UNITED STATES DEPARTMENT OF EDUCATION OFFICE OF THE INSPECTOR GENERAL September 20, 2005 ED-OIG/A03F0001 Ms. Theresa S. Shaw Chief Operating Officer Federal Student Aid Union Center Plaza, Rm. 112G1 830 First Street, NE Washington, DC 20202 Dear Ms. Shaw: This Final Audit Report (Control Number ED-OIG/A03F0001) presents the results of our audit of the School Eligibility Channel's (SEC) initial review and quality control review process for electronic submissions of institutions' financial statements through the Department's eZ-Audit system. BACKGROUND The School Eligibility Channel (SEC) is one of four principal components within Federal Student Aid's Application, School Eligibility and Delivery Services (ASEDS) organization. The SEC administers the process by which institutions are determined to be eligible to participate in the federal student financial assistance (SFA) programs and certifies them for participation. This requires determining whether institutions meet the regulatory requirements for administrative capability and financial responsibility. To provide the Department with the information necessary to evaluate an institution's financial responsibility, institutions are required to submit financial information to the Department every year. An institution must provide this information in the form of audited financial statements as part of a combined submission that also includes the institution's compliance audit. Proprietary institutions have six months from the end of their fiscal year to provide the combined submission; public and private non-profit institutions have nine months. The Department provided notice in the Federal Register on May 16, 2003 (Vol. 68, No. 95) of the implementation of a new electronic process for submitting financial statements and compliance audits to the Department. The Department's system for this electronic process is the eZ-Audit system. Institutions are required to submit audits and financial statements using eZ-Audit for submissions due on or after June 16,2003. 400 MARYLAND AVE., S.W., WASHINGTON, DC 20202-1510 www.ed.gov Our mission is to ensure equal access to education and to promote educational excellence throughout the nation. Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOl eZ-Audit is a web-based, single point of submission for financial statements and compliance audits to the Department. The new application replaces a manual process and provides a paperless single point of receipt and access through the web. Institutions are responsible for entering summary audit and financial data into a web form and attaching an electronic file or files containing the audits and auditor's reports. Using the financial data entered by the institution eZ-Audit computes a composite score. The composite score is an important factor in determining an institution's financial responsibility under the regulations. SEC did not use the composite score calculated by eZ-Audit to evaluate financial responsibility, but had either a case team or the Document Receipt and Control Center (DRCC) use a worksheet within eZ-Audit to calculate an "official" composite score. In response to the approval received from the Office of Management and Budget (OMB) under the Paperwork Reduction Act, SEC developed an eZ-Audit quality control process to demonstrate to OMB that the data utilized by eZ-Audit is valid and reliable. SEC pledged to perform quality control reviews on 100 percent of the eZ-Audit submissions in the early stages of eZ-Audit. Based on its analysis ofthe quality control data, on September 1, 2004, SEC decided to suspend the 100 percent quality control process. Effective October 1, 2004, SEC instituted a revised quality control process based on sampling. AUDIT RESULTS We found that SEC did not establish and implement procedures that provide reasonable assurance that all institutions' required annual financial statement data was entered accurately in eZ-Audit. Specifically, we found that SEC did not have adequate internal controls in place to ensure that all of the detailed financial information entered by institutions into the eZ-Audit templates was accurate and reliable. SEC did not utilize the composite scores computed by eZ-Audit, based on the financial data entered by the institution, in evaluating financial responsibility. SEC and DRCC manually input financial data into an eZ-Audit worksheet that computed the "official" composite score. We also found that the official composite scores calculated by SEC and DRCC were not always correct. In an Interim Audit Memorandum we informed SEC of the following conditions: • A regulatory exclusion, applicable only to private nonprofit institutions, of certain Title IV funds from the financial ratio calculations was improperly applied to proprietary institutions; and • The eZ-Audit system's program incorrectly excluded REA program funds, from "total revenues" in calculating the financial ratios. SEC took corrective action as a result of our Interim Audit Memorandum. 