enhanced SBA's ability to process a large
volume of loan applications in a timely manner. In addition, DCMS has
the capability to interface with an Internet-based application feature
that could reduce the resources and time required to input application
data for home loan applicants by capturing much of this information
electronically. As the 2006 Atlantic hurricane season has already
begun, SBA would benefit by expediting its plans to resume its business
processing reengineering efforts to analyze ways to more efficiently
process loan applications, including an evaluation of implementing an
Internet-based application feature.
Recommendations for Executive Action:
In order to provide more timely disaster assistance in the future, we
recommend that the Administrator of SBA direct the Office of Disaster
Assistance to take the following four actions:
* reassess DCMS's maximum user capacity and related loan processing
resource needs based on such things as lessons learned from the Gulf
Coast hurricanes, a review of information available from catastrophe
risk modeling firms and disaster simulations, and related cost
considerations;
* conduct complete stress testing to ensure that DCMS can function at
planned for maximum user capacity levels;
* improve management controls over assessing contractor performance
through inspections of all equipment purchased or leased to support
DCMS; and:
* expedite plans to resume business process reengineering efforts to
analyze the disaster loan process and identify ways to more efficiently
process loan applications including an evaluation of the feasibility of
implementing a secure Internet-based application feature for home loan
applicants.
Agency Comments and Our Evaluation:
We provided SBA with a draft of this report for review and comment. The
Associate Administrator for Disaster Assistance provided written
comments that are presented in appendix III. In these comments, SBA
provided additional context regarding the magnitude of the disasters
and the impact on the Disaster Loan Program. SBA stated that it
generally agreed with our recommendations and intended to improve the
delivery of the Disaster Loan Program for events of all sizes. However,
SBA disagreed with the following four findings and conclusions in our
draft.
First, SBA disagreed with our conclusions that it performed limited
planning and that it would have been better prepared to reduce the
backlog of applications through the use of catastrophe risk models
rather than relying primarily on the Northridge earthquake to establish
its capacity needs. As we noted in our report, SBA planned the maximum
user capacity for DCMS based on the volume of applications it received
from victims of the Northridge earthquake--the single largest disaster
SBA had previously faced--and did not anticipate the likelihood of a
single disaster or series of disasters of the magnitude of the Gulf
Coast hurricanes. We continue to believe that catastrophe risk modeling
firms and disaster simulations provide critical information, such as
the likelihood and severity of damages from potential catastrophes.
Combined with other elements of a comprehensive planning process, such
information would have been useful in planning the maximum user
capacity of DCMS. If SBA had considered this information, the agency
may have concluded that the likelihood of large scale disasters
exceeding the magnitude of the Northridge earthquake was significant
enough to expand its maximum concurrent user requirement. This
additional capacity would have better prepared SBA to reduce the
backlog of loan applications more rapidly because additional staff in
all phases of the loan application process would have been able to
access DCMS.
Second, SBA stated in its comments that our draft report does not
include an analysis of the difference between using DCMS and ALCS--
SBA's previous system. SBA also highlighted in its comment letter many
of the benefits offered by DCMS. While it was not in the scope of our
work to conduct a comparative analysis of ALCS and DCMS, our report
recognized some of the benefits realized by adopting DCMS. For example,
we noted that ALCS tracked the movement of paper loan application files
from one stage of the loan process to another and required the movement
and storage of large volumes of paper. We also noted that DCMS helped
SBA move toward a paperless processing environment by automating many
of the functions staff members had performed manually using ALCS such
as obtaining FEMA referral data and credit bureau reports, as well as
completing and submitting loss verification reports from remote
locations.
Third, SBA stated that the draft report does not indicate that the
specific computer components, which the hosting contractor incorrectly
provided, were processing chips that were embedded subcomponents of the
computer servers, which SBA personnel could only detect by opening and
dismantling the computer hardware. We agree that the hardware was
embedded in the computer servers and could have been verified by
physical inspection. SBA conducted such an inspection in September
2005. However, alternative ways of verifying the computer hardware were
possible. For example, SBA staff could have used its system utilities
to view details of the hardware and operating system after the
processors were installed and may have detected the incorrect
processors and taken corrective actions in a more timely manner.
Finally, SBA took issue with our finding that it actually took longer
to process expedited approvals under a pilot program, compared with its
average processing time frames for all approvals. SBA stated that our
interpretation of the data was misleading because it did not adjust for
the length of time an application was in the loss verification
inventory before being assigned to the loan department for processing.
