OIG Final Report 22-16 SBA’s COVID-19 EIDL Program Data Migration Challenges

Summary

Small Business Administration Office of Inspector General memorandum, Report 22-16, SBA's COVID-19 EIDL Program Data Migration Challenges, dated July 19, 2022 and sent by Inspector General Hannibal "Mike" Ware to Administrator Isabella Casillas Guzman. The OIG found in February 2022 that SBA had been moving COVID-19 Economic Injury Disaster Loan data from its software-as-a-service provider into its own data warehouse since December 2021 without a data migration plan, ahead of the contract's June 30, 2022 end, after which the provider would destroy the data. SBA finalized a migration plan on April 27, 2022, but it lacked user acceptance testing and criteria to confirm the data was complete and usable, and SBA relied on contractor row counts. The OIG says SBA must ensure usable data to service and oversee the $385 billion in COVID-19 EIDL loan and grant files.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Office of Inspector General
U.S. Small Business Administration
MEMORANDUM

1
DATE:
July 19, 2022
TO:

Isabella Casillas Guzman
Administrator
FROM:
Hannibal “Mike” Ware
Inspector General
SUBJECT:
SBA’s COVID-19 EIDL Program Data Migration Challenges, Report 22-16
As the U.S. Small Business Administration (SBA) shifts its focus from processing
applications to servicing and overseeing Coronavirus Disease 2019 (COVID-19) Economic
Injury Disaster Loans (EIDL) and Targeted EIDL Advances, SBA is migrating data from its
“software as a service” provider to its own data warehouse and systems. This service
provider is an outside company contracted to provide cloud-based software solutions.
In February 2022, the Office of Inspector General (OIG) found that SBA had been migrating
data from its software provider into SBA’s custody since December 2021 without a data
migration plan. This was an issue we found in 2019 when SBA migrated data to cloud
platforms. We issued a report on SBA’s need to improve its oversight of controls over data
management regarding portability, interoperability, and documentation of service-level
requirements with contractors so that data is efficiently transferred from contractors’
systems.1
Although SBA updated its policies as a result of our 2019 review, management did not
follow the policies when it began migrating COVID-19 EIDL program data from the service
provider’s cloud platform to SBA’s data warehouse. Without advanced planning for data
migration and defined acceptance criteria, SBA took reactive measures to prevent the loss
of vital program data when the contract ended on June 30, 2022. On April 27, 2022, SBA
finalized its migration plan; however, the plan did not provide a user acceptance testing
plan and sufficient detail to ensure the data would migrate completely and be fully usable.
SBA must continue to take action to ensure it has accurate, available, and usable data to
monitor, service, and oversee the $385 billion COVID-19 EIDL loan and grant files. In
addition to SBA’s responsibilities for managing the program, this information is critical for
OIG and other oversight agencies to conduct independent audits and investigations for
fraud, waste, and abuse of SBA programs.

1 SBA OIG Report 19-10, SBA’s Cloud Migration and Oversight (April 9, 2019).

2
Background
To aid small businesses adversely affected by the COVID-19 pandemic, Congress
substantially increased SBA’s loan and grant making authority. SBA approved $385 billion
as of April 28, 2022 in COVID-19 EIDLs and EIDL advances to eligible small businesses
adversely affected by the pandemic. SBA stopped accepting applications for new COVID-19
EIDLs on December 31, 2021 and accepted requests for increases, reconsiderations, and
appeals through May 6, 2022.
COVID-19 EIDLs are made directly by SBA through a contracted service provider that
received, reviewed, and made recommendations for SBA’s final loan decision. SBA
contracted with a service provider through June 30, 2022 as a short-term solution to
disburse loan and grant funds quickly to meet the unprecedented need.
COVID-19 EIDL programs will continue to require SBA to manage and monitor the loans, as
well as maintain records for many years to come. EIDLs are 30-year loans with a 2.5-year
deferment period. Payments will be due monthly over the remaining 27.5 years. SBA is
required to maintain records for COVID-19 EIDLS for 6 years and 3 months after maturity
of the loan. The same record retention timeline is required for COVID-19 EIDL advances
after the date of disbursement. As such, SBA needs to plan accordingly to maintain all EIDL
data in order to effectively service these long-term loans.
COVID-19 EIDL Data Migration Challenges
In our initial February 2022 data retention discussions, SBA did not have a documented
data migration plan for the COVID-19 EIDLs and advances. Because the agency did not have
a plan in advance, agency officials were reactionary in their approach to transferring the
data from the service provider prior to the contract ending June 30, 2022. Specifically, data
users alerted program officials of missing data elements that were overlooked, causing
program officials responsible for the migration effort to hastily develop solutions before
the contractor destroyed the data. These needs could have been better anticipated if
program officials engaged with users earlier in the process. Also, program officials relied on
data testing that was carried out on an ad hoc and limited basis because they did not define
acceptance criteria for what would be considered accurate, complete, and usable data.
SBA is required to make and preserve records containing documentation of decisions and
essential transactions made by the agency. Additionally, the agency must design the
records to provide information necessary to protect the legal and financial rights of the
federal government and persons directly affected by the agency’s activities.2 SBA relied on
the service provider platform to process the unprecedented volume of loan and grant
applications from COVID-19 EIDL relief programs. The agency did not plan to use the
service provider platform for continued support after initial disbursements. Therefore, the
data would have needed to be transferred to another SBA system upon completion of the
contract. SBA, however, did not proactively develop a documented data migration plan to
ensure the COVID-19 EIDL data would be usable and accessible after transferring to SBA’s

