oversight

Functionality of the Debt ManagementCollection System 2

Published by the Department of Education, Office of Inspector General on 2015-11-05.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                   Functionality of the Debt Management

                            Collection System 2



                                 FINAL AUDIT REPORT





                                    ED-OIG/A02N0004

                                     November 5, 2015



Our mission is to promote the                            U.S Department of Education
efficiency, effectiveness, and                           Office of Inspector General
integrity of the Department’s                            Washington, DC
programs and operations.
                       NOTICE

Statements that managerial practices need improvements, as well as
other conclusions and recommendations in this report, represent the
  opinions of the Office of Inspector General. Determinations of
   corrective action to be taken will be made by the appropriate
                Department of Education officials.

In accordance with the Freedom of Information Act (5 U.S.C. § 552),
  reports issued by the Office of Inspector General are available to
  members of the press and general public to the extent information
      contained therein is not subject to exemptions in the Act.
                              UNITED STATES DEPARTMENT OF EDUCATION
                                    OFFICE OF INSPECTOR GENERAL


                                                                                                                 AUDIT SERVICES



                                                               November 5, 2015
MEMORANDUM
TO:           James W. Runcie
              Chief Operating Officer
              Federal Student Aid

FROM:         Patrick J. Howard /s/
              Assistant Inspector General for Audit

SUBJECT: Final Audit Report
         Functionality of the Debt Management Collection System 2
         Control Number ED-OIG/A02N0004

Attached is the subject final audit report that covers the results of our review of the functionality

of Federal Student Aid’s Debt Management Collection System 2. An electronic copy has been

provided to your Audit Liaison Officer. We received your comments concurring with the

findings and recommendations in our draft report.


Corrective actions proposed (resolution phase) and implemented (closure phase) by your office

will be monitored and tracked through the Department’s Audit Accountability and Resolution 

Tracking System (AARTS). The Department’s policy requires that you develop a final

corrective action plan (CAP) for our review in the automated system within 30 calendar days of

the issuance of this report. The CAP should set forth the specific action items, and targeted 

completion dates, necessary to implement final corrective actions on the findings and 

recommendations contained in this final audit report. 


In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector

General is required to report to Congress twice a year on the audits that remain unresolved after

six months from the date of issuance. 


In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the

Office of Inspector General are available to members of the press and general public to the extent

information contained therein is not subject to exemptions in the Act. 


We appreciate the cooperation given us during this review. If you have any questions, please call

Daniel P. Schultz at 646-428-3888.


Enclosures


Electronic cc:

Dawn Dawson, Audit Liaison Officer, Federal Student Aid

                               400 MARYLAND AVENUE, S.W., WASHINGTON, DC 20202-1510

               Promoting the efficiency, effectiveness, and integrity of the Department’s programs and operations.
                                              TABLE OF CONTENTS


                                                                                                                                 Page

EXECUTIVE SUMMARY ...........................................................................................................1


BACKGROUND ............................................................................................................................4


AUDIT RESULTS .........................................................................................................................7


          FINDING NO. 1 – FSA Did Not Always Accurately Assess the 

                          Operational Status for DMCS2 Functions, 

                          Processes, and Subprocesses and Did Not

                          Sufficiently Document its Validation Assessments ........................7


          FINDING NO. 2 – FSA’s Instructions Did Not Correct Inaccurate Loan

                          Balances in DMCS2 ........................................................................11


          FINDING NO. 3 – FSA Did Not Adequately Oversee Debt Accounts in

                          DMCS2 Not Assigned to a PCA ....................................................12


OBJECTIVE, SCOPE, AND METHODOLOGY ....................................................................15


Enclosure 1: Descriptions of DMCS2 Functions, Processes, and Subprocesses ....................20


Enclosure 2: FSA’s One-Pager Dated March 29, 2013 ............................................................22


Enclosure 3: FSA Comments ......................................................................................................24

        Abbreviations, Acronyms, and Short Forms Used in This Report

Department        U.S. Department of Education

Direct Loan       William D. Ford Federal Direct Loan Program

DMCS              Debt Management Collection System

DMCS2             Debt Management Collection System 2

FFEL              Federal Family Education Loan Program

FSA               Federal Student Aid

GA                Guaranty Agency

GAO               United States Government Accountability Office

Maximus           Maximus, Inc.

NSLDS             National Student Loan Data System

OIG               Office of Inspector General

One-Pager         Requirements Assessment One-Pager Completion Tracker

PCA               Private Collection Agency

TIVAS             Title IV Additional Servicers

Xerox             Xerox Education Solutions, LLC
Final Report
ED-OIG/A02N0004                                                                                        Page 1 of 27



                                      EXECUTIVE SUMMARY



The objective of our audit was to determine whether Federal Student Aid (FSA) accurately
assessed the operating status of the Debt Management Collection System 2 (DMCS2) functions
that it indicated to be fully or partially functioning, including workaround procedures, as of
FSA’s plan for DMCS2’s implementation. We used FSA’s Requirements Assessment One-
Pager Completion Tracker (One-Pager) dated March 29, 2013, as its plan for DMCS2
implementation. FSA used the One-Pager to track the operational status of DMCS2. In
November 2013, FSA stopped using the One-Pager to track the implementation of DMCS2. The
final One-Pager formed the basis of the operational status of DMCS2 for the transition to a new
contractor. FSA also identified deficiencies that were to be corrected by FSA’s initial contractor
and its subsequent contractor.

DMCS2, implemented in October 2011, is the system FSA uses to manage and collect on
defaulted loans (debt accounts). Following the implementation of DMCS2, FSA and its DMCS2
contractor identified multiple deficiencies and operational issues that needed to be corrected in
order for DMCS2 to properly operate. FSA created the One-Pager in November 2011 and used
it to track the operational status of key DMCS2 functions, processes, and subprocesses. 1 As of
March 29, 2013, the One-Pager consisted of 43 functions and 13 processes, with 69 subprocesses
associated with them. See Table 1 below for the operational status of these functions, processes,
and subprocesses.

                                   Table 1. Operational Status of

                           DMCS2 Functions, Processes, and Subprocesses

                 Status                Functions       Processes    Subprocesses
                 Fully Operational         34               8            30
                 Partially
                                            7               5            39
                 Operational
                 In Development/
                 Not Yet Proven to          2               -             -
                 Operate
                        Total              43              13            69


FSA issued its final One-Pager, dated November 15, 2013, which identified 51 of the 56 functions
and processes as operational. The final One-Pager also identified DMCS2 deficiencies that Xerox
Education Solutions, LLC (Xerox), was responsible for correcting and the deficiencies to be deferred
to, and corrected by, FSA’s subsequent contractor, Maximus, Inc. (Maximus), to be addressed using



1
  FSA did not formally define the terms function and process. For the purpose of our audit, functions are executable
DMCS2 tasks that work independently of one another. Processes are also executable DMCS2 tasks composed of
multiple related processes (subprocesses) that are dependent on one another for the overall process to be operational.
If any subprocess is not operational, FSA deems the overall process not operational.
Final Report
ED-OIG/A02N0004                                                                                       Page 2 of 27

a change management plan. FSA’s plan to correct DMCS2’s deficiencies was the subject of another
audit conducted by the Office of Inspector General (OIG). 2

To accomplish our objective, we judgmentally selected 25 of 58 third-party users 3 and received
information from 23 of the 25 users we contacted regarding operational issues. We selected third
parties primarily based on the number and dollar value of loans in their inventories or based on
their performance scores and related payments. Based on information provided by the 23 third-
party users, we judgmentally selected 10 DMCS2 functions, processes, and subprocesses
identified as operating to determine whether the operational status was accurately assessed. In
addition, we interviewed FSA and Xerox officials and reviewed validation documentation for the
10 selected functions, processes, and subprocesses.