We disagree that our interpretation of the data was misleading because
all physical disaster loan applications had to go through loss
verification before a decision was made, regardless of whether the
application was part of the expedited pilot program. While the
expedited approval pilot program may have reduced the amount of time
for loan officers to complete the underwriting decision, our intent,
consistent with our overall objective, was to show the total time
disaster victims waited for SBA to make a decision on their
application. This includes the time an application is in other stages
of the disaster loan process, such as application entry and loss
verification. As we noted in our report, SBA implemented the pilot
program when the agency faced a significant backlog of 115,000
applications in the loss verification stage, and these applications had
been in the queue for 39 days on average. SBA's data showed that the
agency actually took longer to process expedited approvals, about 104
days on average, compared with 94 days on average for all approvals. We
continue to believe that it is appropriate to consider the total
processing time frames when comparing applications approved under the
pilot program with all approved applications.
SBA also provided other technical corrections and comments, which have
been incorporated in this report, where appropriate.
We are sending copies of this report to appropriate congressional
committees, the Administrator of the Small Business Administration, and
other interested parties and will make copies available to others upon
request. In addition, the report will be available at no charge on the
GAO Web site at [Hyperlink, http://www.gao.gov.]
If you or your staff have any questions regarding this report, please
contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. GAO staff who made major contributions to
this report are listed in appendix IV.
Signed by:
William B. Shear:
Director, Financial Markets and Community Investment:
List of Addressees:
The Honorable William Thad Cochran:
Chair:
Committee on Appropriations:
United States Senate:
The Honorable Susan M. Collins:
Chair:
The Honorable Joseph I. Lieberman:
Ranking Minority Member:
Committee on Homeland Security and Governmental Affairs:
United States Senate:
The Honorable Olympia J. Snowe:
Chair:
The Honorable John F. Kerry:
Ranking Minority Member:
Committee on Small Business and Entrepreneurship:
United States Senate:
The Honorable Richard C. Shelby:
Chair:
The Honorable Barbara A. Mikulski:
Ranking Minority Member:
Subcommittee on Commerce, Justice, and Science:
Committee on Appropriations:
Unites States Senate:
The Honorable Tom Davis:
Chair:
The Honorable Henry A. Waxman:
Ranking Minority Member:
Committee on Government Reform:
House of Representatives:
The Honorable Donald Manzullo:
Chair:
The Honorable Nydia M. Velazquez:
Ranking Minority Member:
Committee on Small Business:
House of Representatives:
The Honorable Frank R. Wolf:
Chair:
The Honorable Alan B. Mollohan:
Ranking Minority Member:
Subcommittee on Science, State, Justice, Commerce, and Related
Agencies:
Committee on Appropriations:
House of Representatives:
The Honorable Dianne Feinstein:
United States Senate:
The Honorable Mary L. Landrieu:
United States Senate:
[End of section]
Appendix I: Scope and Methodology:
In this report, we evaluate: (1) what affected the Small Business
Administration's (SBA) ability to provide timely disaster assistance
and (2) the actions SBA took after the disasters to improve its
response to disaster victims. This report focuses primarily on the
Disaster Credit Management System (DCMS) and the disaster loan process.
We visited the Gulf Coast region to observe conditions and meet with
federal, state, and local officials and victims of the disasters. We
also interviewed officials from the Office of Disaster Assistance at
SBA's headquarters and officials from the Processing and Disbursement
Center in Texas, Field Operations Centers East and West in Georgia and
California, Customer Service Center in New York, DCMS Operations Center
in Virginia, and Georgia District Office. We reviewed SBA's standard
operating procedures for approving, declining, and withdrawing disaster
loans. In addition, we reviewed documents related to the agency's
response to the Gulf Coast hurricanes, congressional testimony, and
other program documentation.
We reviewed documents related to SBA's acquisition and implementation
of DCMS. In addition, we discussed the acquisition process with
officials from SBA's DCMS Operations Center, which provides technical
and program management support for the system. We also reviewed SBA's
standards for system development and compared the acquisition process
for DCMS with industry standards for effective information technology
acquisition. Further, we interviewed officials from SBA's Office of
Inspector General and reviewed their reports related to the
implementation of DCMS and SBA's Disaster Loan Program. We did not
conduct a comparative analysis of DCMS and ALCS--SBA's previous system-
-as part of our work. To obtain the perspectives of system users, we
interviewed loan processing staff at various SBA locations. We also
obtained SBA's total costs for planning, acquiring, and implementing
DCMS through April 2006. However, we did not audit the reported costs
and thus cannot attest to their accuracy or completeness.