2 44 USC 3101 – Records management by agency heads; general duties.

3
data warehouse. A migration plan is an essential first step to effectively manage the
transfer of program data from a contractor’s system.
SBA’s contract with the service provider stipulates it will provide all data and audit logs to
SBA in a format that is readable and usable. Once SBA has successfully accepted the data
and notified the service provider, the service provider will destroy and permanently
eliminate any data received and created for this program. Thorough testing is important to
prove that the data is received in full and usable prior to SBA signing off on acceptance of
the data.
We alerted program management of the need to prepare a migration plan, which SBA took
action to develop and finalized in April 2022. However, the plan was still missing usability
acceptance criteria, which is necessary to confirm the data fully transferred and is usable in
the new system. SBA still needs to identify what the agreed acceptance criteria is within the
data migration plan. Once identified, the sufficiency of this testing can be assessed and the
“definition of done” will be known.
SBA’s System Development Methodology provides a framework for planning, managing, and
overseeing SBA’s information technology projects throughout the various stages of a
project lifecycle.3 Although compliance requirements can be scaled to meet complexities
unique to each system project, there is an overarching principle to establish, validate, and
verify data based on acceptance criteria so that deliverables from the system are what SBA
expected. Further, it is an industry best practice to run usability tests frequently to ensure
the final output meets expectations.4 The System Development Methodology emphasizes the
service provider and SBA must agree on acceptance criteria and what the “definition of
done” for deliverables should be – specifically, the deliverable is the data from the retiring
system.
SBA chose to rely on row counts provided by the contractor as a general way of reconciling
the data transfer. This exercise may address acceptance testing for the volume of data, but
not for the usability of data. We informed program officials about the importance of having
usability testing, which SBA promptly added to the May 3, 2022 migration plan. Although
SBA responded quickly to identify usability testing that would be completed, SBA did not
identify what the agreed acceptance criteria were within the data migration plan. As a
result, the sufficiency of this testing cannot be assessed because the “definition of done” is
not known. Without defined criteria, SBA cannot assure it has taken adequate steps to
preserve the COVID-19 EIDL data. SBA runs the risk that it may not detect if the data is
incomplete or unusable until after the contractor destroys the original data at the
conclusion of the contract.

3 SBA System Development Methodology published on SBA SharePoint, signed March 7, 2018. This version is not finalized
and is part of open recommendations identified in SBA OIG Report 20-17, Evaluation of Certify.SBA.gov (July 30, 2020). In
the absence of a finalized methodology, we reference it as a desk guide that must be followed by business sponsors,
project managers, system developers, and management.
4 U.S. Digital Services, Digital Services Playbook, available at https://playbook.cio.gov.

4
Conclusion
As SBA shifts from reviewing applications to servicing loans and grants, the potential for
identifying additional fraudulent loans increases significantly as borrowers default. The
ability to recover funds and prosecute fraud relies on having continued access to loan and
grant data, especially regarding evidential matter for audits and investigations.
SBA should adequately plan and provide oversight for all data migrations. By enforcing
existing contract terms, SBA should be able to ensure efficient and comprehensive COVID-
19 EIDL data transfer. The COVID-19 EIDL program has statutory requirements to ensure
the data is preserved in its entirety with data integrity and accessibility long after the
completion of the pandemic relief program.
Management should design the agency’s information system and related internal controls
to achieve objectives and respond to risks for potential loss of data. All COVID-19 EIDL data
must be transferred in its entirety and be available for servicing and enforcement of loans
as well as ongoing analysis to support audits, investigations, and law enforcement
requirements.
We have found over $84.3 billion in potentially fraudulent COVID-19 EIDLs.5 SBA is also
reviewing over 1.5 million complaints of identity theft in the COVID-19 EIDL program, as of
December 19, 2021. In the face of potential fraud of this magnitude, it is imperative SBA
ensure it implements a comprehensive migration plan and enforce contract requirements
to preserve any evidence of wrongdoing and retain the data necessary for management and
oversight of these programs.
Suggested Actions
To address concerns about data migration challenges for SBA’s COVID-19 EIDL pandemic
relief program, we suggest the Administrator direct the Associate Administrator for the
Office of Capital Access to:
1. Design and implement a comprehensive migration plan for the COVID-19
EIDL program, to include defined acceptance criteria and robust testing, with
detailed project milestones and defined areas of responsibility for program
management, information technology, and procurement groups so that data
is preserved to meet the needs of all stakeholders.
Analysis of Agency Response
SBA management provided formal comments that are included in their entirety in the
Appendix. Management stated that the agency’s current plans mitigate the identified
concerns.
Management explained that it reduced risk by performing internal testing and providing
stakeholders access to the new system. Management further stated they were working to
modify the contract to ensure data will remain available for future litigation efforts.