Based on work we performed from April 2013 through April 2014, we found that FSA did not
always accurately assess the operational status of the fully or partially operational DMCS2
functions, processes, and subprocesses represented on the One-Pager, dated March 29, 2013.
Based on our selected 10 functions, processes, and subprocesses, we determined FSA did not
accurately assess the operational status of one function and one subprocess. Through
information received from DMCS2 third-party users between June 2013 and April 2014, we
determined that FSA may not have accurately assessed the operational status of an additional
process and four subprocesses. In addition, FSA did not sufficiently document its validation
assessments 4 of the operational status of all 10 functions, processes, and subprocesses that we
selected. As a result, there is a risk that FSA did not accurately assess the operational status of
additional DMCS2 functions, processes, and subprocesses reported as fully or partially
operational on the One-Pager. Further, inaccurately assessed statuses could hamper Maximus’
efforts to make DMCS2 fully operational. We also found that FSA did not provide consistent
and effective instructions to servicers to correct inaccurate loan balances in DMCS2 and, as a
result, inaccurate loan balances remained in DMCS2. Finally, FSA did not adequately oversee
debt accounts in DMCS2 that were not assigned to a private collection agency (PCA) and, as a
result, there was no assurance that debt accounts were properly processed in DMCS2.

We recommend that the Chief Operating Officer for FSA—

    •	 ensure that FSA adequately monitors and validates the implementation and operational
       statuses of DMCS2 functions, processes, and subprocesses;
    •	 develop and implement validation procedures, including documentation requirements,
       using guidance such as FSA’s Enterprise Test Management Standards, for assessing the
       operational statuses of all DMCS2 functions, processes, and subprocesses;
    •	 ensure that documentation is maintained to support the reported operational status of

       DMCS2’s functions, processes, and subprocesses;

    •	 test and validate that the procedures for correcting inaccurate loan balances in DMCS2
       operate as intended;
2
  The purpose of the audit (ED-OIG/A04N0004) was to determine whether FSA’s plan for correcting DMCS2
system deficiencies provided for accountability; specifically, the audit assessed whether the plan included
(1) milestones to ensure Xerox timely corrected system deficiencies and (2) options to hold Xerox accountable if it 

did not have a fully functional system at the end of the contract.

3
  The third-party users were entities that interface with DMCS2 to perform services contracted with FSA.

4
  Validation assessments were the procedures FSA implemented to validate that the DMCS2 functions, processes,

and subprocesses were operational.

Final Report
ED-OIG/A02N0004                                                                     Page 3 of 27

   •	 ensure that the procedures to correct inaccurate loan balances in DMCS2 are consistently
      implemented by all of FSA’s servicers;
   •	 perform an analysis to identify debt accounts in DMCS2 that should have been assigned to a
      PCA but were not and take appropriate actions; and
   •	 develop policies and procedures to monitor and track the debt accounts that are not assigned
      to PCAs to ensure they are properly processed and managed through DMCS2.

We provided a draft of this report to FSA. In FSA’s comments to the draft report, FSA
concurred with our findings and recommendations and stated it has taken steps to ensure the full
functionality of DMCS2 operations. We summarized FSA’s comments at the end of each
finding and included the full text of its comments as Enclosure 3 of this report.
Final Report
ED-OIG/A02N0004                                                                                       Page 4 of 27



                                             BACKGROUND



FSA is responsible for managing the student financial assistance programs authorized under the
Title IV of the Higher Education Act of 1965, as amended. FSA administered two major loan
programs: the William D. Ford Federal Direct Loan (Direct Loan) program and the Federal
Family Education Loan (FFEL) program to assist students in paying for their postsecondary
education. 5 The Direct Loans are made to borrowers by the Department and serviced by
servicers under contract with FSA. The FFEL program loans were issued to borrowers by
private lenders. Following attendance at a postsecondary school, borrowers enter repayment
after a grace period. When borrowers do not make a payment on their Direct Loans after
270 days, the loans are technically in default but are not transferred to DMCS2 until after
360 days of nonpayment. However, this is not always the case for loans made under the FFEL as
defaulted loans for this program are transferred to the U.S. Department of Education
(Department) after meeting certain criteria. If borrowers do not enter into a repayment
agreement on the defaulted loans, the Department refers the debt accounts to one of 22 PCAs 6
that it contracted with for collection of debts. As of September 30, 2014, defaulted Direct Loan
and FFEL program loans totaled about $103 billion. In its budget for fiscal year 2016, the
Department reported net default collections of about $11 billion on defaulted Direct Loan and
FFEL program loans in fiscal year 2014.

On November 20, 2003, FSA entered into a Common Services for Borrowers contract with ACS
Education Solutions, LLC (currently Xerox), 7 to service Direct Loans. In addition to servicing
loans, the Common Services for Borrowers contract required Xerox to perform default management
activities, which included tracking defaulted student loan balances, borrowers’ payments, repayment
agreement information, and loan servicer information, using the Debt Management Collection
System (DMCS). On June 7, 2010, FSA and Xerox agreed to a contract modification that required
Xerox to “enhance, upgrade or replace” DMCS by January 1, 2011. On December 21, 2010, FSA
and Xerox agreed to extend the deadline to February 1, 2011. Under the terms of the contract,
Xerox agreed to provide, at a minimum, the DMCS functionality and enhanced functionality FSA
identified. The enhanced functionality included, but was not limited to, applying financial
transactions to a debt or an account, electronically referring the borrower’s account to a PCA, and
protecting certain accounts from PCA placement (for example, accounts that were in bankruptcy or
assigned to the Department of Justice). Xerox missed the February 1, 2011, deadline and
transitioned from DMCS to DMCS2 in October 2011. At the time of the transition, FSA was aware
of known deficiencies and operational issues with DMCS2. FSA issued a cure notice 8 to Xerox in
February 2012 to allow Xerox an opportunity to (1) cure its failure to implement the required
functionality of DMCS2 in a timely manner and (2) provide a corrective action plan. On

5
  FSA also administers the Federal Perkins Loan Program to assist students. These loans are issued directly to the

borrowers by the postsecondary schools.

6
  There were 22 PCAs as of December 31, 2012.

7
  Xerox Corporation acquired ACS Education Solutions, LLC, in February 2010 and changed the name to Xerox

Education Solutions, LLC, in April 2012.

8
  According to the Federal Acquisition Regulations § 49.402-3(d), if a contractor fails to perform some of the

provisions of the contract or fails to make progress as to endanger performance of the contract, the Government shall

notify the contractor and provide at least 10 days in which to cure the failure.

Final Report
ED-OIG/A02N0004                                                                                      Page 5 of 27

December 14, 2012, FSA and Xerox reached a settlement agreement where Xerox agreed to
continue implementation of the outstanding requirements identified on FSA’s One-Pager and to
complete the DMCS2 enhancements by the end of the Common Services for Borrowers contract.
On September 24, 2013, FSA extended the contract with Xerox through June 30, 2014, to continue
all DMCS2 related services and the completion of development work. The contract also included an
option for Xerox to continue providing services through December 31, 2014. On
September 30, 2013, FSA signed a contract with a new contractor, Maximus, to maintain, operate,
and continue the development of DMCS2. However, FSA issued a stop work order to Maximus on
November 13, 2013, which was lifted on February 24, 2014. On August 1, 2014, Maximus took
over all responsibilities of DMCS2.

FSA’s One-Pager, created November 2011, was a high-level representation of the DMCS2
functionality that FSA used to track the operational statuses of the DMCS2 functions, processes,
and subprocesses. According to the March 29, 2013, One-Pager, we identified 43 functions and
13 processes with 69 subprocesses associated with them. Each function listed on the One-Pager
was independent of other functions. However, processes consisted of multiple subprocesses that
must be operating for the process to function. For each function and subprocess, the One-Pager
provided (1) the actual date that Xerox stated it was functional or the target date that it was
expected to be functional, (2) the actual date that FSA validated it was functional or the target
date that FSA expected to validate the functionality, and (3) the current operational status. FSA
identified the current operational status of each function, process, and subprocess by using one of
three color-coded indicators: green indicated the function, process, or subprocess was in
production and proven to operate with no defects that resulted in a backlog; yellow indicated the
function, process, or subprocess was in production with defects that may or may not result in a
backlog; and red indicated the function, process, or subprocess was in development or test status
but not yet proven to operate at all or production was stopped. See Enclosure 1 for detailed
descriptions of selected DMCS2 functions, processes, and subprocesses. Of the 43 functions,
34 had green statuses, 7 had yellow statuses, and 2 had red statuses. Of the 13 processes with 69
subprocesses associated with them, 8 had green statuses and 5 had yellow statuses. In addition,
the One-Pager identified the functions and subprocesses that required manual or interim
workarounds, which were coded green or yellow. See Enclosure 2 for the One-Pager dated
March 29, 2013.