We obtained documents related to the performance of DCMS, including
system status reports, troubleshooting reports, and system change
requests. We reviewed these documents to assess the extent to which
system-related problems detailed in the documents affected SBA's
ability to provide timely disaster assistance. In addition, we obtained
various reports on SBA's disaster lending activity for victims of
Hurricanes Katrina, Rita, and Wilma. We used these reports to calculate
descriptive statistics on the number of applications mailed and
received, the number and amount of approved loans, the backlog of
applications in various stages, and other characteristics for
applications processed through May 27, 2006. For comparative purposes,
we also obtained summary statistical reports related to SBA's disaster
lending for past significant disasters. We also obtained data extracts
from DCMS of disaster loan applications SBA received from victims of
Hurricanes Katrina, Rita, and Wilma for various dates. We used the
extracts to calculate average time frames for various stages of the
disaster loan process.
In assessing the reliability of SBA's data, we reviewed documents such
as the DCMS Privacy Act Assessment and met with appropriate SBA
officials. To increase our confidence in the reliability of SBA's data,
we compared information from selected hard copy application files with
the information recorded in DCMS. We also performed various tests of
the information in the data extracts we obtained to ensure the
completeness of the data. We concluded that SBA's data were
sufficiently reliable for the purposes of our report.
To evaluate actions SBA took after the disasters to improve its
response to disaster victims, we reviewed documents related to changes
SBA made to DCMS and changes SBA planned to make to the system. We
discussed these changes with officials from SBA's DCMS Operations
Center. In addition, we obtained and reviewed documents related to
changes SBA made to the disaster loan process and other initiatives
intended to improve SBA's response to disaster victims. We discussed
these changes and initiatives with the appropriate SBA officials and
obtained data on the impact of these efforts where available.
We reviewed documents related to the Federal Emergency Management
Agency's (FEMA) Individuals and Households Program, which makes
assistance available to victims of major disasters. We also contacted
FEMA to obtain additional information regarding the agency's process
for referring applicants to SBA's Disaster Loan Program.
We performed our work in Atlanta, Ga; Buffalo, N.Y; Fort Worth, Tex;
New Orleans and Metarie, La; Sacramento, Calif; Bay St. Louis, Biloxi,
Gulfport, and Waveland, Miss; Herndon, Va; and Washington, D.C. We
conducted our work between November 2005 and July 2006 in accordance
with generally accepted government auditing standards.
[End of section]
Appendix II: SBA's Acquisition and Implementation of the Disaster
Credit Management System:
Since the early 1990s, SBA utilized its Automated Loan Control System
to track the movement of paper application files from each stage of the
process until it made a decision on the application, disbursed funds
for approved applications, and transferred the application file to
servicing. SBA also obtained data manually from external data sources,
including FEMA, the Internal Revenue Service (IRS), and the credit
reporting agencies. In December 1998, after using a significant number
of resources in response to victims of Hurricane Georges, which struck
Puerto Rico that previous September, SBA began an effort to modernize
its manual and paper-based disaster loan process.
SBA intended for its new disaster loan system to support: (1) a
"paperless" electronic loan application and loan process, (2) loan
processing from any location where the system is implemented, (3)
multiple interaction methods between loan applicants and the Office of
Disaster Assistance (e.g., by Internet or telephone), and (4) access to
external data sources. The modernization effort entailed the following
actions:
* documenting SBA's current loan process and proposed future loan
process;
* performing requirements analysis, conducting a commercial-off-the-
shelf (COTS) market survey, and developing a business case;
and:
* acquiring, customizing, and implementing the system.
In March 1999, SBA completed a business process reengineering study to
document the current process and proposed future process. In August
2000, SBA completed the initial development of the new system
requirements. Subsequently, SBA contracted for a COTS survey of
products meeting its requirements and leveraging its other information
technology resources. The survey identified two products that met a
significant number of SBA's requirements, with some customization and
integration of additional products needed to meet all requirements.
