[House Hearing, 106 Congress] [From the U.S. Government Publishing Office] HEARING ON SBA COMPUTERIZED LOAN MONITORING SYSTEM: A PROGRESS REPORT ======================================================================= HEARING before the SUBCOMMITTEE ON GOVERNMENT PROGRAMS AND OVERSIGHT of the COMMITTEE ON SMALL BUSINESS HOUSE OF REPRESENTATIVES ONE HUNDRED SIXTH CONGRESS SECOND SESSION __________ WASHINGTON, DC, FEBRUARY 29, 2000 __________ Serial No. 106-44 __________ Printed for the use of the Committee on Small Business U.S. GOVERNMENT PRINTING OFFICE 65-506 WASHINGTON : 2000 COMMITTEE ON SMALL BUSINESS JAMES M. TALENT, Missouri, Chairman LARRY COMBEST, Texas NYDIA M. VELAZQUEZ, New York JOEL HEFLEY, Colorado JUANITA MILLENDER-McDONALD, DONALD A. MANZULLO, Illinois California ROSCOE G. BARTLETT, Maryland DANNY K. DAVIS, Illinois FRANK A. LoBIONDO, New Jersey CAROLYN McCARTHY, New York SUE W. KELLY, New York BILL PASCRELL, New Jersey STEVEN J. CHABOT, Ohio RUBEN HINOJOSA, Texas PHIL ENGLISH, Pennsylvania DONNA M. CHRISTIAN-CHRISTENSEN, DAVID M. McINTOSH, Indiana Virgin Islands RICK HILL, Montana ROBERT A. BRADY, Pennsylvania JOSEPH R. PITTS, Pennsylvania TOM UDALL, New Mexico JOHN E. SWEENEY, New York DENNIS MOORE, Kansas PATRICK J. TOOMEY, Pennsylvania STEPHANIE TUBBS JONES, Ohio JIM DeMINT, South Carolina CHARLES A. GONZALEZ, Texas EDWARD PEASE, Indiana DAVID D. PHELPS, Illinois JOHN THUNE, South Dakota GRACE F. NAPOLITANO, California MARY BONO, California BRIAN BAIRD, Washington MARK UDALL, Colorado SHELLEY BERKLEY, Nevada Harry Katrichis, Chief Counsel Michael Day, Minority Staff Director ------ Subcommittee on Government Programs and Oversight ROSCOE G. BARTLETT, Maryland, Chairman MARY BONO, California DANNY K. DAVIS, Illinois PATRICK J. TOOMEY, Pennsylvania RUBEN HINOJOSA, Texas RICK HILL, Montana CHARLES A. GONZALEZ, Texas Nelson Crowther, Counsel C O N T E N T S ---------- Page Hearing held on February 29, 2000................................ 1 Witnesses Hochberg, Fred P., Deputy Administrator, U.S. Small Business Administration................................................. 3 Wilkinson, Anthony R., President & CEO, the National Association of Guaranteed Lenders, Inc..................................... 8 Willemssen, Joel C., Director, Civil Agencies Information Systems, Accounting and Information Management Division........ 10 Appendix Opening statement: Bartlett, Hon. Roscoe........................................ 27 Prepared statements: Hochberg, Fred P............................................. 30 Wilkinson, Anthony R......................................... 55 Willemssen, Joel C........................................... 59 HEARING ON SBA COMPUTERIZED LOAN MONITORING SYSTEM: A PROGRESS REPORT ---------- TUESDAY, FEBRUARY 29, 2000 House of Representatives, Subcommittee on Government Programs and Oversight, Committee on Small Business, Washington, DC. The subcommittee met, pursuant to call, at 10:00 a.m., in Room 2360, Rayburn House Office Building, Hon. Roscoe Bartlett [chairman of the subcommittee] presiding. Chairman Bartlett. Good morning. Let me convene the Subcommittee on Government Programs and Oversight of the House Committee on Small Business. Before I begin, let me note that we are this morning nationwide live on the Net, so if you would please speak into your microphone so that the system can pick it up clearly. Good morning and welcome to this hearing of the Subcommittee on Government Programs and Oversight of the Committee on Small Business. A special welcome to those who have come some distance to participate and to attend this meeting. Today we will examine a matter that is of great importance to the taxpayers who expect the 7(a) government guaranteed loan program to be well managed and remain solvent. The hearing is important to Congress in its oversight role and to the U.S. General Accounting Office which is responsible through the audit function to provide accurate information as to the financial condition of federal government programs. And this hearing should be of importance to the Small Business Administration known here in Washington as ``SBA'' the federal agency that is responsible for the day-to-day direction of the 7(a) loan program. Section 233 of the Small Business Reauthorization Act of 1997 (Public Law 105-135) requires that SBA complete eight mandated planning actions before the agency obligates or expends any funds for the development and implementation of the proposed new, automated 7(a) loan monitoring system. It would seem only a matter of common sense that the planning phase should be completed before an agency makes major software and hardware purchases for a new computer system. The proposed new automated loan monitoring system for the 7(a) loan program was the subject of a prior hearing of this Subcommittee held on July 16, 1998. We were encouraged by testimony at that hearing that the Small Business Administration had a project plan, but none of the eight planning steps had been completed. We in Congress support the Administrator's initiative in relying more on the private sector in the 7(a) loan program. We support SBA's turning over to hometown bankers the decision to originate loans and the responsibility for servicing and liquidating loans. Certainly the local banker has more knowledge of the lender and his or her credit worthiness than bureaucrats located some distance from the community in which the loan is made. Also, there is a broad-based support in Congress for the Administrator's efforts to modernize SBA's systems and outlook. There is also broad-based support for the Administrator's goal for the 7(a) loan program that is, to get SBA out of the loan application approval business altogether and to assume the role of overseer of the lending institutions. This hearing will focus on the progress SBA has made, since the July 16, 1998 hearing, in performing and completing the planning needed to serve as the basis for funding the development and implementation of the 7(a) loan program computerized loan monitoring system including the eight planning steps required by the Act. At this hearing today, we would appreciate your assessment of (1) whether any planning has been completed as of today, (2) the management decisions made as a result of that planning, (3) the planning remaining to be completed, and finally (4) the management decisions remaining to be made. Further, we would like to know the extent to which SBA has involved the lenders in the planning process. Lastly, does the planning for the system include maximizing opportunities to reduce needless paperwork, regulatory burden and costs borne by the borrowers, lenders and SBA? It would be unacceptable for SBA to ignore the law and the will of Congress expressed in Section 233 of the 1997 Small Business Reauthorization Act. It would be unacceptable for SBA to bypass accepted system development standards and essential planning steps. No successful business could omit prudent planning. It is incumbent upon Congress and the U.S. General Accounting Office to see that a federal agency does not engage in wasteful, willy-nilly project management. In a nutshell, the purpose of this hearing is to hold SBA's feet to the fire to make sure that they complete the eight planning steps required by law before the agency spends any taxpayers' money to buy software or hardware for a new automated computer system for monitoring its 7(a) loan portfolio. Again thank you all for participating in this hearing. And thank you in the audience for attending this hearing. And we are pleased today to be joined by Mr. Danny Davis, Ranking Democrat on our subcommittee, and would now turn to him for any opening remarks that he would care to make. [Mr. Bartlett's statement may be found in appendix.] Mr. Davis. Thank you very much, Mr. Chairman, and first of all let me commend you for calling this hearing today to review the progress of the Small Business Administration's Automated Loan Monitoring Program. As we all know, Section 233 of the 1997 SBA Reauthorization Act, PL-105-135, mandated that SBA perform the necessary planning to implement the computerized loan monitoring system. Modernization of SBA's loan monitoring system is critical to the survival of our small businesses, as it will help expedite loans in a more efficient and timely manner. This is most important to those programs which embody 7(a) programs and disaster assistance. As a member of this committee, I have worked tirelessly to see that all members of this country receive a fair and equitable treatment from the Small Business Administration regarding access to capital. I have also seen the same commitment from the Small Business Administration. First, completing the modernization of SBA's Loan Monitoring Program will enable everyone here to evaluate the progress made by the Small Business Administration concerning access to capital. Therefore, the full implementation of the SBA plan is critical to the success of the SBA andsmall businesses who need the services that it provides. I have complete confidence that the Small Business Administration and this committee will work together to that end. It is certainly encouraging to see the progress that has been made. It is encouraging to know that the Small Business Administration is dealing with what I consider to be, especially in much of the community that I represent, access to capital has and continues to be one of the most significant barriers to the development of small business, especially by minority groups and women. So, I thank you, Mr. Chairman, for this hearing. I look forward to the testimony that we are going to hear today, and thank all of those who have come to participate. Thank you. Chairman Bartlett. Thank you very much, and I would like now to welcome our witnesses. Let me say first that your prepared testimony will, without objection, be included as a part of the record, so we would encourage you to summarize in any way that you see fit. Our witnesses today are Fred Hochberg, Deputy Administrator, Small Business Administration, then Anthony