Internal Controls at SBA

1
Internal Controls at SBA

• Jennifer Main
• Chief Financial Officer, SBA
• March 10, 2006
• jennifer.main_at_sba.gov

2
Agenda

• Brief background on SBA
• Internal control weaknesses that led to
  disclaimed audit opinion
• Resolution strategy and results
• A-123 implementation approach

3
Overview of SBA

• SBA is one of the smallest of the 24 CFO Act
  agencies
• 2,100 regular employees and about 4,000 temporary
  disaster employees currently
• SBAs direct loan and loan guarantee portfolios
  of about 66 billion make up vast majority of
  balance sheet
• In 2002, our auditor withdrew prior unqualified
  opinion and issued a disclaimer
• In 2005 we regained our unqualified opinion but
  still have one material weakness (financial
  reporting)

4
Re-establishing Internal Control

• Internal control weaknesses led to FY02
  disclaimed audit opinion
• Challenges across the spectrum
• Control Environment
• Risk Assessment
• Control Activities
• Information Communications
• Monitoring

5
Examples of Weaknesses

• 3 conflicting valuation methods for asset sales
  2 developed by same team
• None were right
• Off by 2 billion
• Cash shortfall in loan guarantee financing
  account 50 million overdraw
• No regular tracking or review of cash or
  obligations position in credit accounts
• No internal support across offices those are
  their numbers, not ours

6
How Did It Happen?

• Poor communication across offices budget,
  subsidy modeling, and accounting
• Communication weak within offices between staff
  senior OCFO management
• Culture focused on providing management with
  numbers to support its agenda
• Dissenting views not welcomed
• No focus on internal controls within OCFO

7
Strategy for Resolution

• Change the culture
• Reset expectations focus on core financial
  management
• It is what it is became our mantra
• Facilitate communication and hold people
  accountable

8
Communication Accountability

• Create accountability through communication
• Established two OCFO teams
• Loan team
• Admin team
• Meet bi-weekly
• Key staff from all offices are members of the
  teams
• Annual work plans staff recommendations of
  critical issues plus audit findings

9
Results from Team Approach

• Sub-teams resolved agreed upon issues (audit
  remediation and others)
• Created new reports funds availability, credit
  program cash flows
• Risk assessment process part of yearly planning
• Updated documentation of critical processes
• Continual feedback and assessment through regular
  team meetings
• Met 11/15 deadline in FY04
• Earned unqualified opinion in FY05

10
Credit Programs

• Special initiative to establish internal controls
  for credit subsidy models
• Checklist for compliance with requirements
• Change control compliance process with 3 levels
  of sign-offs, internal review external review
• Documentation of models assumptions
• Detailed reconciliations with accounting data
• Updated procedures for whole area
• Elimination of material weakness in FY05

11
Keys to SBAs A-123 Approach

• Leverage existing efforts dont reinvent
• Using auditor cycle memos as starting point
• Examples existing improper payment testing,
  external reviews of credit cost models
• Be pragmatic aggressive but realistic about
  first year
• Pick a few key things in each area and
  concentrate on them
• Use initiative to expand Agency managers view of
  themselves as financial managers
• Two-pronged approach
• Traditional account risk analysis
• Program office driven risk assessments

12
Organizational Issues

• OCFO hired a contractor to support the effort
• Established a Senior Assessment Team (SAT) in
  8/05
• Insufficient resources to do internally
• Little redundancy in operations staff after years
  of downsizing
• Hard to staff independent office within OCFO
  insufficient knowledge to do credible job
• Contractor to support testing at least first year
• Currently hiring 1 person to help lead effort

13
Determining Scope of Project

• Including all basic financial reports first year
• 2 additional daily loan guarantee volume
  report loan guarantee status report
• Materiality baseline of 0.75 threshold
• SAT will consider whether lower threshold is
  appropriate e.g. daily loan volume report where
  tolerance is zero
• Risk assessments generate lists of areas to
  review prioritizing this year vs. next year

14
Determining Scope of Project

• Focus is on known problem areas including IG and
  auditor identified issues e.g. SBA lender
  reporting initiative
• Criteria for prioritizing include
• how much money is involved
• inherent riskiness or complexity of the
  transactions
• evidence of existing problems
• program office level of concern and focus

15
Example of Scope

• Secondary Market
• Need updated SOP (9/30/06 target)
• Fiscal Transfer Agent (FTA) contract all
  issues in FY03 IG report in resolved? (review)
• Is data from FTA for subsidy modeling complete
  and accurate?
• Timing of SBAs purchases out of the pools is
  the process working effectively?
• Purchase/Liquidations
• Improper payments in purchase area (review)
• Is SBA getting the appropriate share of
  liquidation proceeds? Are expenses charged by
  lenders appropriate?
• Charge offs are they being completed in a
  timely manner? (review and test)
• Valuation of receivables are they accurate?
  (review, maybe test)

• Origination
• Eligibility
• Guaranty fee receipt timely correct amount?
• Approvals valid undelivered orders? (testing)
• Approval data good quality and sufficient?
• Servicing
• Annual fees receipt timely and correct?
• Loan guaranty status data submitted through 1502
  reporting process is the information accurate
  (additional review and testing)
• Prepayment penalties timely and correct?
• Post-approval loan amount and term changes do
  they flow through all systems accurately?

16
Making it Relevant to Managers

• Two pronged approach includes having accounting
  team conduct Account Risk Analyses while program
  managers identify critical processes through risk
  assessments
• Combining quantitative and qualitative approaches
  ensures good coverage of all potential risks
• Having managers participate in risk assessment
  increases their sense of ownership and
  responsibility
• Provides a good opportunity for training about
  risk management and internal controls which is
  necessary for ultimately changing the culture

17
Testing Plan Assurance Statement

• We plan to test all key controls this year to
  establish a baseline
• In future years, testing can be modified to
  address higher risk areas as determined by the
  baseline assessment
• As appropriate based on our findings, we will be
  reporting the results in the PAR and including
  our plans for correcting weaknesses identified

18
Progress to Date Challenges

• Lack of time by knowledgeable staff is biggest
  challenge OCFO team and program office staff
• Fear of the unknown weve never looked under
  that rock before!
• Hurricane Katrina impact unanticipated
  activities
• Keeping up the momentum is the hardest part

19
Progress to Date Opportunities

• Generally more positive reception than
  anticipated from program managers around the
  Agency
• Entity-wide assessment particularly colorful and
  thought provoking
• SAT members interested in using this to leverage
  activity on difficult problems
• Helped to offer program offices consulting
  resources to help with risk assessments,
  documentation, etc.