After the contractor completed the survey, SBA's information technology
investment review board required the agency to complete a business case
analysis for the proposed disaster loan system. SBA's analysis involved
researching the existing requirements, evaluating potential
alternatives, and providing a recommendation. In March 2001, SBA
completed the analysis, which evaluated three alternatives: (1) develop
a custom solution, (2) acquire a COTS product, or (3) stay with the
current environment. SBA determined that the COTS product represented
the best solution after considering the costs and time frames
associated with each alternative.
In June 2002, a SBA contractor developed more specific requirements for
the project because a considerable amount of time had passed since the
first survey and because of the uniqueness of certain aspects of the
disaster loan process, such as loss verification and a check for
duplication of benefits. Later that year, SBA contracted for a separate
COTS survey that utilized the Carnegie Mellon University's Software
Engineering Institute process for evaluating COTS products.[Footnote
26] SBA evaluated products from 10 different vendors, and after
narrowing the selection to two products, received vendor demonstrations
in January 2003. In March 2003, the contractor recommended a COTS
product for SBA to use as the foundation for the Disaster Credit
Management System (DCMS).
In September 2003, SBA completed an analysis of the DCMS design to
identify potential gaps between the recommended COTS product and the
requirements for the system. For example, SBA recognized that the COTS
product did not have the functionality to perform loss verification
activities; therefore, SBA decided to implement a custom loss
verification application and link the application to the core system.
This ensured that loss verification data would automatically
synchronize with DCMS.
In 2003, SBA also began to test various aspects of its new system. In
November 2003, the agency began testing the core application,
interfaces, and additional components (loss verification, scanning,
etc.) User validation readiness testing was conducted between December
2003 and March 2004. In October 2004, SBA contracted for an Independent
Verification and Validation (IV&V) of an initial release of DCMS. An
IV&V can help provide reasonable assurance that a system satisfies its
intended use and user needs, and its use is recognized as an industry
best practice. The IV&V conducted for DCMS found that the system was
supported by strong requirements, test plans, test cases, and other
supporting documentation. In addition, the IV&V found that DCMS was
developed with a high level of user involvement. However, the IV&V did
not evaluate performance testing, including tests to help ensure that
the system could function at its maximum user capacity, because these
tests were not completed until December 2004 after the agency had begun
implementation. This performance testing was conducted with only up to
120 concurrent users due to problems with the hardware associated with
the testing environment. If the testing environment had functioned as
planned, it was estimated the system could accommodate approximately
600 concurrent users.
SBA used a phased approach for implementing DCMS. In November 2004, SBA
first implemented DCMS in its Niagara Falls, New York, Disaster Area
Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas,
and Sacramento, California DAO. SBA also began using DCMS to process
applications for all new disaster declarations. As figure 6
illustrates, SBA's process of moving from its former manual, paper-
based disaster loan process to a more automated process using DCMS took
about 6 years. SBA's costs for planning, acquiring, implementing, and
operating DCMS totaled about $32 million through April 2006.
Figure 6: Time Line of DCMS Activities:
[See PDF for image]
Source: GAO.
[End of figure]
[End of section]
Appendix III: Comments from the Small Business Administration:
U.S. Small Business Administration:
Washington, D.C. 20416:
July 17, 2006:
William B. Shear:
Director:
Financial Markets and Community Investment:
United States Government Accountability Office:
441 G Street N.W.
Washington, DC 20545:
Dear Mr. Shear:
We appreciate the opportunity to provide comments on the U.S. Small
Business Administration's (SBA) response to the catastrophic Hurricanes
Katrina, Rita and Wilma in 2005 as articulated in the Government
Accountability Office's (GAO) draft report entitled Small Business
Administration, Actions Needed to Provide More Timely Disaster
Assistance.
In reviewing SBA's performance to this unprecedented series of events
we think it is helpful to fully appreciate the context of these
hurricanes as well as the long-term recovery efforts of the Agency. In
the summer and fall of 2005, Hurricanes Katrina, Rita and Wilma
destroyed significant portions of Louisiana, Mississippi, Alabama,
Florida and Texas. These hurricanes wrecked devastation on home and
business owners and collectively represent the worst natural disaster
in American history. The declared disaster area was approximately
90,000 square miles, covering an area equivalent to that of Great
Britain. The after-effects of the hurricanes, including the devastation
of critical infrastructure, damage to roads and bridges, loss of basic
utilities (i.e., electrical, gas, water), hampered communications, and
the inability to access parts of the disaster area in order to perform
damage inspections also adversely affected the speed at which SBA was
able to deliver its Disaster Loan Program.