2 Audit of SEC's Procedures for Reviews ofeZ-Audit Financial Statements ED-OIG/A03-FOOOI A draft of this report was provided to Federal Student Aid (FSA). In its response, FSA indicated that it generally concurred with all of our findings and recommendations and noted that it has either already implemented or will be implementing actions to address the issues raised in the audit's findings. We summarized FSA's response after each finding and a copy of the complete response is provided as an attachment to this report. Finding No.1 SEC Did Not Have Adequate Internal Controls to Ensure the Accuracy of eZ-Audit Data Entered by Institutions SEC did not have adequate internal controls to ensure that the detail data entered by institutions into the eZ-Audit financial statement templates was accurate and reliable. This occurred even though institutional submissions during our audit period were evaluated twice, once by DRCC and a second time by either the SEC's eZ-Audit Quality Control (QC) Team or a Case Team. The DRCC, QC Team, and Case Teams generally did not identify incorrect financial data entered by institutions. The errors occurred in the eZ-Audit templates for the balance sheet and income statement of proprietary institutions and the statement of financial position and statement of activities of private non-profit institutions. We reviewed a sample of 28 financial statements submitted during the period April 1, 2003, through September 30,2004. We found one or more incorrect data entries in the eZ-Audit financial statement templates for all 28 financial statements. We classified an entry to be an incorrect data entry when there were errors in the amount andlor classification of an eZ-Audit financial statement template line item. For 25 ofthe 28 financial statements reviewed, the eZ-Audit financial statement templates included unverifiable data entries. We classified an entry as an unverifiable entry when the eZ Audit financial statement template line items could not be traced to the audited financial statements. The following tables show the breakdown ofthe incorrect and unverifiable data entries for the 15 proprietary and 13 private non-profit institutions in our sample. Analysis of Proprietary Institutions eZ-Audit Financial Statement Templates Balance Sheet Income Statement Number of Included Both Included Included Correctly Included Included Included Reports Incorrect and Incorrect Unverifiable reflected Incorrect and Incorrect Unverifiable Analyzed Unverifiable Data Data Entries the Unverifiable Data Data Entries Data Entries Entries audited Data Entries Entries BIS 15 3 1 1 10 12 1 2 3 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOl Analysis of Private Non-Profit Institutions eZ-Audit Financial Statement Templates Statement of Financial Position Statement of Activities Number of Included Included Included Included Included Included Correctly Reports Incorrect and Incorrect Unverifiable Incorrect and Incorrect Unverifiable Reflected Analyzed Unverifiable Data Data Entries Unverifiable Data Data Entries the Data Entries Entries Data Entries Entries audited SOA 13 7 4 2 5 5 1 2 During our audit period, DRCC was required to review and compare the audited financial statements to the financial data entered into the eZ-Audit financial statement templates by institutions. If the DRCC determined that there was a data entry error, the submission would be deemed unacceptable and classified as incomplete. An SEC official explained that a data entry error was an error in which "the numbers [in a financial statement template] did not add up, e.g. Total Current Assets on the financial statement are different from the Total Current Assets on the template." A DRCC official added that, "a report would only be considered incomplete for a major discrepancy such as if the totals (Total Assets, Liabilities, Revenues, Expenses) between the audited financial statements and the templates were not in agreement." There was no requirement to evaluate the accuracy and reliability of all the detail line items entered by the institutions. An incomplete submission would be sent back to the institution for resolution. The DRCC also calculated the official composite score for non-flagged institutional submissions by entering the required data elements into a composite score worksheet in eZ-Audit. If the DRCC determined that all amounts in the eZ-Audit financial statement templates were correct but needed to make a change in the classification or treatment of an item that impacted the composite score while calculating the official composite score, it would document the change, flag the submission, and refer it to a Case Team for review. The DRCC also referred submissions that were flagged for any other reason to the Case Teams. Case Teams were responsible for financial analysis of all flagged financial statement submissions. Case teams reviewed classification or treatment changes that impacted the official composite score. They did not evaluate the accuracy or reliability of all the detail line items entered by the institution. Financial statement submissions that were not flagged were sent to the eZ-Audit QC Team, which performed the same review steps as the DRCC. 1 Evaluating the accuracy and rel4ibility all of the detail line items was not part of the eZ-Audit QC Team's I During the period Aprill, 2003, through June 22, 2004, the eZ-Audit QC Team also reviewed flagged fmancial statement submissions. 