Wilkinson, President and CEO of the National Association of Guaranteed Lenders, Inc., and Joel Willemssen, Director, U.S. General Accounting Office. Chairman Bartlett. Mr. Hochberg, we would be pleased to get your testimony first. Thank you. STATEMENT OF FRED P. HOCHBERG, DEPUTY ADMINISTRATOR, U.S. SMALL BUSINESS ADMINISTRATION Mr. Hochberg. Thank you. Mr. Chairman and Congressman Davis, my oral testimony will address the questions that you raised, Mr. Chairman, in your opening statement, and all of what we are doing here will also address issues of access to capital, because we will have far better information from our lenders, where loans are being made, and where they are not being made, as a result of our efforts through this program. Good morning, Mr. Chairman and Members of the Subcommittee. Thank you for inviting the U.S. Small Business Administration to testify about the progress we have made in planning for the implementation of our Loan Monitoring System. My name is Fred Hochberg, Deputy Administrator of the SBA. By way of introduction, I should add that I come to the SBA from the business world. I served as President and Chief Operating Officer of the Lillian Vernon Corporation, a business founded by my mother which I guided from $6 million to $170 million over the course of 18 years. One of the projects I undertook at the company was a complete enterprise-wide overhaul of my company's computer operations. But, before I get started I'd like to just brag a little bit. In yesterday's issue of Forbes magazine, the title is ``Best of the Web,'' the SBA was cited as having the best web site. You can find that on page 76 of yesterday's Forbes magazine. So, we are developing a very strong IT program at the SBA and we are glad that Forbes recognizes it. Joining me today are some of the senior executives who are responsible for the Loan Monitoring System. Behind me, you will find Kris Marcy, our Chief Operating Officer, Larry Barrett, Chief Information Officer, Charles Tansey, Associate Deputy Administrator for Capital Access, and Joe Loddo, our Chief Financial Officer. We are appearing on behalf of SBA Administrator, Aida Alvarez, whose schedule did not permit her being with us today. Despite her absence, the Administrator is deeply committed to transforming the SBA into a 21st century institution, using the best practices of the private sector, as well as the most recent advances in technology. Let me summarize my rather lengthy statement, and I thank you for including this as part of the official record as well. SBA's legislative mandate is quite clear. Simply put, our mandate is to serve as a gap lender, to ensure that those small businesses who do not have access to traditional means of capital have the funds necessary to start or grow their businesses. Our success in carrying out this mission has been nothing short of phenomenal. Since 1990, our loan portfolio has grown from $17.5 billion to over $50 billion. We now guarantee between 45,000 and 50,000 loans a year, three times the amount in 1990. And, we have made fundamental, major changes to the way we do business. Just a few examples. Now, all routine servicing is handled in our centralized business and disaster loan centers. Seventy- five percent of all loans bypass the district offices. SBA has reduced burdensome paperwork and increased efficiency with the SBAExpress and LowDoc programs, programs that help borrowers needing less than $150,000.00 in capital. We have completed our first round of safety and soundness reviews of the small business lending companies and are in the midst of our second round. This is a first for the SBA. In accordance with our legislative directive, SBA now contracts out about a third of its disaster loan servicing. Seventy-five percent of our business loan portfolio is now serviced by the private sector, our lending partners, and we launched our first ever asset sale, which was quite successful, last August. And, we did this with 22 percent fewer employees over the last decade. Obviously, this meant that the way we deliver programs had to change dramatically. You might say at this point, well, this is all well and good, but why not centralize even more. The answer goes back to our legislative mission, small businesses, new businesses, businesses without long credit histories, have special needs. Just look at the current crisis in the home heating oil industry in New England, and I should add in Maryland. If banks were to send these loan requests from these small oil companies to our Sacramento processing center, they might well be turned down. Many of these companies have no borrowing history, many of them need technical assistance, and it does take local knowledge of the local marketplace to make these loans work. We must give these small companies the loans coupled with technical assistance to help them get back on the road to recovery. We are all for centralization, but only if we can use it effectively in assisting our small business clients. SBA once made loans directly and did the credit reviews directly. Now, as I mentioned, 75 percent of all business loans are being made by our lending partners, with no or limited credit review by the SBA. This presents a level of risk, which you noted in your letter of invitation to this hearing, and this concern, Mr. Chairman, is why the agency began planning for a Loan Monitoring System back in 1996 and made its first funding request to Congress in February of 1997. Our computer systems were originally designed 20 years ago, when SBA's once primary function was direct loan making. Simply put, our systems have not fully evolved to meet the challenges and the way our loan products are now being delivered by lenders. It is critical that SBA develop a computer system that allows us to rapidly identify and respond to variations in lending patterns. Two major challenges face us as we move ahead. First, as a result of recent changes in thenation's banking laws, the face of lending has changed and changed dramatically. And, the industry has become increasingly polarized as mergers among large and medium-sized lenders have created a core of very large multi-state banks on one hand, and left an equally large number of rural and small banks on the other. Secondly, we are challenged by the fact that technology systems are evolving rapidly. When we first began planning in 1996, the full power of the Internet was just beginning to be realized. And, its potential as a consumer banking forum was understood hardly at all. In 1998, 6.9 million households were banking on line. The number is expected to grow to over 24 million by 2002. Thirty- nine of the largest consumer banks in the U.S. now offer Internet bill payment, up from just 17 a year ago. SBA must be able to keep pace or we will be bypassed. Mr. Chairman, you are a scientist with numerous patents to your name. I understand you've held key positions in research and development. You, probably better than most, understand how critical it is to keep up with technology. I know that you and this subcommittee recognize the importance of our developing an effective Loan Monitoring System for all our loans, not just 7(a) and 504. I recognize the contribution this subcommittee has made by outlining the planning steps which, along with the Clinger- Cohen Act, have guided the development of our system thus far. In fact, since the 1997 SBA Reauthorization Act, we have worked closely with the staffs of the House and Senate Small Business Committees and subcommittees, our appropriators and the General Accounting Office, to design a system which makes sense for all of our small business clients, and lending partners, and our staff. As you requested, I have included a detailed description of the work we have done to fulfill the eight planning steps in my written testimony. These steps have proved to be beneficial. I am pleased with the work we have done thus far. We are now ready to go forward. Let me summarize here some aspects of the planning work related to the benchmarking and business process reengineering. And, in fact, just yesterday we completed one additional step, which was pending and is now in final. The purpose of benchmarking was to identify the best practices of organizations. At the beginning, our contractor, Booz-Allen & Hamilton, emphasized the fact that none of the organizations identified in the benchmark report performed precisely the same function as the SBA. Freddie Mac, in its multi-family program for example, deals with about 40 banks. SBA does business with over 6,000. The quasi-government entities we studied, like Freddie Mac and Fannie Mae, are also significantly different from the SBA, because they are involved in housing rather than commercial loans. Housing loans tend to be more homogenous. Conventional lenders in the study do not have SBA's mission of providing financing to those who do not have access to credit on reasonable terms. The difference is mainly due to our role as a gap lender, which I mentioned earlier. Nevertheless, their systems provided very good models for the SBA to use in developing our Loan Monitoring System. There was one underlying theme throughout the benchmarking process, our inability to capture and analyze information which results in increased taxpayer exposure to credit risk. Booz- Allen & Hamilton recommended that systems be developed that would obtain information at loan origination and then automatically and seamlessly transfer the information throughout the organization. I know that you are particularly interested in the use of credit scoring. Greater use of credit scoring to make objective, standard determinations of front-end risk was identified in the bench marking process. By the summer of 2000, SBA plans to begin using customized credit scoring to expedite the decision-making at its LowDoc centers. Specifically, when a loan guarantee request receives a credit score in the low risk range, the credit scoring process will replace one of the two manual credit reviews now required for loan approval. The use of credit scoring, however, must be balanced. Credit