Recently issued audit reports have identified deficiencies related to DMCS2’s operational status.
The Independent Auditors’ Report on FSA’s financial statements for fiscal year 2012 identified
material weaknesses 9 in internal controls related to the functionality of DMCS2. 10 Due to the
internal control weaknesses, FSA was unable to process rehabilitated loans, FSA was unable to
receive collections through administrative wage garnishments, and DMCS2 was unable to accept
some debt accounts transferred from loan servicers. The independent auditor recommended that
FSA ensure that Xerox resolve and complete the system functionality requirements to bring
DMCS2 to a fully operational status and establish temporary workarounds, as necessary. In
FSA’s audited financial statements for fiscal year 2013, 11 the independent auditor reported that
9
  A material weakness is a deficiency in internal controls where there is a reasonable possibility that a material

misstatement of FSA’s financial statement will not be prevented or detected and corrected timely.

10
   The independent auditor’s report was published with FSA’s “Federal Student Aid Annual Report for Fiscal Year

2012,” November 16, 2012.

11
   The independent auditor’s report was published with FSA’s “Federal Student Aid Annual Report for Fiscal Year

2013,” December 11, 2013.

Final Report
ED-OIG/A02N0004                                                                                           Page 6 of 27

FSA was in the process of addressing the material weaknesses reported in the fiscal year 2012
annual audit report. However, the independent auditor identified significant deficiencies 12 in
internal controls related to the operational status of DMCS2 that continued to occur in fiscal
year 2013. The deficiencies affected the reliability of debt accounts in DMCS2 and the financial
statements. A primary issue, which was identified in fiscal year 2012, involved debt accounts
that were unable to be transferred into DMCS2. In FSA’s audited financial statements for fiscal
year 2014, the independent auditor reported that the significant deficiencies related to DMCS2’s
functionality reported in fiscal year 2013 were significantly reduced and that minor issues
remained. 13 The independent auditors identified other deficiencies in internal controls related to
DMCS2. The independent auditors stated that “[while] the nature and magnitude of these other
deficiencies in internal controls were not considered important enough to merit the attention of
those charged with governance, they are considered of sufficient importance to merit
management’s attention.” On December 13, 2012, the OIG issued an alert memorandum, “Debt
Management Collection System 2,” (ED-OIG/L02M0008) to inform FSA of DMCS2’s inability
to accept the transfer of debt accounts from FSA loan servicers. The OIG found that since the
DMCS2 conversion, more than $1.1 billion in debt accounts should have been transferred to
DMCS2 for management and collection but were not because DMCS2 functionality issues
prevented the transfers. In addition, on May 15, 2013, the OIG issued an alert memorandum,
“Federal Student Aid Paid Private Collection Agencies Based on Estimates,” (ED­
OIG/L02N0002) reporting that PCAs were paid commissions based on estimated collection
activity because DMCS2 functionality issues prevented the creation of invoices using collection
information from DMCS2. The March 2014 U.S. Government Accountability Office (GAO)
report, “Federal Student Loans: Better Oversight Could Improve Defaulted Loan Rehabilitation,”
(GAO-14-256) stated that FSA performed limited oversight of Xerox and insufficient testing of
DMCS2 functionality that adversely affected loan rehabilitations.




12
   A significant deficiency, while less severe than a material weakness, is a deficiency in internal controls that merits

attention by those charged with governance.

13
   The independent auditor’s report was published with FSA’s “Federal Student Aid Annual Report for Fiscal Year

2014,” November 14, 2014.

Final Report
ED-OIG/A02N0004                                                                                       Page 7 of 27



                                            AUDIT RESULTS



FSA did not always accurately assess the operational status of the fully or partially operating
DMCS2 functions, processes, and subprocesses represented on the One-Pager, dated
March 29, 2013. We judgmentally selected 10 functions, processes, and subprocesses that FSA
indicated were fully or partially operational and found that FSA did not accurately assess the
operational status of one function and one subprocess. Through information received from
DMCS2 third-party users between June 2013 and April 2014, we determined that FSA may not
have accurately assessed the operational status of an additional process and four
subprocesses. In addition, FSA did not sufficiently document its validation assessments of the
operational status of all 10 functions, processes, and subprocesses that we selected. As a result,
there is a risk that FSA did not accurately assess the operational status of additional DMCS2
functions, processes, and subprocesses reported as fully or partially operating on the One-Pager.
Finally, FSA did not provide Title IV Additional Servicers (TIVAS) with consistent and
effective instructions to correct inaccurate loan balances in DMCS2, and FSA did not adequately
oversee debt accounts in DMCS2 that were not assigned to a PCA.

FSA used the One-Pager to track the operational status of DMCS2. On its final One-Pager,
dated November 15, 2013, FSA identified DMCS2 deficiencies that Xerox was responsible for
correcting and the deficiencies to be deferred to, and corrected by, Maximus using a change
management plan. Therefore, while our audit focused on DMCS2’s operational status as of
March 29, 2013, work to address DMCS2’s deficiencies continued. FSA’s plan to correct
DMCS2’s deficiencies was the subject of another audit conducted by the OIG. 14

FINDING NO. 1 – FSA Did Not Always Accurately Assess the Operational Status
                for DMCS2 Functions, Processes, and Subprocesses and Did Not
                Sufficiently Document its Validation Assessments

FSA did not always accurately assess the operational status of the fully and partially operating
DMCS2 functions, processes, and subprocesses represented on the One-Pager. FSA did not
accurately assess the operational status of the PCA Inbound function and PCA Litigation
Packages subprocess. In addition, through interviews and electronic communication with
DMCS2 third-party users and FSA’s default director, we determined that FSA may not have
accurately assessed the operating status of the Refund process. We also determined that FSA
may not have fully and accurately assessed the operational status of the four Close-Out
subprocesses associated with the Rehabilitation process, the Consolidation process, the
Compromises process, and the Discharge/Cancellations process. In addition, FSA did not
sufficiently document its validation assessments to support the operating status of all 10
functions, processes, and subprocesses that we selected.


14
  The purpose of the audit (ED-OIG/A04N0004) was to determine whether FSA’s plan for correcting DMCS2
system deficiencies provided for accountability; specifically, the audit assessed whether the plan included
(1) milestones to ensure Xerox timely corrected system deficiencies and (2) options to hold Xerox accountable if it
did not have a fully functional system at the end of the contract.
Final Report
ED-OIG/A02N0004                                                                                      Page 8 of 27

FSA Inaccurately Assessed the PCA Inbound Function as Fully Operational
FSA inaccurately assessed the operational status of the PCA Inbound function it deemed fully
operational in October 2012. The PCA Inbound function permitted PCAs to submit five files,
one of which was the Account Return File. This file enabled PCAs to return debt accounts from
their inventories to DMCS2 if the PCAs chose not to pursue collection activities or to return
accounts that were paid in full or compromised. 15 Of the 11 PCAs we contacted that used the
Account Return File, 2 stated that they submitted debt accounts to FSA, but the debt accounts
were not removed from their inventories in DMCS2. If this function had been operating as
intended, the debt accounts would have been removed from the PCAs’ inventories after the
PCAs submitted the accounts on the Account Return File. Because the accounts were not
properly removed from PCAs inventories, the accounts could not be reassigned to another PCA
for collections, or accounts paid in full or compromised could not be properly closed in DMCS2.

