7 Things Lenders Should Know About SBA Audits
Reading Time: 7 minutes
The SBA Office of Credit Risk Management (“OCRM”), conducts continuous, risk-based lender oversight on all SBA lenders and CDCs. As part of this oversight, the OCRM conducts periodic on-site audits to evaluate the lender or CDC’s portfolio performance, credit administration, compliance with loan program requirements, and SBA operations management. 13 C.F.R. § 120.1050(a). When preparing for an inevitable on-site audit, lenders and CDCs should be aware of these 7 things.
1. When Are Audits Conducted?
Generally, on-site audits are conducted on all 7(a) lenders with an outstanding balance of over $10 million on the SBA-guaranteed portions of its loan portfolio, and all CDCs with an outstanding balance of over $30 million on its SBA-guaranteed debentures, once every 12 to 24 months. However, the SBA has the discretion to conduct on-site audits on any SBA lender or CDC as frequently as it considers necessary. The SBA may consider the following factors when determining the frequency of on-site audits:
(a) Results of monitoring;
(b) SBA loan portfolio size;
(c) Previous review or examination findings;
(d) Responsiveness in correcting deficiencies noted in prior review or examinations; and
(e) Such other risk-related information as SBA, in its discretion, determines to be appropriate.
SOP 51 00; 13 C.F.R. § 120.1051.
2. Do Lenders and CDCs Have to Provide the Auditor With Access to Their Loan Files?
Yes. Lenders and CDCs must provide the SBA, or auditor, with access to its files to review, inspect and copy any and all documents relating to SBA guaranteed loans, or as requested for SBA oversight. The lender or CDC must provide the auditor with access to its files during normal business hours. 13 C.F.R. § 120.1010.
3. When Should Lender and CDC’s Receive the Audit Report?
The SBA will provide the lender or CDC with a copy of a written audit report within 60 business days following the conclusion of the examination, unless the SBA notifies the lender or CDC with a later date and the reason for the delay. The report will usually contain the findings, conclusions, corrective actions, and recommendations. 13 C.F.R. § 120.1055(a).
If the lender or CDC receives the audit report by email, the report will be deemed to have been received on the date it was emailed to the last known email address of the lender or CDC, unless the lender or CDC can provide compelling evidence to the contrary. 13 C.F.R. § 120.1055(b).
4. What Do Lenders and CDCs Have to Do When They Receive the Audit Report?
Lenders and CDCs must respond to each of the audit report’s findings, recommendations, and corrective actions, in writing, within 45 business days from the date the report is received, unless the SBA notifies the lender or CDC in writing with a different time period. If the report requested for the lender or CDC to submit proposed corrective actions and/or a capital restoration plan, it must be completed within the same timeframe. The proposed corrective action or capital restoration plan must include:
(a) The steps the lender or CDC will take to correct the finding(s);
(b) The time within which each step will be taken;
(c) The timeframe for accomplishing the entire corrective action plan; and
(d) The person(s) or department with the lender or CDC that is charged with carrying out the corrective action or capital restoration plan.
If the lender or CDC is required to submit a proposed corrective action or capital restoration plan, the SBA will provide the lender or CDC with written notice of approval. In addition, the SBA will provide the lender or CDC with written notice of whether the response is acceptable, or if it requires additional information or other action. 13 C.F.R. § 120.1055(c).
If corrective action is required, lenders and CDCs must implement corrective actions within 90 calendar days from the date the audit report is received, unless the SBA provides written notice of another timeframe. 113 C.F.R. § 120.1055(b).
5. What Are the Consequences for Failing to Respond to the Audit Report?
Lenders and CDCs may be subject to enforcement action if it fails to:
(a) Respond to the audit report in writing;
(b) Timely respond to the audit report;
(c) Provide an acceptable response within the SBA’s discretion;
(d) Respond to all findings and required corrective actions in the audit report;
(e) Submit a corrective action plan or capital restoration plan in writing (if requested);
(f) Timely submit a corrective action plan or capital restoration plan (if requested);
(g) Submit an acceptable correction action plan or capital restoration plan (if requested); or
(h) Implement in any material respect a corrective action or capital restoration plan within the required timeframe.
6. Can Lenders or CDCs Disclose the Contents of the Audit Report With Others?
No. Audit reports and related documents are the property of the SBA and are loaned to the lender or CDC for its confidential use only. Lenders and CDCs are prohibited from disclosing its audit report with anyone outside its own immediate corporate organization, in full or in part, in any manner, without SBA’s prior written permission. If the lender or CDC is required to disclose the contents of the audit report by law, it must provide the SBA with written notice and in advance of disclosure, so that the SBA may have the opportunity to seek appropriate relief, such as an injunction or protective order. 13 C.F.R. § 120.1060.
7. Is There an Audit Fee?
Yes. Lenders are required to pay a fee to the SBA to cover the costs of audits. The fee may include:
(a) The costs of conducting a safety and soundness examination;
(b) The costs of conducting a review of a 7(a) lender and related review activities;
(c) The costs of conducting monitoring reviews of a 7(a) lender; and
(d) The costs of additional expenses that the SBA incurs in carrying out other lender oversight activities, such as salaries and travel expenses of SBA employees, and equipment expenses.
The SBA will bill each lender for the amount owed for (a) and (b), above, upon completion, and for (c) and (d), above, on an annual basis. The lender must make a payment to the SBA within 30 calendar days from the bill date. If the lender fails to pay the bill within this timeframe, the SBA will charge interest, and other applicable charges and penalties. In addition, the SBA may suspend or revoke the lender’s eligibility to participate in the SBA loan program, or limit its delegated authority. 13 C.F.R. § 120.1070.
Takeaways for Lenders and CDCs
Based on the above, lenders and CDCs must ensure that they are complying with all loan program requirements and properly documenting all servicing and liquidation decisions in the loan file. When the SBA inevitably conducts an audit, lenders and CDCs must ensure that they timely respond in writing to all of the findings, recommendations, and corrective actions in the audit report. In the event corrective action is required, lenders and CDCs must ensure that it properly implements corrective action, or risk enforcement action.
Authors:
- Brandon C. Meadows, Esquire
- Melissa Murrin, JD Candidate
Continued reading in the series:
- Which Liquidation Actions Require SBA’s Pre-Approval: Part 1 – SBA 7(a) Loan Liquidation
- Which Liquidation Actions Require SBA’s Pre-Approval: Part 2 – SBA 504 Loan Liquidation
- Classifying SBA Loans in Liquidation Status
- How SBA Lenders Ensure Expense Recovery in Loan Liquidation and Litigation
- What Responsibility and Authority do SBA Lenders Have in Servicing and Liquidating Loans?
- Loan Modification and Deferment Requirements for SBA Lenders
- SBA Loan Site Visits: How to Prepare and What to Expect
- SBA Loans: How to Maximize Recovery by Liquidating Real Property
- SBA Loans: How to Maximize Recovery by Liquidating Personal Property
- How to Maximize Recovery on a SBA Loan by Negotiating a Workout Agreement
- Assumption, Assignment and Sale of SBA Loans
- SBA Loans: Insurance Requirements and Considerations
- SBA Loans: Offers in Compromise
- Post-Default Environmental Risk Management for SBA Lenders
- SBA Loans: Wrap-Up and Charge-Off Procedures