4 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOO 1 procedures. When the eZ-Audit QC Team identified submissions needing further review and resolution, it referred them to a Case Team. SEC's initial review and quality control review procedures for the electronic submissions of institutions' financial statements through eZ-Audit did not require the DRCC, the eZ Audit QC Team, or the Case Teams to make certain all the line items in the eZ-Audit financial statement templates were correct. Consequently, SEC cannot ensure the reliability of all the data in the eZ-Audit financial statement templates. Further, without reliable data, SEC will be unable to use the eZ-Audit financial statement template data for the intended benefit of performing data trending analysis. SEC explained that: The breakout of the [financial statement figures to the templates] ... is not relevant to the composite score ... they are not verified as part ofthe acceptability review. The financial statement submissions are not rejected for this reason. . .. where this breakdown is material to the calculation of the composite score, the case team may request additional information from the institution. The financial statement submissions are not rejected for this reason. We provided the results of our testing to SEC. In response SEC stated that "[t]he information collected on the eZ-Audit template is not intended for use in determining the composite score for an institution. All institutions have a ratio analysis completed using the source financial statements, and this is the official score used by the Department to determine an institution's financial responsibility." Pursuant to 5 C.F.R. § 1320.5(d)(1)(iii) "[t]o obtain OMB approval ofa collection of information, an agency shall demonstrate that it has taken every reasonable step to ensure that the proposed collection of information ... [has] practical utility. The agency shall also seek to minimize the cost to itself of collecting, processing and using the information, but shall not do so by means of shifting disproportionate costs or burdens onto the public." At 5 C.F.R. § 1320.3(1), practical utility "means the actual, not merely the theoretical or potential, usefulness of information to or for an agency, taking into account its accuracy, validity, adequacy, and reliability ...." The detail line item data entered into the eZ-Audit templates do not have practical utility as defined by OMB. The data are not accurate and reliable and are not used by FSA in evaluating institutional financial responsibility. Requiring institutions to provide information that is not verified and not used can only be considered a burden on institutions. 5 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOl Subsequent to the completion of our audit fieldwork SEC provided additional documentation regarding the eZ-Audit templates; however, that infonnation did not change our original conclusions. Recommendation: We recommend that the Chief Operating Officer (COO) for Federal Student Aid (FSA): 1.1 Either improve its processes for reviewing institutions eZ-Audit financial statement template data to ensure the accuracy and reliability of all the data or eliminate the requirement that institutions complete the financial statement templates as part of the eZ-Audit annual financial statement submission. FSA's Reply: FSA concurred with this recommendation. FSA's response states that: FSA agrees to improve its processes for reviewing the financial statements template data and is currently developing these improvements as part of the SEC Standardization project. The updated procedures are scheduled to be in place by the end of March 2006. SEC currently has a quality control process in place to review the acceptability of reviews conducted by the contractor. For non-flagged financial statements, FSA selects a statistical sample and tests the acceptability reviews previously conducted. Flagged financial statements are reviewed by SEC's School Participation Teams. The use of the templates facilitates the identification of schools that may pose a potential risk to the Federal Student Aid programs. These submissions are flagged for review immediately upon receipt. OIG's Response: While FSA agrees to improve its process for reviewing financial statement template data, it does not address the conditions and issues in the finding. There were two primary conditions identified in the finding. The