scoring is not viable for new businesses and first-time borrowers, nor does it factor in anticipated business cash flows or other factors that SBA uses to determine ability to repay. SBA's BPR represented an important step in the agency's modernization planning. The BPR study was conducted from December of 1998 through June of 1999, with a 40-member team composed of a cross section of SBA field and headquarter staff. The team recommended incorporating technology advances that were not even available five years ago. After the BPR, we made a number of management decisions. Using GAO's BPR Assessment Guide, SBA conducted a feasibility study. Senior management and a panel of program experts, who are not part of the BPR team, reviewed the 38 recommendations. Ultimately, 30 of the 38 recommendations were adopted without any change. The remaining eight were adopted with slight modifications to better meet our legislative mission as a gap lender. Then, at the October field managers conference, SBA's senior staff reviewed the future role of the district office and the degree of appropriate centralization and decentralization. That subject was fully discussed and debated. In December, following review by senior staff, the Administrator adopted the recommendations of the feasibility study mentioned above. What are the hallmarks of our Loan Monitoring System? We'll be electronic with our lenders. We will be paperless. We will use high-quality data and be timely. We'll hold lenders to strict performance standards. We will proactively perform risk management. We will strengthen our ability to do timely and accurate subsidy rate calculations. Mr. Chairman, we have created a safe system. We can handle the challenge of doing business electronically. We have worked with the public key infrastructure group as we set up a secure Internet site for conducting SBA business and tested the use of digital signatures. We have two solid years of experience in addressing cyber intrusions and threats. SBA has taken aggressive steps to implement a proactive computer security program, including Internet monitoring, fire walls and two-step authentication to gain access to our site. As a result of the planning process, we are ready to begin the initial development of the system. No further management decisions remain to be made for Iteration One. Also, we have nearly completed orientation of our field staff who will be using the new system. We will continue to solicit feedback from our private sector lending partners. We have been meeting with them monthly to implement a system which will work best for them, too. These forums are an essential ingredient to ensure we develop a system that works for the SBA, our lending partners, and small business owners. Mr. Wilkinson will further elaborate on that. I stress that we are ready to begin the initial implementation of the system. Through extensive consultation with GAO, we have recently provided greater detail on Iteration One, which we believe demonstrates that we are ready to begin. We will continue to work closely with GAO as we evaluate this prototype effort. We have purposely adopted an evolutionary or iterative approach. It is less risky. We are mindful of the mistakes that have caused other organizations to stumble. Let me go back to our commitment. I hope I have convinced you that Administrator Alvarezand I, backed by the team who are sitting behind me, are totally committed to bringing the best of the technology to our agency. We will use electronic commerce in every facet of our operations, using it in our work and communications with every member of our staff and SBA family, our resource partners, and our small business clients. We are modernizing, and we are mindful of the risk associated with major IT projects. We are also aware of the greater risk of not proceeding. As a result of our planning, we are now fully appreciative of the exposure we face. As stewards of federal resources, our failure to proceed would be irresponsible and imprudent. Thank you for inviting the SBA to discuss with you the Automated Loan Monitoring System. I appreciate your continued support of this effort, and I ask for your support in the future. I'd be happy to answer any questions you may have. [Mr. Hochberg's statement may be found in appendix.] Chairman Bartlett. Thank you, Mr. Hochberg. We now will turn to Mr. Wilkinson for his testimony. STATEMENT OF ANTHONY R. WILKINSON, PRESIDENT AND CEO, THE NATIONAL ASSOCIATION OF GUARANTEED LENDERS, INC. Mr. Wilkinson. Good morning, Mr. Chairman, Congressman Davis, Congressman Toomey. My name is Tony Wilkinson, and I'm the President and CEO of the National Association of Government Guaranteed Lenders, or NAGGL as we like to call it. We represent nearly 700 lenders and other program participants who cumulatively make approximately 80 percent of the 7(a) loans guaranteed by the SBA annually. We thank you for holding this hearing today and requesting our input on SBA's automation efforts. I have learned today that one of the other reasons I was asked to be here today was to help bring the average size of the testimony down. My two colleagues have done an excellent job in covering the technical sides of the issue in front of us, and I'm going to speak briefly on what is going on from the lender's perspective. Over the last decade, the SBA 7(a) loan program has experienced tremendous growth. What once was a fairly small program is today a $10 billion plus program. In the early part of the 1990s, the SBA processed the majority of the 7(a) loans. To better leverage private sector resources, so that we could provide access to capital, this process had to change and we had to rely more on preferred lenders and other means to deliver the product, and that has happened. This transformation is well underway at the SBA, and as Mr. Hochberg just said, 75 percent of all 7(a) loans last year were processed under the PLP program or other limited review procedures. So, again, the SBA is now better leveraging private sector resources, providing greater access to capital to small business, and doing so with fewer employees. An integral part of SBA's success will be the development and implementation of the new Loan Monitoring System, and from the lender's perspective this will be no easy task. The agency must deal with the smallest of community banks, all the way up to the largest multi-district commercial banks, and non-bank lenders. These banks and lenders serve various geographical areas, so the needs of the lenders that will be involved in this new Loan Monitoring System are very different, and SBA has had a challenge in figuring out how to meet the needs of both extremes and every lender in the middle. We agree that the SBA must gather sufficient data to manage its loan portfolio in a responsible manner, while not creating a reporting burden on either the borrower or the lender. NAGGL thanks the SBA for the ongoing dialogue that we've had with our Automation Committee. It's been a pleasure to work with Mr. Hochberg and his staff, and from our perspective they are doing an excellent job in putting together the new Loan Monitoring System. We hope this dialogue will continue. We do have regularly scheduled meetings, and we hope this continues especially since we are nearing the stage of refinement. One of the things that we are looking for in the not too distant future is a set of specifications with the data file elements that will help our lenders determine what we will have to do to comply with the new Loan Monitoring System. NAGGL concurs that the Internet should be the standard medium for submitting loan applications and servicing actions. Reliance on the automated flow of information should create efficiencies both with the lender and SBA. We also appreciate SBA's willingness to work with lenders who are not technologically capable, by agreeing to accept applications by paper. As well as having ongoing dialogue with the lending community, we hope that SBA is having a similar dialogue with their current contractors to make sure that they can specifically integrate their computer systems with what the SBA is planning. Hopefully, this will maximize results and there will be no duplication of efforts. As equally important to the process of collecting the data, is the establishment of performance standards by which lenders will be reviewed. The SBA has recently established the Office of Lender Oversight, and it is our understanding that development of performance standards is one of high priority. NAGGL has long said that the SBA needed to be in the business of lender oversight, and we hope to work with the agency to develop performance standards that are appropriate to protect SBA's interests, but also reasonable, fair and focused on compliance with SBA rules. Mr. Hochberg said in his testimony, both written and verbal, that one of the uses of the data collected in the new Loan Monitoring System will be to predict more accurately the future cash flow of loans and help with subsidy rate calculation. We, at NAGGL, hope this actually happens. For the last several years, the Administration has materially overestimated the cost of the 7(a) program by using a default estimate that is much higher than actual defaults. This means that borrowers are being charged fees higher than necessary. In just the last few years, the Office of Management and Budget, per the agency's Fiscal 2001 budget request, now says they overestimated the cost of the 7(a) program by a total of $1 billion. Compared to the request of 7(a) appropriation for Fiscal 2001 of only $142.6 million, this to us is a serious problem. But, even though OMB has reported they overestimated the cost of the program in the past, primarily due to excessive default estimates, they did not change the default estimate, or materially change the default estimate, for Fiscal 2001. OMB is still using a default estimate that we believe is more than 40 percent higher than necessary. A 40 percent decline in the default estimate in the subsidy model would mean a 7(a) program subsidy rate of