As a result, SBA suspended the  loan monitoring system development effort. A credit risk loan and lender monitoring  system—based on industry best practices for infrastructure,  methodologies, and policies—would be an effective way to address credit  risk in the SBA portfolio and to facilitate the oversight of SBA’s lending  partners. Based on our assessment of best practices and our understanding of SBA’s  oversight and programmatic responsibilities, SBA needs a credit risk loan  and lender monitoring service that will enable the agency to efficiently and  effectively analyze various aspects of its overall portfolio, its individual  lenders, and their portfolios. According to the statement of work prepared by FEDSIM,  SBA wanted a loan monitoring capability that would apply monitoring and  evaluation services to existing loan data, apply industry standards and best  practices for loan and lender monitoring, and enable SBA to identify high- risk lenders. The Dun & Bradstreet Loan Monitoring Service Appears to Provide Appropriate Infrastructure and Methodologies, but SBA’s Lack of Comprehensive Policies Could Hamper Effective Oversight

Combined with appropriate SBA policies, the Dun & Bradstreet service  could enable the agency to conduct the type of monitoring and analyses  typical among major lenders and recommended by financial regulators. Although SBA has  obtained a useful service, it does not yet have comprehensive policies on  par with industry best practices to support the loan monitoring service. Comprehensive policies  based on best practices would enable the agency to effectively carry out its  public mission, especially regarding its need to address any findings of  noncompliance with enforcement actions. SBA’s Mission and Loan Program Structure Would Affect Its Use of Credit Risk Management Tools

SBA, similar to private lenders, must determine the level of risk it will  tolerate but do so within the context of the public purposes of its loan  guarantee programs, their budget constraints, and their structures. Nevertheless, many private sector risk management best practices are  relevant to SBA. SBA’s Mission and Loan Guarantee Program Structure Would Affect How SBA Uses the New Loan Monitoring Capability

Although SBA, similar to private lenders, must determine the level of risks  it will tolerate in the loans it guarantees, its mission obligations will drive  its credit risk management policies. For example, different loan products in  the 7(a) program have different levels of guarantees, and guarantees on 504  program loans have a different structure from 7(a) guarantees. These  differences influence the mix of loans in SBA’s portfolio and, consequently,  would impact how SBA manages its credit risk. The structures of SBA’s loan guarantee programs may also account for  some of the differences in risk management policies and practices between  SBA and major lenders. This lender-level emphasis contrasts with how  major private sector lenders manage credit risk, which is at the loan level. Because SBA relies on private lenders to originate and service the majority  of the loans it guarantees, SBA is primarily managing the credit risk in its  portfolio at the lender level. In the event that the Dun & Bradstreet contract  is discontinued, SBA would not have the capability on its own to duplicate  the loan monitoring service provided by Dun & Bradstreet. However, SBA does not have a formal  contingency plan in place.
Why GAO Did This Study

The Small Business Administration (SBA) has been challenged in the past in developing a lender oversight capability and a loan monitoring system to facilitate its oversight. While SBA has made progress in its lender oversight program, its past efforts to develop a loan monitoring system were unsuccessful. In 2003, SBA obtained loan monitoring services from Dun & Bradstreet. GAO evaluated SBA's loan monitoring needs, how well those needs are met by the new service, and the similarities and differences for the purposes of credit risk management between SBA and private sector best practices.

What GAO Found

Largely because SBA relies on lenders to make the loans it guarantees, the agency needs a loan and lender monitoring capability that will enable it to efficiently and effectively analyze its overall portfolio of loans, its individual lenders, and their portfolios of loans. SBA, along with Dun & Bradstreet, essentially identified these same needs as they obtained the loan monitoring service. In addition, they identified the importance of applying industry standards and best practices for loan and lender monitoring and the need to identify high-risk lenders. Based on our assessment of best practices, SBA's credit risk management efforts need to include a comprehensive infrastructure, appropriate methodologies, and policies. The loan monitoring service could enable SBA to conduct the type of monitoring and analyses typical of best practices among banks and recommended by financial institution regulators, if SBA develops and implements appropriate policies. SBA's newly obtained service provides a credit risk management infrastructure and methodology that appear to be on par with those of many private sector lenders. For example, the database affords analytical capabilities based on common financial models that are used by major financial institutions. Although SBA obtained a useful service, it does not have comprehensive policies needed to implement best practices and address its needs as an agency with a public mission, especially regarding its need to use enforcement actions to address noncompliance. In addition, SBA does not have a contingency plan in the event the Dun & Bradstreet service is discontinued. SBA, similar to private lenders, must determine the level of risk it will tolerate, but it must do so within the context of its mission and its programs' structures, which may consequently translate into different uses of its Dun & Bradstreet loan monitoring service. Since SBA is a public agency with a public mission, its mission obligations will drive its credit risk management policies. For example, different loan products in the 7(a) program have different levels of guarantees, and guarantees on 504 program loans have a different structure from 7(a) guarantees. These differences influence the mix of loans in SBA's portfolio and, consequently, would impact how SBA manages its credit risk. Furthermore, the structure of SBA's loan guarantee programs may also result in different credit risk management policies between SBA and major lenders. Private sector lenders manage credit risk at the loan level and the portfolio level. Since SBA relies on private lenders to originate and service the majority of the loans it guarantees, it also needs to manage the credit risk in its portfolio at the lender level.