first was that institutions could not accurately enter the detail line item data into the eZ-Audit financial statement templates. The second was that FSA does not use and does not evaluate the detail line item data entered by institutions. While improved processes for reviewing the line item detail entered by institutions into the eZ-Audit financial statement templates through the SEC Standardization Project may help to correct institutions' input errors, it will not address the problem of unverifiable amounts entered into the detail line items. The unverifiable amounts occur because of the broad latitude provided for in financial reporting with regard to account classification. SEC cannot determine the correct amounts for unverifiable financial statement template line items without extensive communication with institutions. Unless a common chart of accounts is required for all institutions, the financial statement template line items will 6 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOI continue to include unverifiable amounts. FSA does not explain how the Standardization Project will address this issue. The quality control process for reviews conducted by SEC's contractor during our audit period did not require an evaluation ofthe accuracy of the detail line items in the eZ Audit templates. The only change from the quality control process used during our audit period and the one currently in place was to replace a 100 percent review of the work conducted by the contractor with a review of a sample of the work. The quality control process used by SEC does not address the problem of errors and unverifiable amounts in the detail line items ofthe eZ-Audit templates. In addition, SEC has not established an acceptable error rate to determine when a 100 percent review would again be required to correct problems with the contractor's work. FSA's response is silent on the fact that most of the detail line item data entered by institutions is not used in evaluating financial responsibility. Nor does FSA address the fact that the data problems with the detail line items make it impossible to use the data for any trend analysis in the future. Finding No.2 Institutions' Composite Scores Were Not Calculated Correctly Based on our review of a sample of 28 annual financial statements, we identified 14 institutions where, the eZ-Audit composite score worksheet screen data fields included incorrect amounts and or missing amounts. • For 8 of the 14 institutions the error(s) had no effect on the composite score calculation. • For 4 of the institutions the error(s) resulted in an incorrect composite score calculation; however, there was no effect on the composite score scale zone. • For 1 institution the error(s) resulted in an incorrect composite score calculation and incorrect composite score scale zone. 2 • For 1 institution we were unable t,o properly calculate the composite score due to a generally accepted accounting principles (GAAP) violation. 3 We also found that for three institutions the eZ-Audit composite score worksheet screen I was not completed, although the eZ-Audit status of the financial statements was Complete and Archived. 4 2 SEC's calculated composite score was -.1 and our calculated composite score was 1.5. 3 We noted that in three of the annual financial statements reviewed the statement of fmancial position did not conform to the format required by GAAP. As a result, there was insufficient information in the fmancial statements to properly calculate the composite scores. For two of the three fmancial statements we were able to obtain the necessary information from the institution and or the CPA finn to properly calculate the composite scores. 4 During our review, we notified SEC that the eZ-Audit composite score worksheet screens had not been completed for three institutions' financial statements. Two of the three institutions were identified during 7 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-F0001 In order to participate in any ofthe Title IV, Higher Education Act (HEA) programs, an institution must demonstrate that it is financially responsible. An important factor in determining an institution's financial responsibility status is its composite score. An institution's composite score is determined by calculating the result of its primary reserve, equity, and net income ratios (financial ratios). Once a composite score is calculated, it is measured along a common scale from negative one to positive three. The composite score could fall within three composite score scale zones. The composite score scale zones are: • 1.5 to 3.0 - Financially responsible without further oversight. • 1.0 to 1.4 - "In the Zone." The institution is considered financially responsible but additional oversight is required. • -1.0 to .9 - Not financially responsible. The school must submit a letter of credit for at least 50 percent of its Title IV funding. The school may be permitted to participate