Office of Credit Risk Management SMART – SBA’s New Risk Based Review

Office of Credit Risk Management SMART - SBA’s New Risk Based Review Protocol Build Northeast Conference Monday September 8, 2014

SMART – SBA’s new 504 oversight protocol 2 S Solvency and Financial Condition M Management and Board Governance A Asset Quality and Servicing R Regulatory Compliance T Technical Issues and Mission .

“S” - Solvency and Financial Condition The first SMART component is Solvency and Financial Condition. The objective of the Solvency and Financial Condition component is to assess the CDC’s financial ability to operate. 3

“S” - Solvency and Financial Condition The quantitative factors measured for the Solvency and Financial Condition component are: (a) 5 Year Cumulative Net Yield (b)12 Month Default Rate (c) 5 Year Default Rate The qualitative factors reviewed for the Solvency and Financial Condition component include: (a) Reserves for Future Operations (b)Liquidity Risk and Management (c) Debt to Net Asset Ratio 4

“M” – Management and Board Governance The second SMART component is Management and Board Governance. The objective of the Management and Board Governance component is to assess the CDC’s organizational structure, policies, and internal controls. 5

“M” – Management and Board Governance The quantitative factors measured for the Management and Board Governance component are: (a) Lender Purchase Rating (formerly known as Lender Risk Rating---See Notice of Revised Risk Rating System, 79 FR 24053, April 29, 2014) (b) High Risk Origination Rate (c)Loans in Purchase Status over 3 Years Rate 6

“M” – Management and Board Governance The qualitative factors reviewed for the Management and Board Governance component include: (a) Board-Approved Internal Controls Policies, including Independent Loan Review and Loan Classification System (b) Business Strategy and Planning (c)Audit and Review Programs (d) IT Operations (e) Management of Risk Concentrations 7

“A” - Asset Quality and Servicing The objective of the Asset Quality and Servicing component is to assess the quality of the CDC’s 504 loan origination, underwriting, closing, servicing, and liquidation practices. 8

“A” - Asset Quality and Servicing The quantitative factors measured for the Asset Quality and Servicing component are: (a) Stressed Rate (b)Recovery Rate (over last 5 years) (c) Early Problem Loan Rate The qualitative factors reviewed for the Asset Quality and Servicing component include: (a) Credit Administration (b)Servicing and Liquidation Management (c) Potential fraud, negligence or misrepresentation issues on individual 504 loans 9

“R” - Regulatory Compliance The fourth SMART component is Regulatory Compliance. The objective of the Regulatory Compliance component is to assess the CDC’s compliance with SBA Loan Program Requirements. 10

“R” - Regulatory Compliance The quantitative factor measured for the Regulatory Compliance component is: (a) Minimum Level of 504 Activity The qualitative factors reviewed for the Regulatory Compliance component include: (a) Timely and complete submission of CDC Annual Report (and PCLP Loan Loss Reserve Report, if required) (b) Liability Insurance Minimums 11

“T” - Technical Issues and Mission The fifth SMART component is Technical Issues and Mission. The objective of Technical Issues and Mission component is to review risk areas that do not fall into any of the other SMART components but may pose risk to SBA or present program integrity concerns. 12

“T” - Technical Issues and Mission The quantitative factors measured for the Technical Issues and Mission component are: (a) Average Small Business Portfolio Score (weighted) (b) Top Industry Concentration Rate The qualitative factors reviewed for the Technical Issues and Mission component include: (a) CDC support of “other economic development” (b) Job Creation and Retention Documentation (c)Professional Services Contracts 13

SMART Review Protocol SBA’s new SMART protocol features the following levels/types of review: (a) CDC Profile Assessment (b) SMART Analytical Review (c)SMART Targeted Review (d) SMART Full Review 14

CDC Profile Assessment The CDC Profile Assessment (CPA) is the initial level of SMART review. It is a virtual review that serves as a diagnostic exercise. For the CPA, OCRM currently uses SBA, Wells Fargo CSA, and Dun & Bradstreet data. The CPA measures the quantitative factors for each SMART component and scores the quantitative factor measurement using risk tolerance benchmarks established by SBA. 15

CDC Profile Assessment The current quantitative factor scores are: “Preferred” 1 point; “Acceptable” 3 points; and “Less Than Acceptable” 5 points. OCRM may use the CPA to determine the next level of SMART review, if any. OCRM may also use the CPA in connection with CDC delegated authority renewals and extensions. The benchmarks, will be adjusted periodically to move with the 504 portfolio and reflect economic conditions. 16