The magnitude of these disasters caused over 420,000 home and business
owners to apply for SBA assistance. To date, SBA has approved over
154,000 disaster loans for over $10.2 billion to victims of these
horrific storms. Put into context 20 percent of all the disaster loan
dollars approved in the 53-year history of SBA occurred this past
disaster season. The Gulf Coast hurricanes represent the largest
collection of disasters the Agency has ever faced, vastly surpassing
our previous largest disaster, the Northridge earthquake in 1994, where
we received approximately 250,000 applications and approved over $4
billion in disaster loans.
To build from the lessons learned from 2005, and in preparation for the
2006 Hurricane season. SBA convened an Agency-wide Disaster Oversight
Council comprised of Agency leadership as well as other key senior
personnel. The purpose of-the Disaster Oversight Council was to better
leverage the resources of the Agency as a whole, and incorporate new
ideas and best practices from SBA program areas into our disaster
preparedness capability. To pre-position the Agency, SBA has completed
a series of process improvements and reengineering initiatives to
improve service delivery, which include the following:
* Upgraded System Capacity. Today the Disaster Credit Management System
(DCMS) has been tested and verified to support a minimum of 8,000
concurrent users. This represents a four-fold increase in capacity over
peak usage during the 2005 Gulf Coast hurricanes.
* Enhanced Disaster Workforce. SBA's Disaster Assistance capability
expands and contracts in size based on level of disaster activity.
Prior to Hurricane Katrina making landfall, SBA had about 800 employees
on the payroll but quickly surged to over 4,300 employees in response
to these unprecedented storms. Today, SBA's Disaster Loan Program has
roughly 3,500 employees across all key functions. Additionally, SBA has
selected over 1,000 employees in the expansion of the Disaster reserve
corps. The number of trained employees on board and in the reserve core
increases the Agency's capacity to quickly respond to catastrophic
events in 2006 if required.
* Partnered with Private Sector. As a result of the unprecedented
application volume received. SBA created the Disaster Loan Partners
Initiative and selected three private sector contracts to assist with
SBA's loan processing and loan closing activities. This unique
partnership with the private sector provides the Agency with additional
experienced personnel to enhance program delivery to disaster victims.
* Leveraged SBA's Nationwide Infrastructure. During the 2005 Hurricane
season, the Agency utilized SBA's nationwide District Office
infrastructure to handle increased disaster activity.
* Expanded Agency Footprint. The Agency has secured over 400,000 sq.
ft. of space for the current disaster season in multiple locations
across the country. SBA estimates that this should be sufficient to
accommodate infrastructure needs for the 2006 Hurricane season.
However, maintaining this high level of overhead is costly given the
variable nature of disasters. SBA has a fiscal responsibility to the
taxpayers and must evaluate if the resources required to maintain this
space on a continual basis are realistic, cost-effective, or if other
alternatives exist.
* Bolstered Forecasting Ability and Risk Monitoring Procedures. The
Agency has enhanced its capability to immediately forecast application
volumes when disasters strike. This new model - which includes a
flexible tool for forecasting purposes - provides a more robust
methodology for predicting application volume based on assets at risk
and disaster characteristics.
* Developed Disaster Scalability Preparedness Tool. The Agency now
possesses the capability to determine resource needs - financial, human
capital (by function), and logistics - required to maximize SBA's
response against a number of different application volume scenarios.
Action plans that support the requirements outlined in each scenario
continue to be refined.
* Enhanced Communications. The SBA is focused on a two pronged
communications strategy for the current disaster season-emphasizing the
need for disaster preparedness, and outreach to the public and the
media about available resources once a disaster is declared-:
In reviewing the draft report, it seems to place an unreasonable and
unwarranted emphasis on some key points. More specifically, we disagree
with the auditors' conclusions SBA performed limited planning,
resulting in insufficient DCMS user capacity, and that through the use
of catastrophe risk models we would have been better prepared to reduce
the backlog of applications. Additionally, the draft report focuses on
the challenges SBA faced during the response to the 2005 Hurricanes
without recognizing the improved capability afforded by implementation
of our recently released new technological platform.