approximately zero. We would not need an appropriation for Fiscal Year 2001. NAGGL would appreciate any help this committee could provide in helping obtain a more reasonable and fair subsidy rate calculation for the 7(a) program. Mr. Chairman, thank you for the opportunity to appear today, and I'd be happy to answer questions. [Mr. Wilkinson's statement may be found in appendix.] Chairman Bartlett. Thank you very much. Now we welcome Mr. Willemssen, and look forward to his testimony. Thank you. STATEMENT OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL AGENCIES INFORMATION SYSTEMS, ACCOUNTING AND INFORMATION MANAGEMENT DIVISION Mr. Willemssen. Thank you, Mr. Chairman, Ranking Member Davis, Congressman, thank you for inviting GAO to testify today. As requested, I'll briefly summarize our statement. Overall, SBA has made substantial progress in completing the eight mandated planning actions for its Loan Monitoring System. SBA has now completed final or draft products for each of those required actions. For example, SBA has benchmarked its business processes against those of leading organizations, and has conducted a reengineering study to identify and select new processes to improve its operations. The reengineering study addressed the key business functions within SBA, such as guarantee procedures and lender oversight, and made numerous recommendations for improving the agency's business processes. SBA has also started to identify the data needed for the proposed Loan Monitoring System, begun defining data quality standards, started addressing the target information architecture, initially defined system requirements, and estimated the costs to complete the project. Based on the results of the reengineering study, SBA has developed a general description of the Loan Monitoring System. The system is expected to be on line to all users around the clock. Internally, SBA staff are to have access to records from anywhere in the agency, while externally the system is expected to allow lenders to view their own portfolios. SBA plans to have the Loan Monitoring System linked to the Internet and be integrated with a secure web site. Currently, SBA estimates that the new system will cost about $27.7 million. While SBA has made substantial progress in its planning for the Loan Monitoring System, it still must take a number of actions to reduce the project's risk. Let me highlight just some of those key actions. First, SBA needs to identify the costs and benefits of a range of business process and systems alternatives to provide greater assurance that it is pursuing the most cost effective options. Second, SBA needs to ensure that the system it is building will be integrated with its future agency-wide information technology architecture, so that the Loan Monitoring System will be able to work seamlessly with SBA's other systems. Third, SBA needs to make sure that it implements plans for improving data quality, including defining standards and developing a schedule of actions to include data quality in the current systems. Fourth, SBA needs to make sure it's defined key requirements for the Loan Monitoring System before proceeding with development. And finally, SBA needs to provide a clear rationale for why automation of many of its business functions must be custom developed, rather than addressed through the use of commercial, off-the-shelf products. As it proceeds with the Loan Monitoring System, SBA will also need to continue strengthening its project management processes and controls. It has started to implement these basic policies and processes, and they are really critical for such an effort as the Loan Monitoring System. For example, instituting capabilities such as project tracking and oversight are essential to be able to monitor actual results and performance against the schedule. In addition, implementing configuration management policies, which are a set of controls over changes to computer and network system changes, are important to successfully managing systems that intend to be as complex as the Loan Monitoring System. Further instituting quality assurance activities, to verify that system development complies with applicable standards, provides SBA's management with the information they need on whether the project is adhering to established standards and procedures. Another key aspect that must be addressed is security and privacy of automated information. SBA's planned reliance on the Internet poses security challenges that must be addressed early in the project's life. Because of this, SBA needs to update its security operating procedures before it begins wide-scale development of the Loan Monitoring System. That concludes the summary of my statement, and I'd be pleased to address any questions you may have. Thank you. [Mr. Willemssen's statement may be found in appendix.] Chairman Bartlett. Thank you very much for your succinct and informative testimony. Let me turn now to our Ranking Member and ask Mr. Davis for his questions and comments. Mr. Davis. Well, thank you. Thank you very much, Mr. Chairman. Let me just indicate that I find this kind of testimony, especially the technical complexity of it, very intriguing. Mr. Hochberg, I know that many lenders use credit scoring when they are processing small loans. My understanding is that credit scoring may not work well with small and new businesses. I also noticed that you mentioned credit scoring and credit worthiness in your testimony. Can you indicate how you will use this information to assist start-up businesses, small businesses, real small businesses? Mr. Hochberg. Thank you. I think credit scoring is not really going to be applicable for very small businesses and start-up businesses. It looks at past payment history. However, we can use credit scoring on some of the more established businesses, where right now we have two separate financial analysts who review some of these loans. It will replace one of them, so that we can use those resources better, perhaps, to work on more complex or trickier loans. But, credit scoring is just one tool that we'll be using, one tool that we'll be importing from the outside, not reinventing, but use as an outside resource, an off-the-shelf program that we'll customize in some ways. Mr. Davis. You really wouldn't have to have any fear that there is any possibility that this process or this mechanism could be used to redline. I'm always fearful of redlining, in terms of having gone through those experiences and having seen how sometimes the establishment of standards and criteria will box some people out because they just, for a number of reasons, may not be there. Mr. Hochberg. I think that with this Loan Monitoring System we will have better information on which banks are making loans, where they are making the loans, and the kind of businesses they are financing. So, in some ways I believe the opposite will happen, we'll have far better data to understand where the gaps exist, so that we can better address those gaps. And, if we find in certain districts or neighborhoods that there is lower lending activity, which we'll have a better handle on, we can go out and recruit other banks and other lending institutions to makesure that access to capital is not part of the problem. Mr. Davis. In his testimony, Mr. Wilkinson mentioned a desire or the desirability of SBA being a bit more specific in terms of specifications for compliance. How would you respond? Mr. Hochberg. I'm not sure I fully understand that question. Mr. Davis. Well, I think he, could you mention that again? Mr. Wilkinson. I'm not sure I understand the question either. What I said was, we were looking for a set of specifications that they expect to publish soon, so that our lenders will know exactly what data file elements the SBA is looking for, so that we can then sit down with our computer folks to see what we have to do to comply. Mr. Davis. That is exactly my question. Is that forthcoming? Mr. Hochberg. We will be putting out the performance standards and how we will evaluate and analyze different lender performance, so that banks will know precisely what are the criteria in terms of their PLP status and how they operate with the SBA. That will be much more explicit than it's been in the past. Mr. Davis. Also, Mr. Willemssen mentioned in his testimony some question in relationship to custom development of data quality, in terms of whether or not there can be a boilerplate, I would assume, set of data as opposed to having to customize for so many different entities and, perhaps, at different times. How would you respond to that question? Mr. Hochberg. It is our desire to use as much off-the-shelf software as we possibly can in each phase of the program, because this is a large system that has a lot of components to it. We mentioned credit scoring. We'll be using D&B or a similar company in terms of getting credit analysis, but we will be, as much as possible, using off-the-shelf systems because they are, frankly, less expensive. What we did find, though, up to this point, is that we found fewer parallels, fewer exact matches in the private sector or in other government agencies than we, perhaps, had thought at first. So, we probably will rely a little bit more on customization than, perhaps, we would desire, but we don't have a choice in this matter. Mr. Davis. Thank you. Mr. Willemssen, I thought that you were quite complimentary to the SBA, in terms of progress that it has made towards compliance. Are there any areas beyond what you have discussed where you think there is a need or that they could make more progress or more effort? Mr. Willemssen. I think, Ranking Member Davis, I tried to summarize those pretty well in the opening statement, and what we've seen on the part of the Deputy Administrator and his staff is a real willingness over the last few months to work with us. They have been very responsive to the issues we've raised. We do have some remaining issues that we would like them to pursue. I'm not aware that they disagree with the need to implement those actions. There may be a