under provisional certification with a smaller letter of credit, for at least 10 percent of its Title IV funding. DRCC staff reviewed institutions' annual financial statements and completed an eZ Audit composite score worksheet screen for non-flagged financial statements. For flagged financial statements, the Case Teams completed an eZ-Audit composite score worksheet screen. Based on the input of the financial data in the composite score worksheet screen, eZ-Audit computed the institution's official composite score. Although we did not determine the specific cause( s) for the incorrect data entries on the composite score worksheet screens, they appear to be the result of errors on the part of the DRCC and or Case Team staff. The three financial statements that did not have a composite score worksheet screen completed prior to being processed in eZ-Audit as Complete and Archived appear to have been inadvertent omissions on the part of the DRCC and Case Team staff. Erroneous data fields in the composite score worksheet screens may result in improper financial responsibility determinations. Consequently, institutions that are not financially responsible may continue to participate in the Title IV, HEA programs and Title IV HEA program funds may be at risk. Subsequent to the completion of our audit fieldwork, SEC provided documentation indicating that: • A system edit would be implemented in eZ-Audit that will not allow a flagged or non-flagged submission to be archived without an ED composite score being completed. our review of the sample of 28 fmancial statements. SEC completed the composite score worksheet screens for these two institutions. A third institution's (ABI-Accu Tech Business Institute, OPEID 02288900) fmancial statement, for the fiscal year ended May 31, 2003, was identified during our review of a sample of 50 institutions with composite scores less than 1.5. Its composite score worksheet screen has not yet been completed. 8 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOI • A report of all submissions flagged and non-flagged that are archived in eZ-Audit without an ED composite score has been requested. SEC officials explained that the ED composite score would be calculated for any submissions listed on the report. Recommendations: We recommend that the COO for FSA: 2.1 Ensure that the system edit is implemented and verify that the eZ-Audit system will not allow a flagged or non-flagged submission to be archived without an ED composite score being completed. 2.2 Ensure that an official composite score has been calculated for all Complete and Archived annual financial statement submissions. 2.3 Ensure that DRCC and Case Team staff properly complete the eZ-Audit composite score worksheet screen for all proprietary and private non-profit institutions. FSA's Reply: FSA concurred with these recommendations. Finding No.3 Regulatory Exclusion, Applicable Only to Private Nonprofit Institutions, Was Improperly Applied to Proprietary Institutions In an Interim Audit Memorandum dated May 17, 2005, we informed SEC that we had reviewed a total of 39 proprietary institutions with eZ-Audit composite scores of less than 1.5. We found two instances where SEC entered the amount ofFFEL and Pell Grant funds received, for the fiscal year, by each institution, in the "REA Program Funds Revenues" field in the eZ-Audit composite score worksheet screen. The eZ-Audit system's program incorrectly excluded the funds, from both "total expenses" and "total revenues" in calculating the financial ratios. 5 The regulations provide that in certain circumstances funds received under REA grant programs can be excluded from the composite score calculation. The regulations at 34 C.F.R. § 668.172(c)(5) specify that the Secretary- Excludes from the ratio calculation Federal funds provided to an institution by the Secretary under programs authorized by the REA only if (i) In the notes to the institution's audited financial statement, or as a separate attestation, the auditor discloses by name and CFDA number, the amount of REA program funds reported as expenses in the Statement of Activities for the fiscal year covered by that audit or attestation; and 5Total expenses and total revenues are components of the primary reserve and net income ratio calculations, respectively. 