FSA Inaccurately Assessed the PCA Litigation Package Subprocess as Fully Operational
FSA inaccurately assessed the operational status of the PCA Litigation Package subprocess it
deemed fully operational as of March 20, 2013. The PCA Litigation Packages subprocess
enables PCAs to submit debt accounts for litigation if they are unable to recover funds through
their normal collection activities. Once a PCA submits a litigation package, FSA reviews the
litigation package, determines whether the PCA provided all the required documentation, and
accepts or rejects the package. Of the 11 PCAs contacted, 5 PCAs stated that they were unable
to submit any litigation packages as of March 29, 2013. According to one PCA, it could not
submit litigation packages to FSA because the information it needed to submit eligible debt
accounts for litigation was not available in DMCS2. All five PCAs stated that new procedures
for submitting litigation packages started on July 1, 2013. FSA agreed that this subprocess was
not operating as intended as of March 29, 2013. In April 2014, a PCA informed us that it was
unable to submit litigation packages for accounts with electronically signed promissory notes.

Refund Process May Not Be Accurately Assessed
Of the 11 PCAs we contacted, 6 had debt accounts with negative balances that should have been
removed from their inventories in DMCS2 as part of the Refund process. The Refund process
involves FSA returning overpayments on the total debt account balance to borrowers. FSA’s
default director stated that the debt accounts with negative balances were accounts where the
borrowers were due a refund. The Refund process was categorized as fully operational. FSA
deemed the Refund process as fully operational, but if FSA had approved the refunds and
returned the overpayments to borrowers, then the associated debt accounts would have been
removed from the PCAs’ inventories. In a written response to our finding, FSA agreed that
accounts with negative balances remained in PCAs’ inventories.

Close-Out Subprocesses May Not Be Accurately Assessed
Of the 11 PCAs we contacted, 7 had debt accounts with $0 balances that should have been
removed from their inventories in DMCS2 as part of four Close-Out subprocesses. A Close-Out
subprocess involves identifying debt accounts with $0 balances and removing the accounts from
the PCAs’ inventories. Four processes shown on the One-Pager contain a Close-Out subprocess:
the Rehabilitation, Consolidations, Compromises, and Discharge/Cancellations processes. All
four subprocesses were categorized as fully operational. If these Close-Out subprocesses were

15
  A compromise occurs when the borrowers agree to pay a portion of their debt in a set timeframe to satisfy the
debt.
Final Report
ED-OIG/A02N0004                                                                                   Page 9 of 27

fully operational, then DMCS2 should have removed $0 balance accounts from PCAs’
inventories. In a written response to our finding, FSA agreed that accounts with $0 balances
remained in PCAs’ inventories.

FSA Did Not Sufficiently Document its Validation Assessment of the Operational Statuses of
DMCS2 Functions, Processes, and Subprocesses
FSA did not sufficiently document its validation assessments to support the operational status
reported on the One-Pager for the 10 functions, processes, and subprocesses that we selected.
FSA did not document the procedures it used to perform validation. However, for the purpose of
our audit, FSA prepared a written description of the procedures that it claimed it implemented in
March 2012. According to the procedures, FSA subject matter experts developed and used
validation plans to perform and record the validation testing. The project manager and/or
validation lead reviewed the validation test results and conclusions. An FSA management team
subsequently used the validation test results and conclusions to determine the operational status
of each function, process, or subprocess.

In a written response to this issue, FSA acknowledged that it did not fully document the
validation efforts of FSA managers and subject matter experts. However, FSA stated that no
DMCS2 functions were deemed to be operational without an FSA review of deliverables,
reports, or other data that supported the conclusion. Of the 10 functions, processes, and
subprocesses we reviewed, FSA did not have validation plans for 6. FSA did not provide
sufficient validation artifacts (supporting documentation such as e-mails, spreadsheets, and
reports) to support the extent of the validations performed for any of the 10 functions, processes,
and subprocesses.

According to GAO’s “Standards for Internal Control in the Federal Government,”
November 1999, one of the five standards is control activities. Control activities include reviews
that require managers to compare actual performance to planned or expected results and analyze
significant differences. Control activities also include application controls for information
systems. The application system development and maintenance control provides the structure
for safely developing new systems and modifying existing systems. Included are documentation
requirements; authorizations for undertaking projects; and reviews, testing, and approvals of
development and modification activities before placing systems into operation.

FSA did not accurately assess the operational status of the PCA Inbound function and PCA
Litigation Package subprocess and may not have accurately assessed the operational status of the
Refund process and Close-Out subprocesses. This occurred because FSA did not adequately
monitor and validate the implementation of DMCS2 to ensure that DMCS2 functions, processes,
and subprocesses were operational and continued to operate as intended. FSA’s management
decided not to follow its policies and procedures, such as using a configuration management
plan, 16 as it implemented DMCS2. In April 2014, FSA provided us with an unapproved initial
draft of the DMCS2 Configuration Management Plan, dated June 24, 2010. FSA allowed Xerox
to use its own configuration plan to track changes and implement corrections to DMCS2 but did
not adequately oversee Xerox as it was doing so.

16
  A configuration management plan describes the methodology for implementing a process for identifying system
elements to control changes to the system, maintain system integrity, and to account for changes throughout the
system’s life cycle.
Final Report
ED-OIG/A02N0004                                                                       Page 10 of 27

FSA did not sufficiently document its assessments of the operational statuses because its
validation procedures did not provide instructions to ensure staff maintained validation artifacts.
According to an FSA business operations specialist, the validation procedures were developed
without reviewing applicable guidance or standards for performing validation testing. FSA’s
Enterprise Test Management Standards, issued in September 2007, contained the standards and
policies for test phases and test types, test planning and defect management, and test artifacts and
testing techniques.

Because FSA did not always accurately assess the operational status of DMCS2 functions,
processes, and subprocess, FSA may not have identified and corrected DMCS2 defects. Further,
FSA may not be able to ensure that borrowers’ debts were rehabilitated timely, borrowers’
accounts were forwarded to FSA’s servicers, and borrowers’ refunds for overpayments were
paid. Because FSA did not maintain sufficient documentation, it could not support that it
accurately assessed the operational status of the DMCS2 functions, processes, and subprocesses
represented on the One-Pager. Further, there is a risk that FSA did not accurately assess the
operational status of additional DMCS2 functions, processes, and subprocesses reported as fully
or partially operating on the One-Pager. On the final One-Pager dated, November 15, 2013, FSA
noted deficiencies associated with the functions, processes, and subprocesses that were to be
deferred to FSA’s subsequent contractor, Maximus. The remaining deficiencies and additional
development items were to be addressed by Maximus using a change management plan the
contract required and FSA tracked by using a change management process. There is a risk that
Maximus could be hampered in correcting the remaining deficiencies and additional
development items to make DMCS2 fully functional.

Recommendations

We recommend that the Chief Operating Officer for FSA —

1.1	   Ensure that FSA adequately monitors and validates the implementation and operational
       statuses of DMCS2 functions, processes, and subprocesses.

1.2	   Develop and implement validation procedures, including documentation requirements,
       using guidance such as FSA’s Enterprise Test Management Standards, for assessing the
       operational statuses of all DMCS2 functions, processes, and subprocesses.

1.3	   Ensure that FSA maintains documentation to support the reported operational status of
       DMCS2’s functions, processes, and subprocesses.

FSA’s Comments
FSA concurred with Finding No. 1 and its recommendations. In its response, FSA provided a
description of actions it has taken or intends to take to address this finding and its
recommendations.
Final Report
ED-OIG/A02N0004                                                                                    Page 11 of 27

FINDING NO. 2 – FSA’s Instructions Did Not Correct Inaccurate Loan Balances in
                DMCS2

FSA did not provide consistent and effective instructions to the TIVAS to correct inaccurate loan
balances in DMCS2. All four TIVAS indicated DMCS2 contained inaccurate loan balances.
FSA provided instructions, which did not correct inaccurate loan balances in DMCS2, to three of
the four TIVAS and did not provide any instructions to the fourth TIVAS.

The inaccurate loan balances in DMCS2 were a result of DMCS2 not reflecting corrections to
disbursements. According to a TIVAS, it received adjustments to loans after the loan had
already been transferred into DMCS2. This statement was verified through FSA documentation,
which specified that disbursement records and adjustments may come from the Common
Origination and Disbursement system, 17 Loan Consolidation, or FSA. It also specified that these
adjustments can be TIVAS activities that were not processed before the loan was transferred to
DCMS2.