slight disagreement on what that means in terms of the roll-out of the eventual system, but we'll continue to work with them to help ensure the project's success and reduce the risks as much as possible. Mr. Davis. Thank you. Mr. Wilkinson, you, likewise, were quite complimentary, and I think we always like to see various partners being able to work cooperatively and work well, because that generally means there's going to be a different level of success. Are there any other areas that you'd like to see some additional effort or additional movement in? Mr. Wilkinson. Well, as I said in my testimony, one of the key areas that we want to watch is the development of performance standards, and once we've figured out, okay, what do we have to submit up front on a loan application to comply, we've now collected certain amounts of data, well now, what are we going to do with that data, and how is the lender going to be graded, if you will. And so, we are looking forward to working with the agency on developing those standards over the coming months. And, the only other comment I would have is, the agency is hard at work at this. They have dedicated some serious resources to getting this done. Iteration One is scheduled to be finished by summer of 2000. My only concern is that if, for whatever reason, that doesn't get finished by the summer of 2000 and we slide, we'd move into a presidential election, a change of administration, changes in leadership at the agency, that the project could get bogged down. So, we in the lending community are hopeful that while the ball is rolling that this project does get finished, at least Iteration one, this summer, because they've got a lot of folks working on it right now. Mr. Davis. Perhaps, this is my last question, Mr. Chairman. Mr. Hochberg, you heard that question. It's also a thought that I've had, in terms of sometimes if administrations change, and when they do, certain policies within agencies sometimes will also change. As a person inside the agency, can you give us any assurance, while you can't ever give absolute assurances, but can you help belay any concerns that we might have in relationship to that, relative to what's being instituted internally to make sure that there is a continuation? Mr. Hochberg. One, I just want to add, I think we've been working hard and have a very good relationship with the General Accounting Office and NAGGL, so, one, our outside partners, that is not going to change, and that is a steady factor. Additionally, the team that is sitting behind me, our Chief Operating Officer is a career person, and our Chief Financial Officer is a career person. Larry Barrett is our Chief Information Officer, career person. They will be here regardless of a change in administrations. But, I do think that Tony mentioned one important thing. The best way to ensure that there is less interruption is for us to get moving and start implementing, to get this project underway. The concern always is with a change of administrations that when things are simply in draft form or planning form, there's a good reason to reevaluate everything, but if we are making progress, as Tony mentioned, having Iteration one installed, working it through, we will learn so much by installing that first iteration that will inform the rest of the process. I think that's the best assurance that we keep this thing moving and moving rapidly. Mr. Davis. It seems to me that progress is, indeed, being made, and so I want to compliment you on, not only the effort, but what appears to be a great working relationship, and certainly it seems to me that you are moving positively towards implementation. Mr. Chairman, I don't have any other questions. I thank you very much. Chairman Bartlett. Thank you very much. We'll turn now to Mr. Toomey. Mr. Toomey. Thank you, Mr. Chairman. Just a couple of quick questions. Mr. Hochberg, it's my understanding that this Loan Monitoring System has been designed with the 7(a) program in mind. Could you just comment whether there's any applicability at all to the other loan programs, or where that stands? Mr. Hochberg. Yes. This loan program was designed initially with the 7(a) program in mind. It does include the 504 program. It includes microloans and those loans are really made tointermediaries. In addition we did some disaster planning models in modules for our disaster loan, which is a direct loan program. So, we did some front-end work to make sure that this system will encompass the full range of lending that we do. Mr. Toomey. Okay. And, I think it was Mr. Willemssen who suggested that one of the areas that continue to need development, if I understood correctly, was to ensure that the system is fully integrated with the MIS agency-wide, and could you just comment on that, how you see that proceeding? Mr. Hochberg. Let me emphasize, we know this is a large project for the SBA. This is a big systems development effort, larger than we have tackled before, which is why it has been such a deliberate process, why we've gone through the eight steps, why we've worked so closely with GAO, with our outside partners, and have brought in a number of consultants and contractors. But, the architecture has been developed. We are waiting for the final draft of that to come back from our contractor to review. That is an essential platform that has to be in place before we go further. So, we are fully in agreement on that. Mr. Toomey. And, last question, when all is said and done and this is finished, what do you think the total cost will have been? Mr. Hochberg. Well, I think the total cost we currently are estimating at $27.7 million, will be the total cost for phase one of this system. That is for the Loan Monitoring System. That does not include the overhaul of our financial systems, which we have just begun, including our human resources as well as contracting programs, and some of the other technical assistance programs. So, I should just add that's the cost estimate only for phase one. Mr. Toomey. Okay, thank you. Mr. Hochberg. And, that is an estimate. Mr. Toomey. Okay, thank you. Chairman Bartlett. Thank you very much. Let me ask a technical question or clarification first. I wonder if you could put back up the chart which is entitled, ``Doing More With Less.'' You said in your oral testimony that you were now doing more with less, and that you were now using 22 percent less employees in the last decade. If I look at the chart, it would appear that in the last decade your number of employees has dropped to about 50 percent. I was just wondering, was your oral statement wrong or is the chart drawn incorrectly? Mr. Hochberg. Our total employees are down. The problem with the chart is we should have a scale on the left side to show total number of employees. Chairman Bartlett. I'm presuming the scale was linear, no matter what the scale is, if it's linear why it would appear that in the last decade it's dropped almost 50 percent. Has it not? Mr. Hochberg. Let me just get a clarification. The staff in 1992 was 3,874 employees. In 1999, we are looking at 3,123 employees, which is a reduction of 751 to be precise, so that would be the exact number. Chairman Bartlett. Okay. So then, the chart is drawn incorrectly. Mr. Hochberg. Probably the scale is off. The staff part of the chart appears to be on the high side. Chairman Bartlett. Okay, thank you very much. The two just didn't jibe, and I wanted to make sure why. Mr. Wilkinson, you mentioned that the default rates were too high, which means a lot of monies have accumulated because they were not needed to cover those default loans. One of two things presumably could happen as a result of that. One is that less monies could be appropriated because monies have built up. Is there a second alternative, and that is that we now could make more loans because we have the monies there? Mr. Wilkinson. No, sir, that money automatically goes to Treasury. It is gone. There is the agency cannot use those funds. Under the Federal Credit Reform Act, the agency must estimate what the net present value cost of their program is, and that is done based on entering the future cash flows, how much fees we are going to charge borrowers and lenders to be involved in the program, so all the fees are set up front. As time passes and we get actual numbers, the actual numbers replace the estimated numbers, and there's a reestimate amount, either positive or negative, that either flows to Treasury or is borrowed from Treasury. Borrowed is the wrong word, or received from Treasury, to settle up the account. But, what has happened over the last several years is, there's always been too much money estimated up front, so that the amount of appropriations, fees charged to borrowers and fees charged to lenders, has been more than has been necessary. But, under the Federal Credit Reform Act, those monies flow straight to Treasury and they are gone. Chairman Bartlett. I thought I heard you say in your testimony that enough monies had accumulated that we wouldn't need any appropriations for the next year. Mr. Wilkinson. No, well I was trying to draw the comparison of how much had been overestimated, how much the cost of the program had been overestimated, in relation to what we had to obtain in appropriations for the Fiscal Year 2001 budget. Chairman Bartlett. Okay, but there are no monies that are available to you, because at the end of the year they simply return to Treasury. Mr. Wilkinson. That is correct. Chairman Bartlett. So, we need to take cognizance of that in future appropriations, so that surplus monies don't need to be appropriated, is what you are saying, because they can't be used and simply go back to Treasury. Mr. Wilkinson. Well, each year we must get an appropriation to fund a certain program level, and what we are saying is that the estimates used in that are too high. We still have to have those appropriations, because once OMB sets the subsidy rate number it is set, and we have to live with that. So, the Fiscal Year 2001 subsidy rate is set, and for us to have sufficient monies to loan to small