Internal Controls at SBA Jennifer Main Chief Financial

Internal Controls at SBA Jennifer Main Chief Financial Officer, SBA March 10, 2006 jennifer. main@sba. gov

Agenda Ø Brief background on SBA Ø Internal control weaknesses that led to disclaimed audit opinion Ø Resolution strategy and results Ø A-123 implementation approach

Overview of SBA Ø Ø Ø SBA is one of the smallest of the 24 CFO Act agencies 2, 100 regular employees and about 4, 000 temporary disaster employees currently SBA’s direct loan and loan guarantee portfolios of about $66 billion make up vast majority of balance sheet In 2002, our auditor withdrew prior unqualified opinion and issued a disclaimer In 2005 we regained our unqualified opinion but still have one material weakness (financial reporting)

Re-establishing Internal Control Ø Internal control weaknesses led to FY 02 disclaimed audit opinion Ø Challenges across the spectrum: l l l Control Environment Risk Assessment Control Activities Information & Communications Monitoring

Examples of Weaknesses Ø 3 conflicting valuation methods for asset sales – 2 developed by same team l l None were right Off by $2 billion Ø Cash shortfall in loan guarantee financing account – $50 million overdraw Ø No regular tracking or review of cash or obligations position in credit accounts Ø No internal support across offices – “those are their numbers, not ours…”

How Did It Happen? Ø Poor communication across offices – budget, subsidy modeling, and accounting Ø Communication weak within offices & between staff & senior OCFO management Ø Culture focused on providing management with numbers to support its agenda Ø Dissenting views not welcomed Ø No focus on internal controls within OCFO

Strategy for Resolution Ø Change the culture Reset expectations – focus on core financial management l “It is what it is” became our mantra l Facilitate communication and hold people accountable l

Communication & Accountability Ø Create accountability through communication Ø Established two OCFO teams l l l Loan team Admin team Meet bi-weekly Ø Key staff from all offices are members of the teams Ø Annual work plans – staff recommendations of critical issues plus audit findings

Results from Team Approach Sub-teams resolved agreed upon issues (audit remediation and others) Ø Created new reports – funds availability, credit program cash flows Ø Risk assessment process part of yearly planning Ø Updated documentation of critical processes Ø Continual feedback and assessment through regular team meetings Ø Met 11/15 deadline in FY 04 Ø Earned unqualified opinion in FY 05 Ø

Credit Programs Ø Special initiative to establish internal controls for credit subsidy models Ø Checklist for compliance with requirements Ø Change control & compliance process with 3 levels of sign-offs, internal review & external review Ø Documentation of models & assumptions Ø Detailed reconciliations with accounting data Ø Updated procedures for whole area Ø Elimination of material weakness in FY 05

Keys to SBA’s A-123 Approach Ø Leverage existing efforts; don’t reinvent l l Ø Using auditor cycle memos as starting point Examples – existing improper payment testing, external reviews of credit cost models Be pragmatic – aggressive but realistic about first year l Pick a few key things in each area and concentrate on them Use initiative to expand Agency managers’ view of themselves as “financial managers” Ø Two-pronged approach: Ø l l Traditional account risk analysis Program office driven risk assessments

Organizational Issues Ø OCFO hired a contractor to support the effort Ø Established a Senior Assessment Team (SAT) in 8/05 Ø Insufficient resources to do internally Ø Little redundancy in operations staff after years of downsizing Ø Hard to staff independent office within OCFO – insufficient knowledge to do credible job Ø Contractor to support testing at least first year Ø Currently hiring 1 person to help lead effort

Determining Scope of Project Including all basic financial reports first year Ø 2 additional – daily loan guarantee volume report & loan guarantee status report Ø Materiality – baseline of 0. 75% threshold Ø SAT will consider whether lower threshold is appropriate – e. g. daily loan volume report where tolerance is zero Ø Risk assessments generate lists of areas to review – prioritizing this year vs. next year Ø

Determining Scope of Project Ø Focus is on known problem areas including IG and auditor identified issues – e. g. SBA lender reporting initiative Ø Criteria for prioritizing include: l l how much money is involved inherent riskiness or complexity of the transactions evidence of existing problems program office level of concern and focus

Example of Scope Origination Ø Eligibility Ø Guaranty fee receipt – timely correct amount? Ø Approvals – valid undelivered orders? (testing) Ø Approval data – good quality and sufficient? Servicing Ø Annual fees – receipt timely and correct? Ø Loan guaranty status data submitted through 1502 reporting process – is the information accurate (additional review and testing) Ø Prepayment penalties – timely and correct? Ø Post-approval loan amount and term changes – do they flow through all systems accurately? Secondary Market Ø Need updated SOP (9/30/06 target) Ø Fiscal & Transfer Agent (FTA) contract – all issues in FY 03 IG report in resolved? (review) Ø Is data from FTA for subsidy modeling complete and accurate? Ø Timing of SBA’s purchases out of the pools – is the process working effectively? Purchase/Liquidations Ø Improper payments in purchase area (review) Ø Is SBA getting the appropriate share of liquidation proceeds? Are expenses charged by lenders appropriate? Ø Charge offs – are they being completed in a timely manner? (review and test) Ø Valuation of receivables – are they accurate? (review, maybe test)

Making it Relevant to Managers Two pronged approach includes having accounting team conduct Account Risk Analyses while program managers identify critical processes through risk assessments Ø Combining quantitative and qualitative approaches ensures good coverage of all potential risks Ø Having managers participate in risk assessment increases their sense of ownership and responsibility Ø Provides a good opportunity for training about risk management and internal controls which is necessary for ultimately changing the culture Ø

Testing Plan & Assurance Statement Ø We plan to test all key controls this year to establish a baseline Ø In future years, testing can be modified to address higher risk areas as determined by the baseline assessment Ø As appropriate based on our findings, we will be reporting the results in the PAR and including our plans for correcting weaknesses identified

Progress to Date: Challenges Ø Lack of time by knowledgeable staff is biggest challenge – OCFO team and program office staff Ø Fear of the unknown – we’ve never looked under that rock before! Ø Hurricane Katrina impact – unanticipated activities Ø Keeping up the momentum is the hardest part

Progress to Date: Opportunities Ø Generally more positive reception than anticipated from program managers around the Agency Ø Entity-wide assessment particularly colorful and thought provoking Ø SAT members interested in using this to leverage activity on difficult problems Ø Helped to offer program offices consulting resources to help with risk assessments, documentation, etc.