9 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOO 1 (ii) The institution's composite score, as determined by the Secretary, is less than 1.5 before the reported expenses arising from those REA funds are excluded from the ratio calculations. While the regulation permits the exclusion of REA program funds from reported expenses, the regulation does not provide for a corresponding reduction in revenue. In the preamble to the final regulations the Secretary explained the application of this provision in response to a commenter who suggested eliminating Title IV expenditures from "total expenses." The Secretary stated that ... most Title IV, REA program funds will not be included in total expenses of colleges and universities. For example, payments made to those institutions under the Direct Loan, Federal Family Education Loan, Federal Pell Grant, and Federal Supplemental Educational Opportunity Grant programs are not included in total expenses reported on the statement of activities. The Secretary further stated that ... in certain instances sponsored program expenses should be excluded from the ratio calculations. The Secretary believes that an institution that receives REA grant program funds, especially those associated with programs that strengthen institutions or expand access to higher education, should not fail the composite score solely because of the expenditure of those funds. Therefore, the amount of REA funds that an institution reports as expenses in its Statement of Activities for a fiscal year are excluded from the ratio calculations, but only if those reported expenses alone are responsible for the institution's failure to achieve a composite score of 1.5 for that fiscal year.6 [emphasis added] . Proprietary institutions are not eligible to participate in the REA programs that would result in the type of expense that would be excluded. Both the preamble and the regulation reference the "statement of activities" which, under Generally Accepted Accounting Principles, is included in the financial statements of nonprofit institutions. Proprietary institutions have an income statement. In its response to the memorandum FSA agreed with the OIG findings and stated: We have identified 16 schools (11 proprietary and five non-profit) where the regulatory exclusion was applied and are taking the following corrective actions: 662 Fed. Reg. 62,830, 62,845-6 (Nov. 25, 1997). 10 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOO I • Immediately issued new/amended Performance Improvement Procedures to the School Participation Teams and contractor for properly applying the regulatory exclusion - completed June 1,2005; • Analyzed the 16 affected schools to determine the impact of the composite score calculation error - completed June 8, 2005; • Develop action plan for each school- to be completed by June 16, 2005; and • Initiate system changes to correct worksheet calculation and eliminate proprietary schools - to be completed by June 26, 2005. Manual workarounds are in place until the system changes are implemented. On June 16,2005, FSA provided us with documentation confirming that the corrective actions had been taken. FSA's Reply: FSA concurred with the finding. OTHER MATTERS SEC's Quality Control Process did not ensure that all the eZ-Audit Financial Statement Information Screens were completed correctly We noted an error on the eZ-Audit Financial Statement Information Screen for 4 of the 30 financial statements reviewed. 7 On June 1,2005, we informed the SEC that in two instances the institutions provided incorrect auditor information, and in another two instances the institutions failed to provide the audit opinion type for the financial statements. On June 27,2005, SEC provided the following response regarding these issues: The auditor information is verified and entered in the database at the time of resolution by the School Participation Team, if the financial statements are flagged, or by the eZ-Audit Team ifthe financial statements are not flagged. The auditor information for these schools will be corrected. . .. The eZ-Audit system has edit checks that do not allow a submission to be accepted at all if this field [opinion type] is blank. A systems error caused the data not to display, however, the data is saved on the database. This error was reported and is currently being investigated. In these cases the financial statements show that the audit opinion was unqualified. The 7 Public institutions are required to complete the eZ-Audit Financial Statement Information Screen. 11 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOO 1 submission summary shows that the submission was flagged for other reasons but not for a "qualified" opinion therefore, the system is treating this as an unqualified opinion. Subsequent to the completion of our audit fieldwork SEC provided documentation indicating that: • The auditor information lor the two schools was corrected. • An eZ-Audit production support request had been prepared to ensure that the opinion type field data displays properly. OBJECTIVE, SCOPE AND METHODOLOGY The objective of our audit was to determine whether FSA's SEC established and implemented procedures that provide reasonable assurance that all institutions' required annual financial statement data is entered accurately in eZ-Audit. To accomplish our objective, we obtained and analyzed a data file that SEC provided. This file listed every financial statement report received through eZ-Audit during the period April 1, 2003, through September 30, 2004. The file included all types of financial statements. We limited our universe