View From the Crow’s Nest:

504 Updates/SMART Compliance

Mary Kropp – President, Power Steering

Linda Reilly – Chief, 504 Loan Program, SBA

Paul Kirwin – Financial Analyst, OCRM (via phone)

SMART Compliance and Independent Loan Reviews (ILRs)

•First, let’s recap: What does SMART stand for?

SOLVENCY

MANAGEMENT & Board Governance

ASSET Quality & Servicing

REGULATORY Compliance

TECHNICAL Issues & Missions

•Are ILRs part of a SMART Review?

ILRs are mandated by regulation and are one item in the

overall SMART process

504 Updates / SMART

SMART Risk Framework: Qualitative Factors (from previous SBA PowerPoint)

504 Updates / SMART

Solvency

• Reserves for future operations

• Liquidity risk and management

Management & Board Governance

• Board-approved internal controls policies: Independent Loan Reviews & Classifications

• Business Strategy and Planning

• Audit and Review Programs

• IT Operations

• Management of Risk Concentrations

Asset Quality & Servicing

• Credit Administration

• Servicing and Liquidation Management

• Potential “Harm” Issues

Regulatory Compliance

• Timely and complete submission of CDC Annual report (and PCLP reserve report, if required)

• Jobs creation verification

Technical Issues and Missions

• CDC support of “other economic development initiatives”

• Professional Services Contracts

SMART Regulations (from previous SBA PowerPoint)

504 Updates / SMART

Existing SBA Regulation New SMART Regulation

SMART Componen

t

Regulatory Citation Description of Regulation

Regulatory Citation

Description of Regulation

“S” 120.825 120.841

Financial Ability to Operate PCLP Reserve & Multi State Accounting Requirement

120.823(d)(9) Board ensures CDC maintains adequate reserves

“M” 120.826(b) 120.820 120.824 120.824(b)

Board-Approved internal control policy -Independent loan review -Loan classification system Non-profit status & good standing Full time staff person to manage CDC SBA must pre-approve Professional Service Contracts

120.820 120.822 120.828(a) 120.823(c) 120.823(d)(3) 120.823(d)(6) 120.823(d)(12)&(d)(13)

Non-profit Status & Good Standing Eliminate membership Emphasize Board Accountability Oversight Responsibilities Board sets salaries Board accountability & Internal Controls Executive Compensation/IRS 990

“A” 120.938 120.970(b)

In cases of fraud, negligence ore misrepresentation CDC responsible for receipt & review

120.823(d)(7)&(8) 120.823(d)(14)

Board Monitors Portfolio/Semi-annual status reports Approval of loans over $2,000,000

“R” 120.830 120.8320-830

Annual Report w/ Audited Financials (over $20MM) Requirement that CDCs are n full compliance for ALP

120.816 120.823(d)

CDC non-profit status and good standing Board oversees compliance with SBA requirements & bylaws

“T” 120.828(a) 120.828(b) 120..829 120.840(d)4

Minimum level of activity Diversified by Business Sector Job Opportunity Average Documentation of any SBA-required Insurance (ALP)

120.823(e) 120.830(a)(3)

D&O/E&O Insurance – amount based on sliding scale Economic development activity/reinvestment

SMART Compliance and Independent Loan Reviews (ILRs) are not

mutually exclusive: •ILRs are part of the SMART compliance process under letter “M” per the previous SBA

slides; however, ILRs are not performed by the SBA.

•ILRs are CDC defined in its internal control policy, that has been approved by the CDC

Board (and ultimately, the SBA).

•SBA has emphasized that the CDC may perform its own ILR if the criteria for independence

is clearly stated, the process is defined in its Internal Controls and the review and approval

of the ILR report rests solely with the CDC Board of Directors.

However, my part of the presentation today is based on the CDC utilizing an

independent party to complete the ILR and will provide some guidelines that I

have learned by working directly with the Senior members of the SBA OCRM

team to ensure my sampling meets SBA standards and the loan reviews are

found acceptable.

Watch for SBA’s Independent Loan Review Guide coming soon.

504 Update / SMART Compliance

Independent Loan Reviews and the requirement for them are not

new with the Final Rule but have been a part of CFR 120.826

under the Basic Requirements for operating a CDC. §120.826 Basic requirements for operating a CDC.

A CDC must operate in accordance with the following requirements:

(a) In general. CDCs must meet all 504 Loan Program Requirements. In its Area of Operations, a CDC must market the 504

program, package and process 504 loan applications, close and service 504 loans, and if authorized by SBA, liquidate and litigate

504 loans. It must supply to SBA current and accurate information about all certification and operational requirements, and maintain

the records and submit all reports required by SBA.