business we must obtain the appropriation. Where we need to focus is more on the Federal Credit Reform Act and the kinds of estimates that OMB is allowed to use in the model. Chairman Bartlett. Thank you very much. The purpose of our hearing today, of course, was to determine the status of planning or implementation of this Loan Monitoring System. Mr. Hochberg, in your oral testimony you said that we were now ready to go forward. I gather from subsequent remarks you made that you feel that you are now ready to implement the system. The monies, of course, as a result of Section 233 of the Small Business Reauthorization Act of 1997 Act, have been fenced, and they will not be released from the appropriators until a signal from our committee, and that signal will not be made until we get a signal from GAO that you, in fact, have completed those eight planning steps that were mandated by that Act. Mr. Willemssen, in his testimony, and his summary, went through and I think I numbered them correctly, a dozen items that in his view need to be completed. I am presuming, Mr. Willemssen, that your position is that these actions need to be completed before you can certify that these eight planning steps have been completed, so that the system can now be procured. Mr. Willemssen. The majority of those actions we would want to see completed before SBA embarks on major design and development activities associated with the Loan Monitoring System. To the extent, and this is the subject of some discussion that we've had with SBA over the last day or two, to the extent that their Iteration One is viewed as more of a prototyping effort and something that helps them learn more about what they want the system to do, then I would reduce that list to a much smaller number. We have received some information from SBA on exactly what that first iteration associated with the system is, but not enough yet to make a final determination. Chairman Bartlett. Thank you. Let me go through the list, if I might, and just ask each of you your position on it, and then I would like to get an estimate of time to complete. It's my understanding that there are more than adequate monies there to complete the planning? Mr. Willemssen. Correct. Chairman Bartlett. Okay. Number one was, completing the analysis of benefits and costs for alternative business processes identified through SBA's business reengineering effort. This is a task that needs to be completed, in your judgment, Mr. Willemssen, before we can certify the system as ready to be implemented? Mr. Willemssen. Yes. We would like to see additional information on costs and benefits associated with a range of alternatives for going forward with the major system development activity. Chairman Bartlett. Mr. Hochberg, do you understand what GAO is interested in here, and do you agree? Mr. Hochberg. My understanding in working with Joel, is that what is needed is a more explicit articulation of what the cost benefits are program by program, not the total system, but by elements of the program. That's my understanding. But, associated with what options that the agency will pursue is making sure that those are the most cost effective options, so that we are getting a system that meets everyone's needs at the lowest possible cost. Chairman Bartlett. And, how long should it take for that to be implemented? Your guess, Mr. Willemssen, and then I'll ask Mr. Hochberg his. Mr. Willemssen. I would say it would still take a couple months more work on the part of SBA to do that. Chairman Bartlett. Any argument with that, Mr. Hochberg? Mr. Hochberg. I probably should ask Larry Barrett, our Chief Information Officer, to give a more precise estimate of that kind of information. Mr. Barrett. Larry Barrett, Chief Information Officer, Small Business Administration. I estimate it slightly shorter than that. We are estimating somewhere from four to six weeks to accomplish those tasks. Chairman Bartlett. Thank you very much. The second one I have identified here is performing benefit cost analysis for systems alternatives. Mr. Willemssen. Correct, and that can actually be associated with the item that we just talked about. As SBA goes through the business and system alternatives, it should determine the costs and the benefits of each. Chairman Bartlett. So, if they completed the first project that we talked about, they would have to finish the second Mr. Willemssen. The two should be done in concert. Chairman Bartlett. Okay, so the two months, or the four to six weeks estimate on the part of the agency, should accomplish both of those first two. All right. Thank you very much. The third one I have identified here is completing the part of its information architecture that specifies the rules and standards for interoperability and maintainability of interrelated systems. Mr. Willemssen. Mr. Willemssen. If SBA puts the necessary resources to that task, there's no reason that they can't have an initial identification of the standards and protocols they want to adhere to in a matter of several weeks. It's just a matter of putting the resources on it. Chairman Bartlett. Mr. Hochberg, you have the resources to get this done, and do you agree with several weeks? Mr. Hochberg. Let me just add, Mr. Chairman, that the money you mentioned, the $8 million that was appropriated for 2000 that is fenced off, some of this project can be done by internal staff that is dedicated to this project. However, the funds to pay that staff are actually in that $8 million appropriation. The only money we have is fenced off, parked at FEDSIM to be used for outside contractors. But the money needed to have our internal staff keeping doing this work and doing it more thoroughly, we do not have access to those funds. Chairman Bartlett. Mr. Willemssen, from your testimony it was my understanding that adequate monies were there, do you understand that some of those monies are fenced so that they are not available, and who needs to take action to make sure they are not fenced so that they can complete the planning? Mr. Willemssen. Well, our view of the monies available, it's a matter of whether SBA wants to decide to use in-house resources or contractor resources to get some of these activities accomplished, and then laying out a clear schedule of activities for who is going to do what and when. It would certainly appear to us, based on the information we have at this point in time, that adequate funds are available for those planning activities. If SBA or the Deputy Administrator has information to the contrary we'd be more than happy to look at that. Chairman Bartlett. But, the information you now have available, you would indicate that probably there should be enough monies there to complete the planning? Mr. Willemssen. Yes, sir, Mr. Chairman. Chairman Bartlett. And, they are not fenced and we do not have to take action to release them? Mr. Willemssen. I do not have evidence of that for the planning side. Chairman Bartlett. Mr. Hochberg, if that is true, if monies which you need are fenced and some action needs to be taken to release them, would you please indicate what is fenced and what actions need to be taken, so that your progress will not be slowed due to lack of available monies? The fourth one was identifying requirements and data elements for reports. Mr. Willemssen. Mr. Willemssen. SBA has made progress on this and is getting close to having a standard set of data elements. I think it was discussed somewhat in the testimony earlier that the lenders want to have this information too. SBA just needs a little bit more on the input and output side on the level of detail, but I think they are getting fairly close on that. Chairman Bartlett. What is close in terms of time to complete? Mr. Willemssen. I would say, again, within a period of several weeks. Chairman Bartlett. Several weeks? Mr. Hochberg. Mr. Hochberg. Mr. Chairman, generally GAO is conservative, so if they say several weeks I'm comfortable with that estimate. Chairman Bartlett. Okay, thank you. Let me ask a question, when you are saying several weeks, and four to six weeks, and two months and so forth, are you presuming, are both of you presuming that there are adequate resources there that these times can run concurrently, or they have to run sequentially? Mr. Willemssen. No, many of these activities can run concurrently, and that's why I would echo the comment I made earlier, it's a matter of SBA putting the needed resources on these activities to get them done in that time frame. Chairman Bartlett. When we finish this list, we'll go back again and ask you to look at the longest one of these and ask the question, are there enough resources to complete them all within that time period, or do some of these have to be sequential, simply because maybe some of them can't be done until others are done, or because the same people are needed to do two of them. You can't do two things at once. Mr. Willemssen. Right. Chairman Bartlett. So, we would like to come away with a feeling as to the maximum amount of time it's going to take in addition to the amount of time it's going to take for each of these components. Five, completing the definition of specific data, quality standards, did we cover that one? Mr. Willemssen. Yes, among the items we'd like to see there is more specificity on SBA plans to clean up the data before embarking on major software design efforts. Again, depending on how Iteration One is defined, something like this can possibly be delayed. The data quality standards are absolutely essential eventually but not as pivotal in terms of finishing them before proceeding. Chairman Bartlett. In other words, you are saying that you could certify to us that they were ready to buy equipment before this was necessarily completed? Mr. Willemssen. Right, there would be other activities that would be higher on the priority list to address. Data quality must be addressed, it's absolutely essential. But in terms of doing this before proceeding with the initial system design, I'm not as concerned. Chairman Bartlett. With an adequate understanding