FSA’s instructions to the three TIVAS did not correct the inaccurate loan balances in DMCS2.
According to one TIVAS, FSA instructed it to recall 18 debt accounts with lower actual balances
than those reflected in DMCS2 and to service these accounts as though they were not defaulted.
This would provide the borrower with an opportunity to make lower monthly payments based on
the borrower’s actual loan balance. Because FSA did not provide this TIVAS with instructions
regarding accounts with higher actual loan balances, these accounts remained in DMCS2. FSA
suggested that another TIVAS recall the debt accounts from DMCS2, correct the loan balances,
and resubmit the debt accounts to DMCS2. However, according to this TIVAS, following FSA’s
instructions to resubmit the recalled accounts would have resulted in the accounts not being able
to be reassigned in DMCS2. This TIVAS used a spreadsheet to manually maintain these
accounts that had inaccurate loan balances in DMCS2. FSA instructed the third TIVAS to
manually maintain the accounts until DMCS2 was able to process the corrections. The fourth
TIVAS did not take any action with respect to accounts with inaccurate loan balances in DMCS2
because it had not received instructions from FSA.

On March 5, 2014, FSA provided us with proposed procedures for TIVAS to correct inaccurate
loan balances in DMCS2. According to one TIVAS, the procedures were implemented in
July 2014. The procedures instructed the servicers to submit correct loan balance information to
FSA for approval. After FSA’s approval, TIVAS will forward the information to Xerox to
correct the loan balances in DMCS2. We noted the procedures did not include a process to
follow for corrections to accounts no longer in DMCS2 due to rehabilitation, consolidation, or
any other process that required the accounts to be closed in DMCS2.

According to GAO’s “Standards for Internal Control in the Federal Government,” control
activities are one of the five standards for internal control. Control activities help to ensure that
all transactions are completely and accurately recorded. Control activities include the accurate
and timely recording of transactions and events.

17
   The Common Origination and Disbursement system is used to create, deliver, and report the Department grants

and Direct Loans.

18
   The TIVAS Recall function allows TIVAS to initiate a transfer of debts and the associated transaction history

from DMCS2 to the TIVAS for servicing.

Final Report
ED-OIG/A02N0004                                                                      Page 12 of 27

Because FSA did not provide effective instructions to correct inaccurate loan balances, the
inaccurate loan balances remained in DMCS2. Further, inaccurate loan balances in DMCS2
would cause collection activities, rehabilitations, and consolidations to be based on inaccurate
loan balances. In addition, if the loan balances were understated in DMCS2 and the borrowers
repaid the inaccurate balances in full, the borrowers would be liable for repaying the remaining
amount of the debt to the Department. Likewise, if the balances were overstated in DMCS2 and
the borrowers repaid the inaccurate balance in full, the borrowers would have paid more than the
amount of their actual debt, and the Department would owe such borrowers a refund.

Recommendations

We recommend that the Chief Operating Officer for FSA —

2.1	   Test and validate that the procedures for correcting inaccurate loan balances in DMCS2
       operate as intended.

2.2	   Ensure that the procedures to correct inaccurate loan balances in DMCS2 are consistently
       implemented by all of FSA’s servicers.

2.3	   Ensure that all rehabilitated or consolidated loans that were transferred from DMCS2 to a
       servicer prior to corrective procedures being implemented reflect accurate loan balances.

FSA’s Comments
FSA concurred with Finding No. 2 and its recommendations. In its response, FSA provided a
description of actions it has taken or intends to take to address this finding and its
recommendations.

FINDING NO. 3 – FSA Did Not Adequately Oversee Debt Accounts in DMCS2 Not
                Assigned to a PCA

FSA did not adequately oversee debt accounts not assigned to a PCA to ensure the accounts were
properly processed through DMCS2. FSA’s default director stated that a debt account was not
assigned to a PCA when (1) the borrower entered into a repayment agreement with the
Department within 65 days of the borrower receiving an initial default notification or (2) the debt
account had a balance under $500. Instead of assigning FSA staff or a servicer to manage these
debt accounts, FSA relied on DMCS2, which was not fully operational, to ensure that payments
were received and credited to the borrower accounts, to track the number of payments made, to
identify the debt accounts eligible for rehabilitation, and to assign debt accounts automatically to
PCAs when borrowers did not maintain their repayment agreements.

We requested a DMCS2 query for the universe of accounts that had an active repayment
agreement, were not currently assigned to a PCA, and had resided in DMCS2 for at least
95 days. We requested that the query exclude all debt accounts that would never have been
assigned to a PCA, such as accounts with bankruptcy or disability status. According to FSA’s
query results, as of September 4, 2013, about 228,000 debt accounts totaling more than
$748 million in DMCS2 met these criteria. We were unable to determine whether the query
results were accurate and complete. However, we reviewed the query results to obtain an
understanding of these accounts.
Final Report
ED-OIG/A02N0004                                                                     Page 13 of 27

Our analysis of FSA’s query results identified more than 6,100 of the approximately 228,000
debt accounts with a $0 balance and more than 2,600 with a balance less than $0. We found debt
accounts with $0 and negative balances that may not have been properly closed in DMCS2. This
was consistent with the issues identified by PCAs as stated in “Close-Out Subprocesses May Not
Be Accurately Assessed” and “Refund Process May Not Be Accurately Assessed” sections of
Finding 1. FSA’s default director stated that FSA kept the $0 loan balance accounts in DMCS2
for historical information and reporting purposes. FSA stated the presence of these $0 balance
accounts in DMCS2 did not result in harm to borrowers. However, until these accounts are
closed out, the borrowers’ account could still reflect a defaulted status on their credit report.
Also, borrowers who overpaid on an account may not receive a refund from the Department.

We also found debt accounts that had an incorrect repayment status in DMCS2. The repayment
statuses, which are described in Table 2, were labeled active, cancelled, broken, or completed, or
were left blank.

                     Table 2. Description of DMCS2 Repayment Status
 Status             Description
 Active             Borrower entered into a payment plan and was making regular payments.
 Cancelled          Borrower entered into a payment plan that was cancelled by Vangent, a
                    subcontractor to Xerox.
 Broken             Borrower entered into a payment plan but had not made the required
                    payments for 60 consecutive days.
 Completed          Borrower entered into a payment plan and made all required payments.
 Blank              Borrower had not entered into a repayment plan.

According to FSA’s default director, DMCS2 was supposed to assign an account automatically
to a PCA when a borrower had not made the required payments for 60 consecutive days because
the account was no longer in active repayment. Our analysis of FSA’s query results of the
approximately 228,000 debt accounts identified more than 52,000 accounts that had an active
repayment status even though the borrower failed to make the required payments. These debt
accounts should have had a broken repayment status and should have been automatically
assigned to a PCA.

Furthermore, once a borrower cancelled or broke a repayment agreement, the borrower’s debt
account should have been assigned to a PCA. Our analysis of FSA’s query results identified
more than 27,000 of the approximately 228,000 debt accounts still in DMCS2 with a cancelled
repayment status. We provided FSA with six examples of debt accounts that had a cancelled
repayment agreement. FSA determined that three of the six accounts should have been assigned
to a PCA and that three were misidentified as cancelled in DMCS2. According to FSA, the three
borrowers that were misidentified as cancelled had entered into new repayment agreements and
were actually in active repayment. Therefore, there are debt accounts with a cancelled payment
status that should have been assigned to a PCA or that had inaccurate repayment statuses
recorded in DMCS2.

According to GAO’s “Standards for Internal Control in the Federal Government,”
November 1999, control activities are one of the five standards for internal control. Control
activities include reviews that require managers to compare actual performance to planned or
Final Report
ED-OIG/A02N0004                                                                      Page 14 of 27

expected results and analyze significant differences. Control activities also include controls over
information processing. These activities include application controls, which are designed to help
ensure completeness, accuracy, authorization, and validity of all transactions during the
application processing. Control activities should result in timely action being taken on
exceptions or information that requires follow-up.

FSA did not have sufficient control activities to identify and manage debt accounts in DMCS2
that had not been assigned to a PCA. FSA considered the $0 and negative debt accounts to be a
low priority that resulted in no harm to the borrower. FSA was unaware that DMCS2 was not
automatically assigning debt accounts to PCAs when a borrower was 60 or more days delinquent
on a required payment or when a borrower cancelled or broke a repayment agreement because it
was not adequately monitoring debt accounts not assigned to a PCA.

