Small Business Administration: Leadership Attention Needed to Overcome Management Challenges

GAO identified management areas in which SBA had not incorporated key principles or made other improvements, including:

• Strategic planning and program evaluation: The strategic planning activities that GAO reviewed met most federal requirements. But SBA did not describe how it used results from the few program evaluations it had completed to help develop its current strategic plan, as required by the GPRA Modernization Act of 2010. OMB has encouraged agencies to increase their use of program evaluations, but SBA has not routinely conducted them and still lacks evaluations for 10 of 19 programs GAO reported on in 2012. Without evaluations, SBA lacks critical information for ensuring the validity and effectiveness of (1) its goals, objectives, and strategies; and (2) both new and existing programs.
   
• Human capital management: SBA improved its human capital plan by developing goals and objectives. SBA also conducted early retirement programs in fiscal years 2012 and 2014 to begin addressing long-standing skill imbalances, but fewer people than expected retired. SBA risked compromising these efforts because it did not first conduct a skills assessment or develop a workforce plan that would allow it to target its hiring and retention efforts. As of December 2015, SBA had not yet developed a workforce plan and had not conducted a skills assessment or determined training goals. As a result, SBA cannot provide reasonable assurance that its workforce has the skills the agency requires.
   
• Organizational structure: SBA’s organizational structure has created complex overlapping relationships among offices that have contributed to challenges in program oversight. Although SBA recently completed an assessment of its organizational structure and determined that major restructuring was not warranted at that time, it has not documented this effort. Until SBA documents its assessment, it will not have an institutional record of its actions, and it will be difficult for SBA or a third party to validate that SBA’s current organizational structure is contributing effectively to its mission objectives and programmatic goals.

• Enterprise risk management: Given the range of programs SBA manages and oversees, having a robust enterprise risk management (ERM) system is critical to effectively managing risks. SBA initiated efforts to implement ERM in 2009 and developed a framework to guide its ERM approach in 2012. But the agency has not incorporated some elements of a risk management framework, such as goals and specific actions. Without incorporating these elements, SBA cannot reasonably ensure that its ERM efforts fully identify, assess, and manage risks.
   
• Procedural guidance: As of March 2015, SBA had determined that 74 of its 165 SOPs needed to be revised, 31 needed to be canceled, and 60 required no revision. An additional 9 needed to be issued. Federal internal control standards state that documentation must be properly managed and maintained, yet SBA has generally not set time frames for periodically reviewing and completing needed revisions or updates. Without such time frames, SBA staff and their partners may lack the guidance they need to effectively deliver program services in accordance with laws and regulations.
   
• Information technology: SBA had not implemented more than 30 SBA OIG recommendations related to IT security but has recently increased its emphasis on improvements, according to a senior official. Further, SBA had only partially implemented several required IT management initiatives. For instance, SBA established policies to consolidate the number of its data centers and manage software licenses for IT investments. However, contrary to OMB guidance SBA had not conducted regular reviews of its operational IT investments to ensure that they continue to meet agency needs. Until SBA fully implements all of the required IT management initiatives, the agency cannot provide reasonable assurance that its IT investments are cost-effective, meet agency goals, or are effectively managed.