Revised Risk-Based Review Protocol for Certified Development Companies

I. Introduction

The SBA’s Office of Credit Risk Management (OCRM) is updating its oversight of Certified Development Companies (CDCs) participating in the SBA’s 504 loan program. The revised RiskBased Review (RBR) protocol described below is intended to be flexible and is capable of taking into account individual facts and circumstances. The SBA will use this guidance along with judgment and Agency discretion in conducting RBRs of CDCs. II. SMART Risk Measurement Methodology The revised RBR protocol features a composite risk measurement methodology and scoring guide, “SMART,” which the SBA has developed for the oversight of CDCs. SMART is an acronym for the specific risk areas or components

II. SMART Risk Measurement Methodology

The revised RBR protocol features a composite risk measurement methodology and scoring guide, “SMART,” which the SBA has developed for the oversight of CDCs. SMART is an acronym for the specific risk areas or components that the SBA reviews for CDCs. The components and their measurement objectives are as follows:

The SMART components cover the general areas the SBA reviews under the authority of 13 C.F.R. 20.1050(a). Each SMART component includes both quantitative and qualitative factors. (See Appendix A to this Notice for a list of the quantitative and qualitative factors currently being used for each SMART component.) The quantitative factors are benchmarked and scored against risk tolerance thresholds, producing a SMART Score (described below under Lender Profile Assessment). The qualitative factors will include, but not be limited to, consideration of: compliance with SBA Loan Program Requirements (as defined under 13 C.F.R. 120.10), changes in CDC’s loan policies, management and staff capabilities and any other aspect of the CDC’s 504 program. Review of the quantitative and qualitative factors will allow the SBA to better identify a CDC’s specific risk areas, assess the level of risk a CDC poses to the SBA, and make recommendations for corrective action as needed. The SMART methodology, including but not limited to quantitative and qualitative factors, may be revised from time to time.

III. CDC Revised Risk-Based Review Protocol

The SBA’s revised RBR protocol for CDCs features the following levels/types of review:

1. Lender Profile Assessment

2. Analytical Review

3. Targeted Review

4. Full Review

5. Annual Report Review

6. Delegated Authority Renewal Review

7. Other Reviews

A detailed discussion of each review level follows.

1. Lender Profile Assessment

The Lender Profile Assessment (LPA) is the first level of review. It is a data-driven virtual review that computes the quantitative factors for each SMART component and then scores them against certain benchmarks. Currently, the SBA scores a quantitative factor: “1” – for performance within a “Lower Risk” range; “3” – for performance within a “Moderate Risk” range; and “5” for performance within a “Higher Risk” range. The total score for all components (SMART Score) is calculated, 3 providing the SBA with a high level assessment of the CDC. SMART scores in this initial version of the LPA currently range between 12, indicating the lowest risk, and 60, indicating the highest risk. The SBA may use the LPA/SMART Score to assist in determining the next level of review, if any, and in connection with CDC delegated authority decisions. The SBA is updating the Lender Portal screens to include SMART Scores and the underlying metrics.

2. Analytical Review

The Analytical Review is the second level of review. The SBA analyzes the LPA for each SMART component, including both quantitative and qualitative factors. The SBA may select a CDC for an Analytical Review based on the CDC’s Lender Risk Rating, LPA or SMART Score, as well as other risk criteria, such as previous RBR assessments, the CDC’s Annual Report, or whether the CDC has been reviewed recently. The SBA may also conduct Analytical Reviews on a population of randomly-selected CDCs or in connection with CDC delegated authority decisions. Analytical Reviews are generally a virtual review unless a CDC does not have virtual review capability. An Analytical Review generally will include a review of a CDC’s 504 loan portfolio data rather than 504 loan files. However, in some cases a 504 loan file review may be required, and if so, the SBA will notify the CDC. The SBA may request documents and information relevant to any or all SMART components from a CDC. OCRM may also solicit information about the CDC from other SBA sources, such as the SBA Sacramento Loan Processing Center, the applicable SBA district office(s) and the applicable commercial loan servicing center. The results of an Analytical Review may conclude the process or may indicate the need for a subsequent level of review, such as a Targeted or Full Review.

3. Targeted Review

The Targeted Review is generally narrow in scope. In a Targeted Review, the SBA generally reviews one or more SMART components or other areas of concern (including program integrity concerns) identified by the SBA as requiring a focused scope of review. For example, the SBA may perform a Targeted Review in connection with “Higher Risk” factor(s) or other material noncompliance identified during an Analytical Review or a Full Review. The SBA may also use a Targeted Review to confirm the implementation of required corrective actions, or in conjunction with increased supervision or enforcement. A Targeted Review may be conducted either virtually and/or at a CDC’s location depending on the CDC’s technological capabilities or other review-specific needs. A CDC selected for a Targeted Review will receive an engagement letter that advises the CDC of the review and requests documents and information relevant to the matters being reviewed. For a Targeted Review that includes a 504 loan file review, the SBA may use random and/or judgmental sampling to target specific risk characteristics.