(b) Operations and internal controls. Each CDC's board of directors must adopt an internal control policy which provides adequate

direction to the institution for effective control over and accountability for operations, programs, and resources. The board adopted

internal control policy must, at a minimum:

(1) Direct management to assign the responsibility for the internal control function (covering financial, credit, credit review, collateral,

and administrative matters) to an officer or officers of the CDC;

(2) Adopt and set forth procedures for maintenance and periodic review of the internal control function;

(3) Direct the operation of a program to review and assess the CDC's 504-related loans. For the 504 review program, the

internal control policies must specify the following:

(i) Loan, loan-related collateral, and appraisal review standards, including standards for scope of selection (for review of

any such loan, loan-related collateral or appraisal) and standards for work papers and supporting documentation;

(ii) Loan quality classification standards consistent with the standardized classification systems used by the Federal Financial

Institution Regulators;

(iii) Specific control requirements for the CDC's oversight of Lender Service Providers; and

(iv) Standards for training to implement the loan review program; and

(4) Address other control requirements as may be established by SBA.

Independent Loan Reviews

(ILRs)

When utilizing an outside provider, the CDC and the provider must

execute a contract that is:

• Reviewed and approved by the CDC Board of Directors

Note: CDC Board must be able to show that the fees charged are

reasonable

and customary for the services being provided; CDC may need to

rely on ILR contractor to provide data as to this.

• Submitted to the District Office for review, WITH APPROVING BOARD

RESOLUTION.

Over the past three years, District Offices are becoming more familiar

with their responsibilities for these reviews, but should direct questions

to SBA OCRM and OFA teams in Central Office for clarification.

• District will then forward the contract Central Office for review and approval

• The Contract must comply with the requirements the CDC has set forth in its

internal control policies, SBA regulations and (at present) must be billed on an

hourly basis (no flat fee contracts).

Contracts for ILRs

This item changes based on the reviewer, so I will provide the

group with what Power Steering requires to complete its ILRs:

1.CSA (Wells Fargo Corporate Trust Services) Status of Portfolio report as of

"review date" both in PDF and in Excel.

2.CSA Status of Portfolio Non-Current Report as of “review date.”

3.CDC Active, funded files listing report from its internal loan management

software.

4.Internal report listing loans in “approved, not yet funded” status (including but

not limited to approval type, approval date, debenture amount, SBA loan number,

SBA Office from Loan Auth, etc.).

5.Internal report listing loans still active in Liquidation status, as well as a second

report listing all historical Liquidation files (including but not limited to approval

type, approval date, funding date, Liquidation purchase date, debenture amount,

SBA loan number, SBA Office from Loan Auth, etc.).

6.Internal report listing all active loans funded in the 12 months preceding the

“review date” (including but not limited to approval type, approval date, funding

date, current balance, original debenture amount, SBA loan number, SBA Office

from Loan Auth, etc.).

What info will my ILR

contractor need?

Continued listing of what Power Steering requires to complete its

ILRs: 7.Internal report listing all active loans and their respective risk ratings (including

rating and date rated, plus approval type, approval date, dollar amount, SBA loan

number, SBA Office from Loan Auth, etc.).

8.SBA Lender Portal Report closest to "review date," including Excel spreadsheet of

individual ratings.

9.SBA CDC Management Report closest to "review date”.

10.CDC Credit Policy Manual (if any), plus PCLP policies if/where different (Or

updates since last review by PSUI).

11.CDC Loan Credit Scoring, Loan Grading and Loan Grading Exceptions Policy

(Or updates since last review by PSUI).

12.CDC Concentration of Credit (by Industry) report as of “review date” both in

dollar amount and in number of loans as follows:

a. Concentration by 6-digit NAICS code ($ & #)

b. Concentration by 3-digit master NAICS codes ($ & #)

c. Top 5 to 10 franchises lent to ($ & #).

What info will my ILR

contractor need?

Continued listing of what Power Steering requires to complete its

ILRs:

13.CDC Watch List and/or Critical Asset List (if any).

14.Copies of most recent CDC 60-day and over Quarterly reports submitted to

SBA, if any.

15.Copies of most recent quarterly Liquidation reports submitted to SBA, if any.

16.Other CDC Policies, including but not limited to: CDC Servicing Policy &

Procedures (if any), CDC Internal Control Policy or Loan Process Outline, Board

Manual (Or updates on any of these since last review by PSUI).

17.Access to digital loan management systems and files, including but not limited

to complete Application, Closing and Servicing/Liquidation files (or equivalent).

[IMPORTANT: if off-site service, CDC must be ready to provide organized

files as noted above in a mutually agreed upon digital format and electronic

access to loan management systems; bulk PDF’s without appropriate

indexing or bookmarks may not be acceptable]

What info will my ILR

contractor need?

Continued listing of what Power Steering requires to complete its

ILRs:

18.Copies of any recent SBA OCRM loan reviews, SMART/SAR reviews and

management letters / responses regarding same (this item is subject execution

and subsequent OCRM approval of SBA confidentiality document, provided

separately if CDC indicates this is applicable).

19.Copies of any Quality Control reviews by the Sacramento, ASM reviews and

quarterly Priority Closing reviews, if any. If applicable, copies PCLP reserve

reports and SBA acceptance of same.