CDC Profile Assessment U.S. Small Business Administration CDCProfile Assessment Office of Credit Risk Management Day Report Generated: #N/A Friday, September 05, 2014 Third Quarter of Fiscal Year 2014 Source Data Updated Quarterly 504 SMART RATES Solvency Management Asset Quality Regulatory Compliance Technical Issues 17 5 Year Cumulative Net Yield 12 Month Default Rate 5 Year Default Rate Lender Purchase Rating (formerly LRR) High Risk Origination Rate* Loans in Purchase Status over 3 Years Rate Stressed Rate Recovery Rate (Over last 5 years) Early ProblemLoan Rate Preferred ( 1) Acceptable ( 3) -1 % -3%and -1% -3% #N/A #N/A 0% 0%and 5% 5% #N/A #N/A 0% 0%and 5% 5% #N/A #N/A 1,2 3 4,5 #N/A #N/A 0% 0%and 13% 13% #N/A #N/A 0% 0%and 27% 27% #N/A #N/A 3% 3%and 10% 10% #N/A #N/A 33% 33%and 6% 6% #N/A #N/A 0% 0%and 4% 4% #N/A #N/A 4 #N/A #N/A MinimumLevel of 504 Activity Average SBPS (weighted) Top Industry Concentration Rate Less Than Number Lender Rate Acceptable ( 5) of Points 4 197 188 and 197 188 #N/A #N/A 13% 13%and 28% 28% #N/A #N/A Total Points #N/A

SMART Analytical Review The SMART Analytical Review (SAR) is the next level of SMART review. A SAR begins with a CPA, and SBA uses the CPA template to analyze and document each SMART review component, including both quantitative and qualitative factors. OCRM may select a CDC for a SAR based on the CDC’s CPA, as well as other risk criteria, such as previous RBR assessments. OCRM may also conduct SARs in connection with CDC delegated authority renewals and extensions. SARs are generally a virtual review unless a 18

SMART Targeted Review A SMART Targeted Review (STR) is generally narrow in scope. In a STR, SBA will review one or more SMART components or other areas of concern (including program integrity concerns) identified by SBA as requiring a focused scope of review. For example, SBA may perform a STR in connection with a finding identified during a SAR or a SMART Full Review. 19

SMART Full Review SBA performs a comprehensive analysis of all SMART review components in a SMART Full Review (SFR). SFRs are generally conducted on-site at the CDC, but may include a virtual review portion. SBA intends to select CDCs for SFRs based on indications of higher risk (including portfolio size) as identified through CPAs, SARs or other SBA monitoring tools, and/or based on program integrity considerations. 20

SMART Full Review SBA performs a comprehensive analysis of all SMART review components in a SMART Full Review (SFR). SFRs are generally conducted on-site at the CDC, but may include a virtual review portion. SBA intends to select CDCs for SFRs based on indications of higher risk (including portfolio size) as identified through CPAs, SARs or other SBA monitoring tools, and/or based on program integrity considerations. 21

Frequently Identified Deficiencies in Reviews Board-approved Internal Control Policy (13 CFR 120.826(b)) No Independent Loan Review Loan Classification not compliant with FFIR Audit engagement letter must include the required verbiage providing the SBA access to, and copies of any work papers, policies and procedures relating to the services performed (13 CFR 120.826(d)(2)). Directors and Officers Liability insurance policies inadequate – many exclude SBA-related claims, 504 loan making, and CDC staff (SOP 50 10 5(F) Subpart A Chapter 3(V)(A)(g)(iv)). Determination of need for life insurance needs to be addressed in CDC’s credit memorandum. Need to obtain COC or equivalent prior to funding. Improvement needed in documentation of use of proceeds for construction. Need to obtain list of equipment at closing if equipment included as collateral. At default, site visit should be conducted and inventory of equipment taken if possible. 22

Independent Loan Review OCRM looking for this through ALP renewals, Full SMART Reviews, and SMART Analytical Reviews. Key OCRM Requirements: 1) Board-approved written internal control policy 2) Defined elements 3) Loan Classification System consistent with FFIR system (aka Risk Rating) 23 .

Key Elements of Independent Loan Review To protect review function’s independence, board or board committee should approve review plan. Plan should identify individual(s) who will conduct review – must be independent of process under review. Scope of sample selection – explain how sample size is set and how loans are actually selected for review. Define frequency of review (at least annually). Specific review criteria. Review findings should be compiled in report format and presented to the board. 24 .

Scope of Loan Review Loan reviews should analyze a number of important credit factors, including: Credit quality; Sufficiency of credit and collateral documentation; Proper lien perfection; Proper loan approval; Adherence to loan covenants; Compliance with internal policies, procedures, and applicable laws and regulations; and The accuracy and timeliness of credit grades assigned by loan officers. 25