5 SBA OIG Report 22-02, Top Management and Performance Challenges Facing the Small Business Administration in Fiscal
Year 2022 (October 15, 2021).

5
Management’s plan to modify the contract would ensure data is preserved. Once the
contract modification is complete, the risk of data loss will be mitigated. Safeguarding the
data from destruction beyond the June 30, 2022 contract expiration will allow SBA to
support legal proceedings for the immediate future.
Scope and Methodology
We prepared this memorandum to bring attention to data migration challenges for SBA’s
COVID-19 EIDL pandemic relief program. We reviewed federal publications, regulations,
and applicable guidance, as well as SBA’s communications to the public regarding these
programs. We also met with SBA officials to discuss their plans for the upcoming migration
of the COVID-19 EIDL program data following the completion of each service provider
contract. We reviewed a selection of data generated from SBA’s systems and warehouse
and compared it to the service providers’ systems to test whether the information
produced was accurate, complete, and timely. We did not observe test reports and data
output being generated directly from SBA systems. Direct verifications would not have
served a useful purpose since migration efforts are still in progress at this time.
We prepared this memorandum in alignment with OIG’s quality control standards and the
Council of the Inspectors General on Integrity and Efficiency Quality Standards for Federal
Offices of Inspector General, which require that we conduct our work with integrity,
objectivity, and independence.
If you have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
cc:
Arthur Plews, Chief of Staff, Office of the Administrator
Therese Meers, Acting General Counsel
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk
Patrick Kelley, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Stephen Kucharski, Acting Chief Information Officer, Office of the Chief Information
Officer
Katherine Aaby, Associate Administrator, Office of Performance Planning, and the
Chief Financial Officer
Erica Gaddy, Deputy Chief Financial Officer
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Internal Controls Division

6
Appendix: Management Comments
SBA Management Response to Memorandum

Date:
July 5, 2022

To:

Andrea Deadwyler

Assistant Inspector General of Audits

Office of Inspector General

From:
Ronald Whalen
Acting Director OPSM -
Office of Capital Access

Subject:
Office of Inspector General (OIG) Draft Memorandum on Small Business
Administration’s (SBA's) COVID-19 EIDL Program Data Migration Challenges,
Project 22010

The SBA team reviewed the OIG report regarding the migration of data from its “Data Analysis
and Loan Application Recommendation Services” provider to SBA managed systems. SBA
initiated data migration on April 15, 2022.

OIG Suggested Action and Agency Response: Design and implement a comprehensive
migration plan for the COVID-19 EIDL program, to include defined acceptance criteria and
robust testing, with detailed project milestones and defined areas of responsibility for program
management, information technology, and procurement groups so that data is preserved to meet
the needs of all stakeholders.

SBA Response: SBA mitigated the risk in the OIG’s report by performing internal testing,
providing stakeholders with access to the migrated data, and modifying the contract to support
SBA litigation.

• Internal Testing: The SBA validated the migrated functionality, queries, reports, row
counts, and tables to the internal loan system. The test plan and results are available for
the OIG to review.
• Stakeholder Access: The Office of Disaster Assistance (ODA) Fraud Review Team
received access to the data to continue to collect investigative data to support mission
critical processes. The OIG was granted front-end and back-end access to run
independent data reviews. SBA will monitor access and data issues reported by the
stakeholders. As of the publication of this memo, the ODA Fraud Review Team and OIG
stakeholders have not reported issues with the data.
• Contract Modification: SBA is modifying the RER contract to ensure that the data is
available for SBA litigation only.

U.S. SMALL BUSINESS ADMINISTRATION

WASHINGTON, DC 20416

File and source

File

22-16-eidl-data-migration-challenges.pdf

Size

388,113 bytes

SHA-256

1a14215992bfc91afe5ee109a9f6cc88afeca2bf19337425059858a9d7e22409

Our copy

22-16-eidl-data-migration-challenges.pdf

Original

www.sba.gov