What GAO Found
As GAO reported in September 2015, the Small Business Administration (SBA) has not resolved many of its long-standing management challenges due to a lack of sustained priority attention over time. Frequent turnover of political leadership in the federal government, including at SBA, has often made sustaining attention to needed changes difficult (see figure below). Senior SBA leaders have not prioritized long-term organizational transformation in areas such as human capital and information technology (IT). For example, at a 2013 hearing on SBA's budget, the committee Chairman stated that SBA's proposed budget focused on the agency's priorities but ignored some long-standing management deficits. This raises questions about SBA's sustained commitment to addressing management challenges that could keep it from effectively assisting small businesses.
Turnover in Senior-Level Positions at SBA, 2005 through 2015
Many of the management challenges that GAO and the SBA Office of Inspector General (OIG) have identified over the years remain, including some related to program implementation and oversight, contracting, human capital, and IT. SBA has generally agreed with prior GAO recommendations that were designed to address these issues and other challenges related to the lack of program evaluations. The agency had made limited progress in addressing most of these recommendations but had recently begun taking some steps. A senior SBA official told GAO that improving human capital management, IT, and the 8(a) program (a business development program) were priorities for the current administrator. For example, he stated that SBA was exploring creative ways to recruit staff and plans to expand SBA One—a database currently used to process loan applications—to include the 8(a) program. Also, SBA had begun addressing some internal control weaknesses that GAO and the SBA OIG identified as contributing to the agency's management challenges. SBA officials noted that the agency had begun to update its standard operating procedure (SOP) on internal controls and planned more revisions after the Office of Management and Budget (OMB) updated its Circular A-123, which is expected to include guidance on implementing GAO's 2014 revisions to federal internal control standards. OMB issued a draft of the revised circular in June 2015 and as of September 2015 was reviewing comments it received.
In September 2015, GAO maintained that 69 recommendations it made in prior work continued to have merit and should be fully implemented. As of December 2015, SBA had implemented 7 of these recommendations, including those pertaining to disaster assistance and Small Business Innovation Research. For example, SBA revised its planning documents to adjust staffing and resources available for future disasters by considering the potential effect of early application submissions for disaster loans as GAO recommended. Such action should help improve the agency's timely response to disasters. In addition, SBA had initiated actions in response to the eight new GAO recommendations. For example, SBA officials told GAO that the agency had established an Economic Impact Evaluation Working Group, which was developing evaluation plans for several program offices.
|
GAO identified management areas in which SBA had not incorporated key principles or made other improvements, including:
|
-
Strategic planning and program evaluation: The strategic planning activities that GAO reviewed met most federal requirements. But SBA did not describe how it used results from the few program evaluations it had completed to help develop its current strategic plan, as required by the GPRA Modernization Act of 2010. OMB has encouraged agencies to increase their use of program evaluations, but SBA has not routinely conducted them and still lacks evaluations for 10 of 19 programs GAO reported on in 2012. Without evaluations, SBA lacks critical information for ensuring the validity and effectiveness of (1) its goals, objectives, and strategies; and (2) both new and existing programs.
-
Human capital management: SBA improved its human capital plan by developing goals and objectives. SBA also conducted early retirement programs in fiscal years 2012 and 2014 to begin addressing long-standing skill imbalances, but fewer people than expected retired. SBA risked compromising these efforts because it did not first conduct a skills assessment or develop a workforce plan that would allow it to target its hiring and retention efforts. As of December 2015, SBA had not yet developed a workforce plan and had not conducted a skills assessment or determined training goals. As a result, SBA cannot provide reasonable assurance that its workforce has the skills the agency requires.
-
Organizational structure: SBA’s organizational structure has created complex overlapping relationships among offices that have contributed to challenges in program oversight. Although SBA recently completed an assessment of its organizational structure and determined that major restructuring was not warranted at that time, it has not documented this effort. Until SBA documents its assessment, it will not have an institutional record of its actions, and it will be difficult for SBA or a third party to validate that SBA’s current organizational structure is contributing effectively to its mission objectives and programmatic goals.
|
-
Enterprise risk management: Given the range of programs SBA manages and oversees, having a robust enterprise risk management (ERM) system is critical to effectively managing risks. SBA initiated efforts to implement ERM in 2009 and developed a framework to guide its ERM approach in 2012. But the agency has not incorporated some elements of a risk management framework, such as goals and specific actions. Without incorporating these elements, SBA cannot reasonably ensure that its ERM efforts fully identify, assess, and manage risks.
-
Procedural guidance: As of March 2015, SBA had determined that 74 of its 165 SOPs needed to be revised, 31 needed to be canceled, and 60 required no revision. An additional 9 needed to be issued. Federal internal control standards state that documentation must be properly managed and maintained, yet SBA has generally not set time frames for periodically reviewing and completing needed revisions or updates. Without such time frames, SBA staff and their partners may lack the guidance they need to effectively deliver program services in accordance with laws and regulations.
-
Information technology: SBA had not implemented more than 30 SBA OIG recommendations related to IT security but has recently increased its emphasis on improvements, according to a senior official. Further, SBA had only partially implemented several required IT management initiatives. For instance, SBA established policies to consolidate the number of its data centers and manage software licenses for IT investments. However, contrary to OMB guidance SBA had not conducted regular reviews of its operational IT investments to ensure that they continue to meet agency needs. Until SBA fully implements all of the required IT management initiatives, the agency cannot provide reasonable assurance that its IT investments are cost-effective, meet agency goals, or are effectively managed.
|
Why GAO Did This Study
SBA has provided billions of dollars in loans and guarantees to small businesses. GAO has previously reported on management challenges at SBA. In this testimony, which is based on a September 2015 report (GAO-15-347) and related updates on the status of recommendations, GAO discusses (1) the extent to which SBA has addressed previously identified management challenges; and (2) SBA’s management of its strategic planning, human capital, organizational structure, enterprise risk, procedural guidance, and IT. To conduct this work, GAO reviewed prior GAO and SBA Office of Inspector General reports on SBA programs, examined relevant SBA documents, and interviewed agency officials.
What GAO Recommends
In its September 2015 report, GAO made eight recommendations designed to improve SBA’s program evaluations, strategic and workforce planning, training, organizational structure, enterprise risk management, procedural guidance, and oversight of IT investments. SBA generally agreed with these recommendations and provided additional information about its recent efforts to complete its organizational assessment. In response, GAO clarified its recommendation that SBA document its assessment, including the results and any planned organizational changes. GAO also maintains that 62 recommendations it made in prior reports still have merit and should be fully implemented.
For more information, contact William Shear at (202) 512-8678 or shearw@gao.gov.