between GAO and the agency, you then could certify to us that they were ready to procure if you had a good feeling about how they were going to address this? Mr. Willemssen. Right, and we saw the specific milestones that SBA officials have laid out for when they are going to do this and how, and then they have the project management oversight to track what actually happens against that schedule. Chairman Bartlett. Okay, thank you. Number six, ensuring that systems requirements document include capacity and performance requirements. Mr. Willemssen. This is possibly the one of the eight that would take the longest, in my opinion, especially if Iteration One is the beginning point of a typical system design and development effort. Among the things that SBA needs to still look at here are specifying exactly what they want the system to do from a capacity perspective and a performance perspective. For example, how big is this going to be? How many lenders are going to be accessing it? How many employees and, therefore, how much horsepower do we need, how much communication throughput do we need? What kind of performance are we expecting? Are we expecting immediate on-line access 24 hours a day? That has ramifications for the size of the system, which has ramifications for the cost. So, there are still some issues here that SBA needs to look at. Again, I want to reemphasize, to the extent that Iteration One is more of a prototyping effort, where SBA tries to learn more about what they want the system to build, then we're less concerned with making sure this is fully done before they proceed. Chairman Bartlett. But, if you don't know the system's capacity needed and the performance requirements, how can you size the system? Mr. Willemssen. Well, you can't from a traditional life cycle approach to system development. Again, and that's why if they wanted to take an initial prototyping effort to get some more indication and validation of where they think they are going is correct, then that's a more appropriate strategy. But, starting on a major system design and development effort with not knowing those exact specifications on capacity and performance, that's a little more risky. Chairman Bartlett. I'm familiar with prototyping in the defense area, where you acquire a prototype system and you gain experience with it. You now know what you need to change so that the next one will be better, that's not what we are talking about here. You are not talking about a prototype system that they are going to get some experience on and then discard and buy the real thing? Mr. Willemssen. I don't have the full description of the system at this point, for example, a statement of work on exactly what would be involved right now in SBA Iteration One. I'd defer to the Deputy Administrator, but I know SBA is considering looking at testing some different scenarios, some different prototype systems, to see that the requirements that they've laid out to date are reasonable. Chairman Bartlett. Am I also correct in assuming that this cannot be done until some of the other things are done, because you will have to have completed some of the others before you could get an estimate of the capacity needed and the performance requirements, would you not? Mr. Willemssen. That is correct. Chairman Bartlett. So, this will be sequential. Mr. Willemssen. That one is, from a couple perspectives, a bit more sequential, and, again, is the one that probably holds SBA up the longest. Chairman Bartlett. Now, once they are able to start with that, have the information necessary to start, how long will it take to complete it in your judgment? Mr. Willemssen. To complete Iteration one? Chairman Bartlett. No, to complete ensuring systems requirements document, include capacity and performance requirements. You can't do that until some of the other things are done. Once the other things are done, how long will it take to do this one? Mr. Willemssen. I would say my best estimate would be early summer 2000, to have it all done, from a system requirements standpoint. Chairman Bartlett. Okay, so you are talking about four months. Mr. Willemssen. And again, those time frames are driven based on the point that you made a few minutes earlier. We have to look at where the resources are, and does SBA have available resources from a contractor and in-house perspective. And my other caveat is, as the Deputy Administrator mentioned earlier, dependent upon the approach they want to take with Iteration One. Chairman Bartlett. Okay. Mr. Hochberg, do you agree with this estimate? Mr. Hochberg. Let me respond to that. I'd also like Larry to respond, since it is his direct responsibility to do this implementation. I should add for a point of clarification that I will also follow up in writing, the funds for 2000, to pay for staff to do this work, because this is a blend of both contractors and staff, are held by Chairman Rogers' Appropriations subcommittee. We cannot use those funds, to pay internal costs to do this work until that money is released. The money we have access to at the moment is at FEDSIM, which can only be used for outside consultants and outside contractors. None of that can be used to pay the people that at the direction of the committee we have brought in house to ensure continuity in the planning process. Therefore, we are using regular salaries and expense funds--not modernization funds--until we get that release from Chairman Rogers. But, let me ask Larry to respond to the timing issue. Mr. Barrett. Larry Barrett, CIO. We disagree with GAO's estimates. We think that we can do it probably in a slightly shorter period of time for two reasons. The first reason being that we think that we have collected a lot of that information already, although we haven't provided it to GAO yet, and the second reason is that we view Iteration One as a prototype, and we need that prototype or we need that first iteration to provide additional information for us to do the capacity planning for the full- blown system that will come later. Chairman Bartlett. Okay. Let me ask Mr. Wilkinson, I gather that you have not yet determined whether prototype equipment needs to be acquired and work lists before completing final system design. At what point will you be comfortable with whether or not that needs to be done, so that the monies necessary for that, I'm gathering that the monies necessary for acquiring the prototype are fenced, and they would need to be released, and that will require your agreement and the agreement of this committee and the Appropriations Committee before that's released? Mr. Wilkinson. I would be more comfortable with Iteration One when I saw a document such as the statement of work, for what the contractor is exactly supposed to do for that particular iteration, and we have evaluated that, discussed it with SBA, and made some determination as to the adequacy of that approach. Chairman Bartlett. Okay. So you need proper documentation Mr. Wilkinson. And, I have not seen that to date. Chairman Bartlett. So, that needs to be done before you can reach a considered judgment. Mr. Wilkinson. And, the SBA may have it done, we have not yet been provided that document. Chairman Bartlett. You've just not seen it yet. Okay. Now, the seventh one was ensuring that sound justification exists for pursuing custom development functions. I gather that GAO has a concern that not enough COTs, commercial off the shelf, is being planned, and that the agency is considering pursuing some custom developments that may not be necessary in your judgment? Mr. Wilkinson. Well, the Deputy Administrator has discussed this point, the fact that they will, to the extent possible, try to pursue commercial off-the-shelf products. We think that's the right approach, because generally speaking you can get those done quicker and at less cost. It was a bit surprising to us to see that about 40 percent of the functions needed non-COTs products, and we just wanted to see the written justification and rationale for why it was that high. So, it's not to say we don't believe SBA, we would just like to see what documents support that, given that that kind of approach generally results in higher costs and lengthier time frames. Chairman Bartlett. Okay. Mr. Hochberg, does the agency have the justification for the custom developments, rather than going commercial off the shelf? Mr. Hochberg. Mr. Chairman, we are looking at that. There are many parts of the Loan Monitoring System. So on a system- by-system basis we are looking at commercial off the shelf versus in-house programming across the board. I come from the private sector. I ran a business for 18 years. The last thing I would want to see done is reinventing the wheel, developing things that can be found on the outside. I have zero interest in that whatsoever. I agree with Joel entirely, it takes longer, it costs more money to do a custom solution. So, to the extent possible we want to find off-the-shelf programming in the same way we want to centralize as many processes as possible. Chairman Bartlett. When will you have completed that analysis, to be able to get that information to GAO? Mr. Hochberg. I should ask Larry to give you the precise timing on that. Mr. Barrett. The COTs decision will be an ongoing evaluation as we go through the various iterations of the system. We will constantly be looking to see if we can purchase off-the-shelf software. We'll make a decision on Iteration One before we proceed in Iteration One, and then use that information in terms of deciding about the software for the succeeding iterations as we go through them. Chairman Bartlett. Thank you. Mr. Willemssen, the eighth item I have here is estimating the cost to completion that are based on an analysis of the benefits and costs of system alternatives. Do I conclude from this that you aren't sure that the, what, $27 million is the right amount? Mr. Willemssen. Yes, in terms of SBA's effort on this particular action, it is substantially completed at this point. However, when they embark on additional analyses and costs and benefits