to include 2,490 annual financial statement submissions that had a status of complete and archived for this period. We randomly selected and reviewed the eZ-Audit financial statement data for 30 financial statement reports from the universe of 2,490 complete and archived annual financial statement submissions. The 30 financial statement reports included: • 15 proprietary institutions; • 13 private non-profit institutions; and • 2 public institutions. We determined whether the regulatory exclusion of certain Title IV funds from the financial ratio calculations, applicable only to private non-profit institutions, was applied properly. To accomplish this we reviewed eZ-Audit financial statement data for a sample of 50 financial statement reports randomly selected from the universe of 252 complete and archived annual financial statement reports, submitted through eZ-Audit during the period April 1, 2003, through September 30,2004, that had a flag reason field of "fail" or "zone." We reviewed SEC's procedures for the initial review and quality control reviews of electronic submissions of institutions' financial statements through the eZ-Audit system. We also interviewed DRCC and SEC personnel to obtain an understanding of these procedures. 12 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOI We did not rely on computer-processed data contained in the Department's eZ-Audit system. However, we determined the universe of eZ-Audit computer-processed data (for financial statements received through eZ-Audit during the period April 1, 2003, through September 30, 2004) was complete. We compared theeZ-Audit data for our sample of 30 financial statement reports to source documents. Therefore, we believe the data used was adequate for sampling and testing purposes for our audit objective. We conducted our on-site fieldwork at SEC's headquarters in Washington, DC. from November 8,2004, through November 10, 2004, and from November 15, 2004, through November 16, 2004. Our audit was performed in accordance with generally accepted government auditing standards appropriate to the scope ofthe review described above. STATEMENT ON INTERNAL CONTROL We have made a study and evaluation of SEC's internal control to ensure the accuracy of eZ-Audit financial statement data for the period April 1, 2003 through September 30, 2004. Our study and evaluation was conducted in accordance with Government Auditing Standards. For the purpose ofthis report, we assessed and classified the significant internal control into the following category: Procedures for the initial review and quality control reviews of electronic submissions of institutions' financial statements through the Department's eZ-Audit system. The management of SEC is responsible for establishing and maintaining internal control. In fulfilling this responsibility, estimates and judgments by management are required to assess the expected benefits and related costs of control procedures. The objective of internal control over the eZ-Audit system is to provide management with reasonable, but not absolute, assurance that institutions' eZ-Audit financial statement data is valid and reliable. Because of inherent limitations in any internal control structure, errors or irregularities may occur and not be detected. Also, projection of any evaluation ofthe system to future periods is subject to the risk that procedures may become inadequate because of changes in conditions, or that the degree of the compliance with the procedures may deteriorate. Our assessment disclosed weaknesses in SEC's internal control for the period April 1, 2003, through September 30, 2004, which, in our opinion, result in more than a relatively low risk that errors, irregularities and other inefficiencies may occur resulting in inefficient and/or ineffective performance. These weaknesses are fully described in the Audit Results. section of this report. 13 Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements ED-OIG/A03-FOOOl ADMINISTRATIVE MATTERS Statements that managerial practices need improvements, as well as other conclusions and recommendations in this report, represent the opinions of the Office of Inspector General. Determinations of corrective action to be taken will be made by the appropriate Department of Education officials. Corrective actions proposed and implemented by your office will be monitored and tracked through the Department's Audit Accountability and Resolution Tracking System (AARTS). ED policy requires that you develop a final corrective action plan (CAP) for our review in the automated system within 30 days ofthe issuance of this report. The CAP should set forth the specific action items, and targeted completion dates, necessary to implement final corrective actions on the findings and recommendations contained in this final audit report. In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector General is required to report to Congress twice a year on the audits that