The draft report indicates that SBA should have used results of data
from catastrophe risk modeling to plan for the appropriate level of
DCMS maximum users. Further the draft report indicates that SBA should
use catastrophic modeling to predict the capacity needed to process the
volume of activity as a result of such events. However, the report
provides little guidance on how SBA could use such modeling to
determine the system requirements. Additionally, the report fails to
reflect that SBA did design the DCMS to handle the largest disaster it
had ever faced, the Northridge earthquake, which had produced
application volume far greater than SBA's usual demand, SBA's only
failure was to be unable to anticipate a disaster that doubled that
extraordinary demand SBA strongly suggests that report reflect this set
of facts.
The draft report also fails to offer an analysis of the difference
between using the DCMS system and using SBA's prior, antiquated
Automated Loan Control System (ALCS) in response to such to such
catastrophic events. Such a comparison would have revealed that SBA was
able to handle a disaster twice the size of the Northridge earthquake
in the same amount of time or less. As a result, the report only
responds to the potential adverse impact of DCMS related issues to the
response, and not to the positive contributions offered by the new
technology. While it is difficult to perform a comparative analysis to
quantify the benefits of the new technology, there are opportunities
throughout the report to demonstrate a better balance between the
benefits of the new system and the problems with the old.
We suggest that GAO include the immediate improvements of DCMS response
times to ODA's loan making function in the report, such as:
* Electronic case files versus paper case files:
* Automated workflow within DCMS eliminates hundreds of staff who
performed file control processes:
* Automated credit report pull for every application eliminates manual
process.
* Loss verification assignments are sent and completed inspections
returned through data sync via secure internet connection eliminating
file shipping costs and time associated with loss verifier deployment.
* Loss verification process automated with pre-defined data and
formulas to eliminate manual steps.
* Scanning component integrates into the electronic data file to
provide access to multiple users without need to physically transport
paper records.
* Implemented automated loan closing checklist eliminates manual
creation of document for each case.
* New interface with the Federal Emergency Management Agency (FEMA) for
automated Duplication of Benefits retrieval eliminates manual access
and printing of multiple pages of data.
* New interface with SBA loan accounting system for automated queries
on previous loan history of loan applicants eliminates manual search
and printing of records.
* New interface to update SBA co-borrower and guarantor data eliminates
manual data entry.
* Implemented certain achievable process improvements such as
reengineered application screening process, pre-processing decline and
referral process, auto-decline process, expedited approval process, and
other policy changes relative to system enabled improvements.
The draft report states that SBA did not verify whether the hosting
contractor provided the correct computer equipment in contradiction to
Federal procurement policies. It is true that SBA acquired leased
equipment which did not contain all of the correct components. However,
the report fails to point out that the specific components that were
not correctly provided were the processing chips, embedded
subcomponents of the servers that could not be detected unless SBA
personnel had actually opened and dismantled the servers.
We also believe that the findings in the draft report are misleading
regarding SBA's pilot of "expedited approvals." We believe that GAO's
interpretation of the data is misleading because it does not adjust for
the length of time a file was in loss verification inventory before
being assigned to the loan department for processing. The conclusion
that applications took longer to process under the expedited rules is
not an accurate representation due to the fact that these applications
were in loss verification and an inspection of the disaster-damaged
property had to be scheduled and completed before performing the
financial analysis in loan processing. Once the damage inspection was
completed, the amount of time to complete the underwriting decision was
substantially decreased, thus resulting in a shorter wait for a loan
decision. We believe a more accurate comparison would have been the
amount of time it took to process "expedited loan approvals" versus
applications that were processed in the normal manner from the date the
application was assigned to the loan department to the date of loan
decision. Inclusion of the days an application was in departments such
as loss verification prior to loan processing does not accurately
reflect the positive impact of the pilot program to notify applicants
of approval decisions faster.
We note that the comments in the recommendations section in the draft
report suggest several ways to better improve our program performance.
We generally agree with the recommendations and intend to improve the
delivery of our program for events of all sizes. Our response to the
recommendations is as follows:
Recommendation 1, Reassess DCMS maximum user capacity. SBA agrees with
the need to reassess the DCMS maximum user capacity and related
processing resource needs. To a large extent, this process began during
the response to the 2005 hurricanes and achievement of an immediate
step has recently been completed through the implementation of the
upgraded DCMS hardware which will support in excess 48,000 concurrent
users. The new hardware was put into production use an June 12, 2006,
Further efforts to enhance productivity and overall system capacity are
on-going. The utilization of catastrophe risk models and disaster
simulations is being considered as part of the disaster planning
process, and to the extent these processes are useful, SBA will
incorporate best practices.