Recommendations

We recommend that the Chief Operating Officer for FSA —

3.1	   Perform an analysis to identify debt accounts in DMCS2 that should have been assigned
       to a PCA but were not and take appropriate actions.

3.2	   Develop policies and procedures to monitor and track the debt accounts that are not
       assigned to a PCA to ensure they are properly processed and managed through DMCS2.

3.3	   Ensure that borrowers with a negative balance are issued a refund for the amount
       overpaid and update their account status to ensure their accounts are closed in DMCS2.

3.4	   Ensure that accounts with a balance of $0 are properly closed in DMCS2.

FSA’s Comments
FSA concurred with Finding No. 3 and its recommendations. FSA stated that it had taken or
plans to take steps to address the issues identified in the finding.
Final Report
ED-OIG/A02N0004                                                                  Page 15 of 27



                 OBJECTIVE, SCOPE, AND METHODOLOGY



Our objective was to determine whether FSA accurately assessed the operating status of the
DMCS2 functions that it indicated to be fully or partially functioning, including workaround
procedures, as of FSA’s plan for DMCS2’s implementation. We used FSA’s One-Pager dated
March 29, 2013, as its plan for DMCS2 implementation.

To achieve our objectives, we performed the following.

1.	 Obtained and reviewed the FSA March 29, 2013, One-Pager.
2.	 Reviewed selected provisions of
    •	 the Federal Acquisition Regulation;
    •	 the Code of Federal Regulations;
             o Title 34 C.F.R. Part 682, Federal Family Education Loan Program; and
             o Title 34 C.F.R. Part 685, William D. Ford Federal Direct Loan Program.
    •	 National Institute of Standards and Technology Special Publication 800-53; Revision 4,
        Security and Privacy Controls for Federal Information Systems and Organizations;
    •	 Office of Management and Budget Circular No. A-123, Management's Responsibility for
        Internal Control; and
    •	 FSA’s Business Operations Change Management Plan, Version 1.1, dated 

        June 2012.

3.	 Obtained an understanding of the roles and responsibilities of key personnel involved in
    updating the One-Pager through interviews with Xerox officials and FSA’s Business
    Operations officials.
4.	 Obtained an understanding of how the One-Pager statuses were determined through
    interviews with officials from FSA’s Business Operations office.
5.	 Obtained an understanding of the functions and processes identified on the One-Pager
    through interviews with FSA Business Operations staff and the examination of the
        •	 Draft Debt Recovery Services: High Level Requirements, dated April 7, 2010;
        •	 DMCS Validation Index;
        •	 DMCS Business Processes and Functions Training Guide - Mapped to the One-Pager;
        •	 DMCS2 Workarounds as of March 29, 2013;
        •	 DMCS2 Production Repository; and
        •	 Technical Proposal – Task Order 95, dated July 2010.
6.	 Obtained an understanding of the internal and external interfaces of DMCS2 to identify
    DMCS2 third-party users.
7.	 Obtained an understanding of the method FSA used to update the One-Pager and validation
    procedures through interviews with FSA officials and reviewed the validation procedures to
    determine whether FSA supported its decision on the operational statuses for the functions,
    processes, and subprocesses selected from the One-Pager.
8.	 Judgmentally selected 10 DMCS2 functions, processes, and subprocesses included on the
    March 29, 2013, One-Pager to review documentation to support the operational statuses. See
    the “Sampling Methodology” and “Review of Validation Procedures” sections below for
    details.
Final Report
ED-OIG/A02N0004                                                                   Page 16 of 27

9.	 We reviewed the following audit reports:
    •	 U.S. Department of Education Fiscal Year 2012 Agency Financial Report,

       November 16, 2012; 

    •	 Federal Student Aid Annual Report for Fiscal Year 2012, November 16, 2012;
    •	 Federal Student Aid Annual Report for Fiscal Year 2013, December 11, 2013;
    •	 Federal Student Aid Annual Report for Fiscal Year 2014, November 14, 2014;
    •	 OIG Final Alert Memorandum, “Debt Management Collection System 2,”

       December 13, 2012 (ED-OIG/L02M0008);

    •	 OIG Final Alert Memorandum, “Federal Student Aid Paid Private Collection Agencies
       Based on Estimates,” May 15, 2013 (ED-OIG/L02N0002);
    •	 OIG Final Consulting Report, “Title IV Additional Servicers Capacity Assessment”
       December 15, 2011 (ED-OIG/S15L0001); and
    •	 GAO Report, “Federal Student Loans: Better Oversight Could Improve Defaulted Loan
       Rehabilitation” (GAO-14-256) March 2014.

Selection Methodology

Third-Party Users

The third parties that interfaced with DMCS2 included, but were not limited to, the Department
of Justice, the Internal Revenue Service, the Department of the Treasury, schools, lenders,
TIVAS, guaranty agencies (GAs), and PCAs. We judgmentally narrowed our universe to
TIVAS, GAs, and PCAs because we determined they had the highest level of interaction with
DMCS2 and could best provide insight into whether DMCS2 functions, processes, and
subprocesses were operating as intended.

We judgmentally selected 25 of 58 DMCS2 third-party users in our universe to obtain
information regarding issues users experienced with DMCS2. The 25 selected users represented
all 4 TIVAS, 10 of 32 GAs, and 11 of 22 PCAs. We received information from 23 of the 25
users we contacted.

We conducted a site visit at one of the four TIVAS. To select a TIVAS for our site visit, we
chose the TIVAS with the largest number of accounts and largest total loan balance. We
requested information on issues they experienced when using DMCS2 from the three remaining
TIVAS.

We conducted a site visit at 1 of the 32 GAs. The GA was selected because of its proximity to
the TIVAS where we conducted a site visit. Additionally, we judgmentally selected 9 of the
remaining 31 GAs from which to request information on issues they experienced when using
DMCS2. Seven GAs responded. To select the nine GAs, we analyzed the amount of loans they
transferred to DMCS2 from March 2012 through June 2013 and the number and dollar value of
loans they had in their inventory. We selected one GA with the highest loan accounts transfers
to DMCS2, four GAs with the highest number and dollar value of loans they had in their
inventory, two medium GAs based on loan volume (about 100,000 loans), one GA with a high
loan dollar value compared to the number of loans, and one GA that had not transferred any
loans.
Final Report
ED-OIG/A02N0004                                                                                    Page 17 of 27

We conducted a site visit at one large PCA and one small PCA of the 22 PCAs. 19 To select these
PCAs, we ranked the PCAs based on (1) how their Competitive Performance and Continuous
Surveillance scores changed from DMCS to DMCS2, (2) whether the PCA received an estimated
bonus that might require repayment, and (3) changes in the PCAs invoice amounts from fiscal
year 2011 to 2012. We selected the large PCA with the greatest decrease in their Competitive
Performance and Continuous Surveillance score change and the small PCA with the smallest
increase in invoice amounts from fiscal year 2011 to 2012. We judgmentally selected, using the
same methodology noted above along with how long the large PCAs were contracted with FSA,
seven large and two small PCAs from the remaining 20 PCAs to obtain information regarding
their experience with DMCS2.

We conducted site visits at one TIVAS, one GA, and two PCAs. During the site visits, we
interviewed management staff responsible for overseeing the debt management services. We
also reviewed documentation, such as policy and procedure manuals, issue logs, and email
communication that related to DMCS2. We obtained information through electronic
communication from the remaining 19 users.