4. Full Review

The SBA conducts a comprehensive analysis of each SMART component in a Full Review. Full Reviews are generally conducted at the CDC’s location, but may include a virtual review portion. The SBA selects CDCs for Full Reviews based on indications of higher risk as identified through LPAs/SMART Scores, Analytical Reviews, Annual Report Reviews, or other SBA monitoring tools; whether the SBA has performed an RBR recently; and/or program integrity considerations. The SBA may also select a random sample of CDCs to receive Full Reviews. A CDC selected for a Full Review will receive an engagement letter that requests documents and information relevant to each SMART component. The LPA diagnostic serves as the initial step in the Full Review. Full Reviews include reviews of 504 loan files. The SBA generally selects loans for review using both random and judgmental sampling techniques. Judgmental loan file selection criteria for Full Reviews include loan characteristics such as loan size, borrower industry, loan delivery method, Small Business Predictive Score at origination, and loan performance.

5. Annual Report Review

Under 13 C.F.R. 120.830, a CDC must submit an Annual Report within 180 days after the end of the CDC’s fiscal year. Annual Reports are submitted to the SBA district office designated as the CDC’s Lead SBA Office. As set forth in SOP 50 10 5, the Lead SBA Office performs a review of the CDC’s Annual Report and an operational review of the CDC, and forwards the Lead SBA Office review and the CDC’s Annual Report to SBA Headquarters. OCRM will perform reviews of Annual Reports for completeness and compliance with the SBA’s loan program requirements.

6. Delegated Authority Renewal Review

The SBA performs a Delegated Authority Renewal Review prior to the CDC’s delegated status expiration date. Examples of delegated status for CDCs are the Premier Certified Lenders Program (PCLP) and the Accredited Lenders Program (ALP). In general, the SBA works to coordinate Delegated Authority Renewal Reviews with the timing of a CDC’s Analytical Review or Full Review, if one is to be performed. Delegated Authority Renewal Reviews generally occur every two years. However, CDCs with shortened renewals (e.g., those under increased supervision) may have Delegated Authority Renewal Reviews more frequently. The Delegated Authority Renewal Review will analyze the LPA along with the other Delegated Authority criteria as set forth in the SBA’s Loan Program Requirements. A Delegated Authority Renewal Review may result in the granting or denial of continued delegated authorities.

7. Other Reviews

OCRM may perform other reviews of CDCs from time to time. These include, for example, CDC Self-Assessments and Agreed Upon Procedure Reviews (AUP). For the CDC Self-Assessment or AUP, the CDC is responsible for conducting the review. The SBA might use a CDC Self-Assessment or AUP as an alternative method to confirm corrective actions required or review a matter or deficiency of low to moderate risk. The Self-Assessments or AUPs are performed by third-party practitioners or an independent office within the CDC (e.g., internal audit), upon which the SBA and the CDC agree, and must follow a review protocol as prescribed or approved by the SBA. The SBA may review the CDC Self-Assessments or AUPs to confirm that review “assertions” and “objectives” were met, testing and results were accurate, and the report was reliable. The RBR protocol, like the SMART methodology, may be revised and is subject to periodic adjustment. The SBA will use judgment and discretion and may consider matters such as risks identified, changing economic conditions, and Agency resources in making periodic adjustments.

IV. Review Report and Assessment Categories

RBRs, particularly Analytical Reviews, Targeted Reviews, and Full Reviews, generally culminate in a Review Report (Report). In general, the Report will include a summary assessment of the CDC and may include an individual assessment for each SMART component reviewed. The summary assessment generally bears a close relationship to the SMART component assessments, but the summary assessment is not a mathematical average of the components. The RBR assessment categories of “Acceptable,” “Acceptable with Corrective Action Required,” and “Less Than Acceptable with Corrective Action Required” have now been amended to add a fourth assessment category of “Marginally Acceptable with Corrective Action Required.” A CDC in the “Marginally Acceptable with Corrective Action Required” category requires close supervisory attention and monitoring to promptly correct the serious compliance and risk management practices in the CDC’s operations that, if not corrected, will negatively impact the CDC’s operations and expose the SBA to an unacceptable level of financial and/or program risk. The SBA will use judgment and discretion in assigning review assessments.

Questions

Questions on this revised RBR protocol for CDCs may be directed to Adrienne Grierson, Deputy Director, Office of Credit Risk Management, at Lender.Oversight@sba.gov.

---

Maria Contreras-Sweet

Administrator