20.Most recent CDC Annual Report, and copy of financial statements.

What info will my ILR

contractor need?

This item changes based on the reviewer, so I will provide the group

with what Power Steering requires to complete its ILRs:

•Though the typical total file sampling size right now is approximately 5% of active, funded

files, it is governed by the CDC’s Internal Control Policy and adjustments may be required

by the SBA from time to time.

•SBA is now recommending that at least 10% of the legacy file group (loans funded in

excess of one year) be reviewed, with the caveat that the sample number will be no larger

than the last OCRM review sample number, plus 20% of New Funding (loans funded

within the last 12 months), again with the caveat that the total number of all files reviewed

would not be more than the last OCRM review; Practice Pointer: Power Steering has maximum

numbers for each of its sampling groups based on actual experience in submitting ILRs to SBA for

review.

•A directed judgmental sampling of Liquidation Files will be completed.

•A directed judgmental sampling of Approved Pending Funding files may be completed.

What is an appropriate

Sample Size for my ILR?

The active file sampling size will be at least equal to the CDC’s last SBA

OCRM review sample size. Also, to the extent not covered in the legacy

file random sampling, a direct judgmental sampling of delinquent,

deferred and catch-up status loans will be added to the legacy portion of

the review.

## files total will be reviewed as follows:

## Legacy,

## New Fundings,

## Approved not yet funded and

## Active Liquidation files

As reviews are repeated annually, the sampling size may decrease

based on prior years’ loan volume, or it may increase due to

performance issues raised in SBA reviews.

What is an appropriate

Sample Size for my ILR?

The Loan Review process by Power Steering is one method to

accomplish this key internal control item. A word of caution is prudent

here that there are many folks out there doing “reviews” and it is up to the

CDC, CDC Board and the SBA to ultimately determine what meets the

requirements.

Power Steering sampling procedures were created in 2012 utilizing the

FDIC sampling process and was initially solely based on their manuals

and recommendations, and adjusted based on meetings with OCRM

senior staff. Then, having performed over 50 ILRs since 2012, the Power

Steering process has been molded by direct feedback from the SBA and

requests for expanded samplings and information reviewed. CDCs should

exercise caution as the rumor mill has indicated that some providers are

charging exorbitant fees and/or are requiring ridiculously large sample

sizes, or both.

Rely on SBA, your Trade Association peer relationships and recognized

professional services providers to ensure value and quality in this

important process.

Educated Opinion

This item changes based on the reviewer, so I will provide the group with the

format Power Steering utilizes: •Report should contain the date completed and the “as of” date based on the portfolio data

date utilized to create the sample.

•The report should have a preamble that discusses what the ILR process is and why it is being

performed and how the report is meeting or exceeding the CDC’s internal controls

requirements.

•The report should have key performance data from both the Lender Portal and the CDC

Management report, with discussion points as to CDC performance as measured by both.

•The report should have a recap of the sampling process and how each number in the

sampling was arrived at.

•The report should have review the findings from the review delineated numerically and with

potential recommendations for correction.

•Reports may have recommendations (less than findings) for best practices.

•Reports should have statistical review pages to ensure proper sampling protocols.

•Reports should have overall Conclusions.

•Report should have the professionally organized working papers for each

file reviewed (typically attached as an appendix). Repeat reviews will note prior years’ findings and recommendations

and status of same.

What is an appropriate

Report Structure for my ILR?

This item changes based on the CDC, but the basics are the

same: •The Review should be presented to the CDC Board of Directors.

Often Power Steering clients have me present the report directly, or

have me “on the line” to clarify issues and answer questions.

•The Board then takes action as appropriate to accept the report and further to

memorialize how the CDC intends to address findings and recommendations.

•If not previously requested by the SBA for ALP renewals, SAR/SMART reviews,

expansion requests, etc., then the report is kept on file at the CDC and provided

to SBA upon request.

Practice Pointer: Power Steering requires that the CDC plan of action as

approved by the Board is provided for our records as SBA may, from time to time,

discuss the report with Power Steering directly.

What do I do with my ILR

once complete?

This item is governed under several CFR and SOP sections and

as a matter of practice, Power Steering restates those sections

verbatim in its contracts. Obviously what Power Steering

charges is proprietary information; however I would be happy to

provide these figures directly to anyone in the room via email at:

mekropp504@aol.com or

mary@powersteering504.com

I will confirm that my review costs in 2015 do not exceed 4 figures

(even for top 5 CDCs), and my review process is one of the most extensive out

there, so if a provider is quoting $10,000 or over,

chances are you are paying too much!

See also:

13 CFR 120.824

13 CFR 120.825

SOP 50 10 5 G, CH 3 Section II.A.7

How much will it cost?

Mary Kropp, President, (210) 478-1055

Thank you for your attention and remember that there is more

guidance coming directly from the SBA very soon!

Thank you!