Recommendation 2, Improve management controls over assessing contractor
performance. SBA has management controls in place to assess contractor
performance through daily, weekly, and monthly reviews of the technical
and operational requirements. These repeatable processes were put in
place during the 2005 disaster response and have been maintained ever
since. In addition, the DCMS hardware upgrade project was completed
with a comprehensive and thorough detailed inspection of all equipment
acquired to support DCMS. Even with these controls in place, the Agency
will look for additional ways we can improve DCMS contractor oversight.
Recommendation 3, Conduct complete stress testing on DCMS. The new DCMS
hardware has undergone significant performance testing prior to release
to production. The capabilities of the new system are substantially
improved beyond the previous production environment. SBA will continue
to enhance the DCMS software and hardware components to further
optimize performance and capabilities, and will perform additional
stress testing; as necessary, to assess the impact of these changes to
the new baseline.
Recommendation 4, Expedite plans to resume business process
reengineering. SBA intends to resume its efforts to reengineer its
business processes in the disaster program, including revised process
flows for applications and to provide a secure internet-based
application feature for home and business disaster loan applicants.
We appreciate the opportunity to provide clarifying comments and have
included our specific requests for clarifications and/or changes within
the attachment herein.
Sincerely,
Signed by:
Herbert L. Mitchell:
Associate Administrator for Disaster Assistance:
[End of section]
Appendix IV: GAO Contact and Staff Acknowledgments:
GAO Contact:
William B. Shear, (202) 512-8678, s [Hyperlink, shearw@gao.gov]
hearw@gao.gov:
Staff Acknowledgments:
In addition to the individual named above, Daniel Blair, Assistant
Director; Barbara Oliver, Assistant Director; Bernice Benta; Tania
Calhoun; Marshall Hamlett; Marc Molino; David Pittman; Jennifer
Popovic; Rhonda Rose; and Eric Trout made key contributions to this
report.
(250263):
FOOTNOTES
[1] Preliminary estimates as reported by the National Oceanic and
Atmospheric Administration.
[2] In this report, we refer to Katrina, Rita, and Wilma collectively
as the Gulf Coast hurricanes.
[3] The objectives of this subsequent review are to determine (1) the
extent to which SBA has a comprehensive disaster response plan and, if
so, how it affected the agency's ability to provide timely assistance
to Gulf Coast hurricane victims; (2) how work force transformation
affected SBA's ability to respond to victims; (3) how SBA's efforts to
modify its regulatory and programmatic authority compared with previous
major disasters; and (4) what outreach strategy SBA used to inform
victims about the disaster loan program.
[4] SBA's hosting contractor provides services such as monitoring the
DCMS network and providing support for leased computer hardware.
[5] Stress testing refers to measuring a system's performance and
availability in times of particularly heavy or peak load.
[6] In this report, we refer to 21 days as the goal because SBA tells
disaster victims that it will try to make a decision on each completed
application within this time frame. According to SBA, the agency's
Government Performance and Results Act goal for fiscal year 2006 is to
process 85 percent of home loan applications within 14 days and 85
percent of business applications within 16 days.
[7] FEMA also refers to the IHP program as Individual Assistance (IA).
[8] SBA provides the income thresholds to FEMA, which vary based on the
applicant's household size and are adjusted annually for inflation. For
example, SBA's minimum income threshold for fiscal year 2005 was
$13,965 for a household size of one;
the threshold increased to $14,355 for fiscal year 2006. If the
applicant's household income falls below the income thresholds, FEMA
will automatically refer them to its Other Needs Assistance Program.
This program provides financial assistance to individuals and
households who have other disaster-related necessary expenses or
serious needs, such as medical expenses.
[9] According to SBA's procedures, an acceptable application is one
that has a signed and reasonably completed application form and a fully
completed and signed Tax Information Authorization (Internal Revenue
Service Form 8821) for each required taxpayer or entity. SBA returns
unacceptable applications and requests the information needed to make
the application acceptable.
[10] SBA does not conduct the preliminary financial analysis for home
loan applicants indicating that they (1) are the sole proprietor of a
business; (2) have household income which includes rents, farms, or
other nonsalary sources (not including disability, social security
pension, etc.); or (3) have household income in excess of $50,000.