One-Pager Functions, Processes, and Subprocesses
We judgmentally selected One-Pager functions, processes, and subprocesses to review based on
issues identified by the third-party users we contacted and our analysis of the historical trends of
the functions and processes that had changes to its statuses within one year of the
March 29, 2013 One-Pager. We associated the characteristics of the operational issues identified
by the third-party users we contacted to the characteristics of the functions, processes, and
subprocesses on the One-Pager. We selected the functions, processes, or subprocesses for
review that had an operational status. The One-Pager consisted of 43 functions and
13 processes, with 69 subprocesses associated with them. The universe that we selected from
consisted of 34 functions and 8 processes, with 30 subprocesses associated with them that were
identified as operational. 20 Our selection of the 10 functions, processes, and subprocesses
consisted of 5 of the 34 DMCS2 functions and 2 of the 8 processes identified as operational and
3 subprocesses, which were part of 3 of 5 DMCS2 processes, identified as partially operational
on the One-Pager. We selected the following functions, processes, and subprocesses:

1. DMCS2 Functions
   • Title IV Additional Servicers Assignments,
   • Guaranty Agency Assignments,
   • Regular Lockbox,
   • Administrative Wage Garnishment Lockbox, and
   • Private Collection Agency Inbound.

2. DMCS2 Processes
   • Consolidations, and
   • Compromises.



19
  FSA classified the PCAs as small or large businesses. There were five small PCAs and 17 large PCAs.

20
  Seven functions and 5 processes, with 39 subprocesses associated with them, were identified as in production with

defects. The remaining 2 functions were identified as in development and not yet proven to function.

Final Report
ED-OIG/A02N0004                                                                                   Page 18 of 27

3. DMCS2 Subprocesses
   • Treasury Offset Program Weekly Update File,
   • Rehabilitation Exceptions, and
   • PCA Litigation Packages.

A description of these functions, processes, and subprocesses is provided as Enclosure 1 to this
report.

Review of Validation Procedures
We reviewed FSA’s documentation used to support the operational status for each of the
10 selected functions, processes, and subprocesses. We determined whether FSA had validation
plans for the 10 selected functions, processes and subprocesses. We reviewed the validation
plans to determine evidence of validation testing, validation results, and approval of the
validation plan. The evidence of validation testing included, but was not limited to, whether the
anticipated and actual validation dates was documented, validation criteria were provided, and
the debt accounts being tested were identified. For validation results, we reviewed the plans to
determine whether FSA documented conclusions, comments, test results, the accuracy rate of a
validation test, and the impact of the nonoperational function or process. Lastly, we reviewed
the plans to determine whether the subject matter expert coordinator approved validation plans.

Because there is no assurance that the judgmental selection of (1) third-party users and (2) One-
Pager functions, processes, and subprocesses were representative of the entire universe, the
results should not be projected over the third-party users or One-Pager functions, processes, and
subprocesses that were not selected for review.

Debt Accounts Not Assigned to PCAs
During our audit, we became aware of debt accounts in DMCS2 that were not assigned to PCAs
for collections (see Finding 3). We requested that FSA query DMCS2 to obtain accounts that
had an active repayment agreement, were not currently assigned to a PCA, had resided in
DMCS2 for at least 95 days, 21 and excluded all debt accounts that should not have been assigned
to a PCA, such as the borrowers with loans in disability or bankruptcy status. The query
identified the borrower, the borrowers’ debt account balance, the payment agreement status, and
whether the borrowers made payments within 95 days of the date of the query. The payment
agreement statuses were labeled as active, cancelled, broken, or completed, or the status was
blank. According to FSA’s DMCS2 query results, 228,096 debt accounts totaling more than
$748 million in DMCS2 met these criteria as of September 4, 2013.

We attempted to assess the accuracy of the data we received by reconciling a sample of records
to National Student Loan Data System (NSLDS) loan records. However, we found the debt
account identifiers between DMCS2 and NSLDS were not the same. We also attempted to
reconcile based on the borrowers’ identification numbers; however, we could not match the debt
accounts to the borrowers with certainty because the borrowers’ loan balances could vary
between the two systems. In addition, the loan statuses and associated dates in NSLDS did not
match the tags DMCS2 used. Therefore, we were unable to verify the accuracy, completeness,
and reliability of the query results. However, we note that DMCS2 is the system of record for

21
  We used a conservative calculation of 95 days for the FSA requested query to exclude the accounts that may be in
the process of being transferred to PCAs.
Final Report
ED-OIG/A02N0004                                                                    Page 19 of 27

managing and servicing the debt accounts and the main resource for FSA to provide information
on the management and servicing of the debt accounts. As a result, we decided to use the
DMCS2 query results provided by FSA to gain an understanding of the debt accounts not
assigned to a PCA. We performed the following for accounts with balances over $500.

   •	 For accounts with active repayment agreements, we reviewed the query results to 

      determine whether payments were made during the past 95 days.

   •	 For accounts with cancelled or broken repayment agreement statuses, we provided a
      sample of six debt accounts to FSA to research whether the accounts should have been
      forwarded to PCAs.
   •	 For accounts without a repayment agreement status, we provided a sample of 20 debt
      accounts to FSA and reviewed tags associated with the accounts to research whether the
      accounts should have been forwarded to PCAs.

We did not perform reviews on accounts under $500, $0 balance accounts, and negative balance
accounts because these accounts would never be sent to PCAs for collections based on FSA’s
operating procedures.

We conducted audit fieldwork from April 2, 2013, through March 19, 2014. We performed
fieldwork at FSA’s office in Washington, DC, and held the exit conference to discuss the results
of the audit with FSA officials on March 19, 2014. We also performed limited follow-up work
with FSA and some third-party users in April 2014.

We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objectives.
Final Report
ED-OIG/A02N0004                                                                Page 20 of 27

Enclosure 1: Descriptions of DMCS2 Functions, Processes, and
             Subprocesses
       Name                                        Description
 Title IV Additional
                       Assignments were made from servicers to DMCS2 when a debt
      Servicers
                       reached 360 days delinquent. Assignments of the debt to DMCS2
    Assignments
                       were done through a systemic or manual process.
       Function

                       Assignments were made from guaranty agencies to DMCS2 when a
 Guaranty Agency
                       debt had reached 360 days delinquent. Assignments of the defaulted
   Assignments
                       debt to DMCS2 system was done through a systemic or manual
    Function
                       process.
 Regular Lockbox
                       Voluntary payments submitted by the borrower to a payment lockbox.
    Function
                   Garnishment of payments from a borrower’s employer as a result of
  Administrative
                   the borrower not responding to initiation of voluntary payment.
Wage Garnishment
                   Administrative Wage Garnishment forced collections were sent to a
Lockbox Function
                   payment lockbox.
                   A systematic exchange of five data files that have been processed by
Private Collection
                   the PCAs and needed to be synched with DMCS2. The five files were
Agencies Inbound
                   Account Returns, Mailed Letters, Account Billing, Account Update,
     Function
                   and Returned Letters.
 Treasury Offset   DMCS2 reported all decreases; increases; refunds; refund adjustments;
 Program Weekly    inactivations; reactivations; payment stream reductions, stops, and
   Update File     starts; address changes; name changes and so forth on a Treasury
   Subprocess      Offset Program Weekly Update file.
  Rehabilitation
                   This process allowed a user to manually flag a debt as eligible for
    Exceptions
                   rehabilitation.
   Subprocess
  PCA Litigation
                   Once a PCA declared the debt uncollectable, the account was referred
     Package/
                   to the Department of Justice for litigation action.
   Subprocess
                   A borrower that made satisfactory voluntary payments over a specific
                   period of time qualified to consolidate their defaulted debts with other
                   debts. Upon completion of the terms of their payment schedule and
  Consolidations
                   the approval of their consolidation request, the borrower’s defaulted
      Process
                   debt was paid off by a consolidation payment from the consolidating
                   servicer in DMCS2. The new debt amount became the borrower’s
                   new consolidation loan and placed with a non-default loan servicer.
Final Report
ED-OIG/A02N0004                                                           Page 21 of 27

                  The Compromise allowed the borrower to agree to pay a calculated
                  portion of their defaulted debt in a set timeframe. A settlement
                  repayment schedule was established based on the terms of the
   Compromises
                  compromise offer. When the borrower met the terms of the
     Process
                  Compromise, the remaining outstanding balance was written off and
                  the borrower’s debt was satisfied. If the terms of the compromise
                  were not met, the compromise expired.
Final Report
ED-OIG/A02N0004                                      Page 22 of 27

Enclosure 2: FSA’s One-Pager Dated March 29, 2013

Final Report
ED-OIG/A02N0004   Page 23 of 27
Final Rep011
ED-OIG/A02 0004                                                                                       Page 24 of27