of alternatives, that figure could change, and so they will have to refine the figure after the cost benefit analysis. And, we also think it's important for SBA to look at the Loan Monitoring System from a life cycle perspective. That's what's typically done on major information systems, is you don't only look at the design and development costs, but the operation and maintenance costs down the line, and the anticipated life of the system. Chairman Bartlett. Thank you. You have also identified four areas in the project management area where SBA shouldstrengthen its project management process and control, and I just wanted to go through those briefly to see how much time that was going to take, and would their ability to do these things impact the final schedule. The first of these was to include putting in place project tracking and oversight capabilities. Mr. Willemssen. Yes, project tracking and oversight are very important for a major effort like this. In the grand scheme of information technology government-wide this is not such a huge effort, but for SBA it is. It's the biggest one they've ever undertaken. The reason that these four are a little different than the other eight, is they transcend boundaries. These have more to do with key processes and controls that SBA needs to implement agency-wide. This is not something that like the eight actions before that we can point to and say, do it for this project. It's something that has to be implemented more from an agency- wide perspective. It's almost cultural, that when we have a major system effort like this, we are going to have project tracking and oversight activities. On all of these, not just project tracking and oversight, SBA is committed to the changes. But it does take time, and it's not something that you can say will be done at a certain point in time. They have to continue strengthening those processes. Chairman Bartlett. Was it your presumption that they would have done these four things when you gave us the time estimates for completing the first eight? Mr. Willemssen. It was our belief that these would be in the process of being implemented, but not fully mature. Fully mature information technology processes take a long time to implement, and most of the federal agencies are not there yet. To the extent that those processes and controls become more mature, you've reduced the risk of systems that don't work as you expected, and you reduce the risk that they go over budget. This is more of a agency-wide scope, it's a little bit broader than just the Loan Monitoring System. It's the way information technology should be done, not only the federal government, but all major organizations. This is followed predominantly on a model initially developed by the Software Engineering Institute out of Carnegie-Mellon. Chairman Bartlett. Thank you. Mr. Hochberg, let me read these four to see if you agree that these are things that need doing and that you are doing, and that it's your judgment that you are working with GAO to accomplish these goals. The first was putting in place project tracking and oversight capabilities. The second was implementing configuration management processes. The third was acquiring independent verification and validation for the Loan Monitoring System project and establishing an internal quality assurance function, and the fourth was addressing the security challenge posed by internet-based access to Loan Monitoring System functions and data. Mr. Hochberg. Mr. Chairman, it is my understanding and my sense, as the Deputy Administrator, I am not the Chief Information Officer, that all four of those are in place. I can particularly speak to two, and I can let Larry fill in some details. On the independent validation and verification, again, coming from the private sector, again, looking at how other agencies have tackled major systems projects, I wanted that IV & V to make sure that we don't stumble in the way that some other organizations have stumbled. In terms of security, this was a material weakness that was cited in the 1998 audit of the agency. The Administrator put into place, upon receiving that audit, immediate plans to upgrade the security of computer data, as well as internet security. We've brought in a contractor, and added a number of staff to specifically address that item. The other two I'm going to let Larry address, and certainly he may want to add to what I've just said. Mr. Barrett. As was indicated, this is going to be an ongoing effort, but we have taken significant steps, I think, to address project tracking and configuration management. A couple of things that we are doing is that we have provided our staff, internal staff, with formal training in both project management and configuration management, and we have been given the authority to hire additional people. One of the requirements and one of the things that we are looking for when we bring in new staff members is for people to bring in people with experience in these basic areas, so not only will we have people already on staff, but bringing in new people. In the interim what we are doing is hiring contractor support to mitigate any weaknesses that we have in both the project tracking area, as well as configuration management and quality assurance. As the Deputy Administrator indicated, we have a big effort underway in terms of Internet security, and just security in general within the agency. We started that over six months ago. The Administrator made a major commitment in terms of both resources and dollars to enhance our programming, and that's well under way. Chairman Bartlett. Thank you very much. I want to thank the witnesses very much for their testimony. This is a necessary oversight responsibility of the Congress. We are pleased with the progress that SBA has made in the roughly year and a half since our first hearing. We are pleased that SBA and GAO are working together. We are pleased that there is a general meeting of the minds as to what yet needs to be done and how long it will take to do that, and I promised that we would come back to look at an overall time. If things go reasonably well, Mr. Willemssen, you are saying it will be early-mid summer before we would be in a position to proceed with procurement? Mr. Willemssen. The caveat I would have is based on a comment that Larry made. If the agency does have additional documentation associated with system requirements that we haven't seen, that substantially address the issues we've laid out, then I would up my estimate further, but I haven't seen those documents. Chairman Bartlett. So, with what you've seen you are saying it's mid-summer? Mr. Willemssen. Then I'd say early summer. Chairman Bartlett. Early-mid summer. Mr. Hochberg, that's reasonable? Mr. Hochberg. It's reasonable to me. Chairman Bartlett. Mr. Hochberg is nodding in the affirmative that it's reasonable. Well, let me thank you very much, and if you need some action to release funds, GAO is not sure that those funds need to be released. Our staff is not sure they need to be released, but if in the judgment of the agency you do not have adequate funds and you need funds released, please substantiate that, document that, and get it to us, and also to GAO so that if there are necessary steps to be taken they can be taken, because we would like the control of these lending programs to be moved from the agency to the private sector. That cannot be finally accomplished and implemented until this is done, so we are anxious that it be done expeditiously. Let me thank all of the witnesses very much for your testimony, and we will keep surveillance of this program and there may need to be an additional hearing before the funds are finally released. Thank you very much. Mr. Hochberg. Thank you, Mr. Chairman. Chairman Bartlett. The meeting is in adjournment. Mr. Wilkinson. Thank you. Mr. Willemssen. Thank you. [Whereupon, at 11:29 p.m., the subcommittee was adjourned.] [GRAPHIC] [TIFF OMITTED] T5506A.001 [GRAPHIC] [TIFF OMITTED] T5506A.002 [GRAPHIC] [TIFF OMITTED] T5506A.003 [GRAPHIC] [TIFF OMITTED] T5506A.005 [GRAPHIC] [TIFF OMITTED] T5506A.006 [GRAPHIC] [TIFF OMITTED] T5506A.007 [GRAPHIC] [TIFF OMITTED] T5506A.008 [GRAPHIC] [TIFF OMITTED] T5506A.009 [GRAPHIC] [TIFF OMITTED] T5506A.010 [GRAPHIC] [TIFF OMITTED] T5506A.011 [GRAPHIC] [TIFF OMITTED] T5506A.012 [GRAPHIC] [TIFF OMITTED] T5506A.013 [GRAPHIC] [TIFF OMITTED] T5506A.014 [GRAPHIC] [TIFF OMITTED] T5506A.015 [GRAPHIC] [TIFF OMITTED] T5506A.016 [GRAPHIC] [TIFF OMITTED] T5506A.017 [GRAPHIC] [TIFF OMITTED] T5506A.018 [GRAPHIC] [TIFF OMITTED] T5506A.019 [GRAPHIC] [TIFF OMITTED] T5506A.020 [GRAPHIC] [TIFF OMITTED] T5506A.021 [GRAPHIC] [TIFF OMITTED] T5506A.022 [GRAPHIC] [TIFF OMITTED] T5506A.023 [GRAPHIC] [TIFF OMITTED] T5506A.024 [GRAPHIC] [TIFF OMITTED] T5506A.025 [GRAPHIC] [TIFF OMITTED] T5506A.026 [GRAPHIC] [TIFF OMITTED] T5506A.027 [GRAPHIC] [TIFF OMITTED] T5506A.028 [GRAPHIC] [TIFF OMITTED] T5506A.029 [GRAPHIC] [TIFF OMITTED] T5506A.030 [GRAPHIC] [TIFF OMITTED] T5506A.031 [GRAPHIC] [TIFF OMITTED] T5506A.032 [GRAPHIC] [TIFF OMITTED] T5506A.033 [GRAPHIC] [TIFF OMITTED] T5506A.034 [GRAPHIC] [TIFF OMITTED] T5506A.035 [GRAPHIC] [TIFF OMITTED] T5506A.036 [GRAPHIC] [TIFF OMITTED] T5506A.037 [GRAPHIC] [TIFF OMITTED] T5506A.038 [GRAPHIC] [TIFF OMITTED] T5506A.039 [GRAPHIC] [TIFF OMITTED] T5506A.040 [GRAPHIC] [TIFF OMITTED] T5506A.041 [GRAPHIC] [TIFF OMITTED] T5506A.042 [GRAPHIC] [TIFF OMITTED] T5506A.043 [GRAPHIC] [TIFF OMITTED] T5506A.044 [GRAPHIC] [TIFF OMITTED] T5506A.045 [GRAPHIC] [TIFF OMITTED] T5506A.046 [GRAPHIC] [TIFF OMITTED] T5506A.047 [GRAPHIC] [TIFF OMITTED] T5506A.048 [GRAPHIC] [TIFF OMITTED] T5506A.049 [GRAPHIC] [TIFF OMITTED] T5506A.050 [GRAPHIC] [TIFF OMITTED] T5506A.051 [GRAPHIC] [TIFF OMITTED] T5506A.052 [GRAPHIC] [TIFF OMITTED] T5506A.053 [GRAPHIC] [TIFF OMITTED] T5506A.054 [GRAPHIC] [TIFF OMITTED] T5506A.055 [GRAPHIC] [TIFF OMITTED] T5506A.056 [GRAPHIC] [TIFF OMITTED] T5506A.057 [GRAPHIC] [TIFF OMITTED] T5506A.058 [GRAPHIC] [TIFF OMITTED] T5506A.059 [GRAPHIC] [TIFF OMITTED] T5506A.060 [GRAPHIC] [TIFF OMITTED] T5506A.061