According to SBA officials, the preliminary financial analysis is not a
valid measure of repayment ability for these individuals because their
financial circumstances are more complex or their income may be able to
support a higher debt level. In these cases, SBA officials stated that
a more thorough financial analysis is warranted, and these applications
go through the normal process.
[11] FEMA does not provide assistance to cover business-related losses.
[12] Economic injury loan applications move directly to the application
processing stage after application entry.
[13] SBA is required to determine whether applicants are able to obtain
financial assistance at reasonable rates and terms from nongovernment
sources prior to assigning an interest rate. A higher interest rate
applies for physical disaster loan applicants determined to have credit
elsewhere, and business physical disaster loan applicants are subject
to a maximum 3-year term for repayment. Economic injury disaster loan
applicants are not eligible for disaster loans if SBA determines they
can obtain credit elsewhere. For the Gulf Coast hurricanes, disaster
victims unable to obtain credit elsewhere were assessed an interest
rate of 2.687 percent for home loans and 4 percent for business loans
and nonprofit organizations. Disaster victims that could obtain credit
elsewhere were assessed an interest rate of 5.375 percent for home
loans, 6.557 percent for business loans, and 4.75 percent for nonprofit
organizations.
[14] According to SBA procedures, legal review staff members generally
do not review draft loan authorization and agreements for unsecured
loans.
[15] For victims of the Gulf Coast hurricanes, SBA increased to
$50,000, the maximum initial disbursement for physical disaster loans
with collateral.
[16] SBA reorganized its Office of Disaster Assistance in 2005 as part
of its workforce transformation initiative. SBA centralized all loan
processing functions for account application and account processing at
its former Ft. Worth (Texas) DAO, which became its PDC. SBA
consolidated field operations, verification, congressional, and public
information office functions at its former Atlanta (Georgia) DAO and
Sacramento (California) DAO, which became its Field Operations Centers
East and West. SBA centralized all victim-related support functions at
its former Niagara Falls DAO, which became its Buffalo (New York)
Customer Service Center.
[17] SBA Office of Inspector General, "Disaster Application Referrals
with $0 Income from FEMA Online Registration Have Increased Costs and
the Demand for SBA Resources," Advisory Memorandum 06-12 (Feb. 17,
2006).
[18] Risk Management Solutions, "The 1906 San Francisco Earthquake and
Fire: Perspectives on a Modern Super Cat" (2006).
[19] AIR Worldwide Corporation, "Insuring and Mitigating the Risk of
Large-Scale Natural Disasters" (2006).
[20] Office of Management and Budget, "Management Oversight of Service
Contracting," Policy Letter No. 93-1 (May 18, 1994).
[21] For more information, see GAO, Aviation Security: Secure Flight
Development and Testing Under Way, but Risks Should Be Managed as
System Is Further Developed, GAO-05-356 (Washington, D.C.: Mar. 28,
2005).
[22] SBA had planned to phase out loan processing operations at this
office by the end of October 2005, as it became the Field Operations
Center West under SBA's transformation initiative.
[23] SBA also used the Sacramento satellite office to process about
10,700 home loan applications for smaller disaster declarations.
[24] Applications for Hurricanes Katrina and Rita only.
[25] The Joint Financial Management Improvement Program is a joint and
cooperative initiative to improve financial management practices in the
government and was authorized under the Budget and Accounting
Procedures Act of 1950. The program promotes strategies and guides
financial management improvement across government; reviews and
coordinates central agencies' activities and policy promulgations; and
acts as a catalyst and clearinghouse for sharing and disseminating
information. See JFMIP Direct Loan System Requirement: June 1999.
[26] The Software Engineering Institute has identified specific
processes and practices that have proven successful in fostering
quality software development. The processes and practices identified
focus on software development and acquisition activities. The institute
has constructed models for developing and acquiring software,
developing and implementing software process improvement programs, and
integrating hardware and software. The institute created the models to
provide general guidance for software development and acquisition
activities that programs can tailor to meet their needs (See GAO,
Defense Acquisitions: Stronger Management Practices Are Needed to
Improve DOD's Software-Intensive Weapon Acquisitions, GAO-04-393
(Washington, D.C.: Mar. 1, 2004).
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds;
evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