Enclosure 3 : FSA Comments


   Federa l Student                     PROUD SPONSOR of
                                        tht AII ERICAN MIND'




          MEMO RAI'\ DUM


          DATE :
                         I   Q   20\5

          TO:            Daniel P. Schultz
                         Regional Inspector General for Aud it
                         Office of Inspector General

          FROM:          James W. Runcie     e
                                             ;t1
                         Chief Operating Officer
                                                     /\(1   (jJL
                                                              \j
          SUBJECT:       Response to Draft Audit Report:
                         Functionality of the Debt Management Collection System 2
                         Control Number ED-OIG/A02N0004

          Thank you for the opportunity to comment on the Oflicc of Inspector General's (OIG)
          dral1 audit report. Functionality ofthe Debt Management Collection System 2. dated
          September 3, 20 15. Federal Student Aid (FSA) ge nerally concurs with your findings and,
          as acknowledged in your rcpon. have taken a number of steps to ensure the full
          functionality of Debt Yfanagement Collt:ction System (D MCS) operati ons. These cffons
          include the award in September 20 13 of a new con tract to manage DMCS. the inclusion
          in the contract of explicit Lifecycle Management Methodology (LMM) requirements and
          fmancial incentives to encourage the successful completion of development milestones;
          and the award of an independent validation and verification (IV&V) contract to advise on
          the sofhvare development process. We agree with the recommendations included in your
          draft report t.hat build on and complement these initial steps.

          FSA 's response to each finding and recommendation follows:

          Finding No. I - FSA Did Not Always Acc urately Assess the Operationa l Status for
          DMCS2 Fun ctions, Processes, a nd Sub-Processes a nd Did Not Sufficiently
          Docum ent its Validation Assess ments.

          Response: We concur with this finding and. as noted above, have taken a number of
          steps to impro"e the tracking of operational status and assess the success of system
          enhancementS as they are implemented. We acknowledge the limitations of the process
          used in 2012 and 2013 to monitor. assess. and validate DMCS system status and
          operational capabilities. As noted in your report, this process. which focused on the use
          of a one-page status tracking report. was largely abandoned in November 2013. and has
          been replaced with a more formalized approach consistent with the Department's LMM
          processes and other broadly accepted management approac hes including the usc of IV & V



                         830 F 'S' S:reet NE. Wa 5'l nfliJn, DC 20202
                                          Stuce-ntflrc      go~
Final Report
ED-OI G/A02N0004                                                                                           Page 25 of 27




    Federal Student                     I   PROUD SPONSOR of
                                            11>41 AM£PICAN MIND '


           Page 2- Functionality of the Debt Management Collection System 2
                  Control Number ED-OIG/A02N0004

           servicers and the incorporation of a broader team of technical and subject- maner experts
           from across rSA.

           Recommendation 1.1: Ensure that FSA adequately monitors and validates the
           implementation and operational statuses of DMCS2 functions. processes. and sub-
           processes.

           Response: We concur with this recommendation. FSA has instituted a more structured
           va lidation process including regular produdion reviews, recurring tactical and risk
           meetings to review ongoing operational issues. review of fom1al development
           deliverables, documented user acceptance testing. production readiness reviews, and
           detailed tracking of individual change controls for each system enhancement.

           Recommendation 1.2: Develop and implement validation procedures. including
           documentation requirements, using guidance such as FSA 's En terprise Test Managern~nt
           Standards. for assessing the operational statuses of all DMCS2 functions. processes. and sub-
           processes.

           Response: We concur with this recommendation. FSA has instituted a more structured
           development and validation process incl uding formal delivcrables, documented user
           acceptance testing, production readiness reviews, and detai led tracking of individual
           change controls for each system enhancement.

           Recommendation 1.3: Ensure that documentation is maintained to support the reported
           operational status of DMCS2"s functions. processes, and sub-processes.

           Res ponse: We concur with this ~ommendation. FSA has instituted a more structured
           process, including contract project management support. to update and maintain
           documentation rel ated to production status, issues. and enhancements.

           Finding No.2- FSA's Instructions Did Not Correcllnllccuratc Loan Balances in
           DMCS2.

           Response: We concur with this finding. In 2014 fom1a l guidance regarding a common
           process to correct inaccurate loan balances was issued through a change control to all
           servicers. This process, which involves the monthly submittal of adjustments. is in place
           with nine of our ten loan scrvicers and in the final stages of implementation by the
           remaining serviccr. The process includes a validation step in which FSA staff select a
           sample of accoun ts from each transm ission and ensure that the adjustments were processed
           correctly.

           Recommendation 2.1: Test and validate that the procedures for correcting inaccurate
           loan balances in OMCS2 operate as intended.

                           83\. F st Street        ~E.    Nus 11ng1or. DC   2ti~U~

                                               Stucen1A1o.g<n
Final Report
ED-0 I G/ A02N0004                                                                                      Page 26 of27




            Page 3- Functionality of the Debt Managcmcm Collection System 2
                    Control Nwn bcr ED-OIG/A02N0004


            Response: We concur with this recommendation. As noted above, procedures have
            been developed. reviewed with panicipating scrvicers. and validated both initially and on
            an ongoing basis.

            Recommendation 2.2: Ensure that the procedures to correct inaccurate loan balances in
            DMCS2 are consistently implemented by all or FS/\ 's scrvicers.

            Response: We conc ur with this recommendation. As noted above. procedures arc in
            place and arc validated on an ongoing basis to ensu re consistent application by all
            serviccrs.

            Recommendation 2.3: Ensure that all rehabilitated or consolidated loans that were
            transferred from DMCS2 to a servicer prior to corrective procedures being implcmcmcd
            reflect accurate loan balances.

            Response: We concur with this recommendation. ·me new process discussed above
            includes provisions for adjusting rehabilitated or consolidated loan accounts transferred
            prior to the implementation of the corrective procedures.

            Find ing No 3-- FSA Did Not Adequately Oversee Debt Acco unts in DMCS2 Not
            Assign ed to a PCA.

            Response: We concur with this finding and have taken or planned steps to address the
            issues raised in the report.

            Recommendation 3.1: Perform an analysis to identify debt accounts in DMCS2 that
            should have been assigned to a PCA but \\Crc not and take appropriate actions.

            Response: We concur with this recommendation. We periodically perform an analysis,
            most recently in May 2015, to identify a~:counts in DMCS that should have been assigned
            to a PCA. Based on these analyses, we have identified actions required to ens ure all
            accounts arc assigned as appropriate. These actions arc being scheduled for
            implementation by Maxim us along with otht:r needed development activities.

            Recommendation 3.2: Develop policies and procedures to monitor and track the debt
            accounts that arc not assigned to a PCA to ensure they arc properly processed and
            managed through DMCS2.

            Response: We concur with this recommendation and are developing policies and
            procedures to formalize the analysis of unassigned accounts and ensure that those
            account.s that arc appropriately left unassigned arc properly processed and managed
            through DMCS.

                           830   F~rst   Street. NE., Washington. ()( 20202
                                             Stud~nlA   d go'
Final Report
ED-0 I G/ A 02N 0004                                                                                     Page 27 of27




              Page 4- Functionality of the De bt Management Collection System 2
                      C o ntrol Number ED-OIG/A02N0004

             Recommendation 3.3: Ensure that borrowers with a negative balance are issued a
             refw1d for the amount overpaid and update their account status to ensure their accounts
             are closed in DMCS2.

             Response: We concur with this recommendation and have identified actions required to
             ensure refunds are issued and account statuses are updated as a ppropriate. These actions
             are being scheduled for implementatio n by Maximus along with other needed
             development activities.

             Recommend ation 3.4: Ensure that accoun ts with a balance of $0 a re properly closed in
             DMC$2.

             Res ponse: We concur with tlti s recommendation and have identified actions requi red to
             ensure accounts with a balance of$0 are properly closed in DMCS. These actions are
             being scheduled for implementation by Maximus along with other needed development
             activit ies.

             Thank you again for the opportunity to review and comment on this draft report.

             cc: Patrick Howard




                            830   F~rst   Street, NE. Washington. DC 20202
                                               StuoentAi<l.go>