remain unresolved after six months from the date of issuance. In accordance with the Freedom ofInformation Act (5 U.S.C. §552), reports issued by the Office of Inspector General are available to members ofthe press and general public to the extent information contained therein is not subj ect to exemptions in the Act. We appreciate the cooperation given us during this review. If you have any questions, please call Bernard Tadley, Regional Inspector General for Audit, at 215-656-6279. Helen Lew Assistant Inspector General for Audit Attachment 14 .. Audit of SEC's Procedures for Reviews of eZ-Audit Fmancial Statements ED-OIGI A03-FOOO 1 Attachment - Auditee's Response FEDERAL STUDENT AID We Help Put America Through School CHIEF OPERATING OFFICER SEP 122005 TO: Bernard Tadley RegIOnal Inspector General for AudIt FROM: Theresa S. Shaw ChIef Operatmg Officer SUBJECT: Draft AudIt Report School Eligibility Channel's Review Process for eZ-Audit Financial SubmisSIOns ED-OIG/A03-FOOOI ThIS is m response to your August 11, 2005 Draft AudIt Report. In general, FSA agrees WIth the OIG findings and recommendations. The following responses address the referenced findmgs and recommendatIOns m the memorandum. Finding 1: School Eligibility Channel (SEC) Did Not Have Adequate Internal Controls to Ensure the Accuracy of eZ-Audit Data Entered by Institutions. Recommendation 1.1: Either Improve its processes for reviewing institutions eZ-Audit financial statement template data to ensure the accuracy and reliability of all the data or eliminate the requirement that institutions complete the financial statement templates as part of the eZ-Audit annual financial statement submission. FSA Response: FSA agrees to Improve ItS processes for reviewmg the finanCIal statements template data and IS currently developmg these Improvements as part of the SEC StandardIzation project. The updated procedures are scheduled to be m place by the end of March 2006. SEC currently has a qualIty control process m place to reVIew the acceptablhty of reviews conducted by the contractor. For non-flagged financial statements, FSA selects a statistIcal sample and tests the acceptablhty reVlews preVlously conducted. Flagged finanCIal statements are reVIewed by SEC's School Participation Teams. The use of the templates facll1tates the IdentificatIon of schools that may pose a potential nsk to the Federal Student AId programs. These submISSIOns are flagged for reVIew ImmedIately upon receIpt. Finding 2: Institutions' Composite Scores Were Not Calculated Correctly. Recommendation 2.1: Ensure that the system edit is implemented and verify that the eZ Audit system will not allow a flagged or non-flagged submission to be archived without an ED composite score being calculated. 830 First Street, NE, Washmgton, DC 20202 J-800-4-FED-AID www studentmd ed gOY 15 • Audit of SEC's Procedures for Reviews of eZ-Audit Fmancial Statements ED-OIGI A03-FOOO 1 FSA Response: FSA agrees wIth the recommendatIOn and WIll Implement an enhancement to the eZ-AudIt system planned for February 24, 2006, as part of a scheduled eZ-Audit release. Begmnmg m August 2005, and untIl the system edIt IS Implemented a monthly report wIll be used to Identlty submissIOns where an ED composite score has not been calculated. Recommendation 2.2: Ensure that an official composite score has been calculated for all Complete and Archived annual financial statement submissions. FSA Response: FSA agrees wIth the recommendatIOn and has identified those financial statement submissions where an ED composIte score has not been calculated. A composite score calculatIOn WIll be completed for these submIssions by December 31, 2005. Recommendation 2.3: Ensure that the Document Receipt and Control Center (DRCC) and Case Team staff properly complete the eZ-Audit composite score worksheet screen for all proprietary and private non-profit institutions. FSA Response: FSA has a quality control process in place to reVIew the composIte scores completed by the contractor. As errors are identIfied, they are communicated to DRCC and documented, and modIficatIOns are made to established procedures as appropriate. As part of the SEC StandardIzatIOn project, SEC WIll be strengthemng ItS procedures regardmg the completion of the composIte score worksheets by the Case Team and DRCC staff and will Implement quality control processes to ensure that the composIte score worksheets are properly completed. ThIS is scheduled for Implementation by the end of March 2006. Finding 3: Regulatory Exclusion, Applicable Only to Private Nonprofit Institutions, Was Improperly Applied to Proprietary Institutions. FSA Response: FSA agreed WIth the OIG findings and provided documentatIon on June 16, 2005, to confirm that correctIVe actions were taken. If you have any questIOns, you may contact Molly Wyatt, DIrector, Integrated Partner ManagementieZ-Audit at (202) 377-3358. cc: Pat Howard 16
Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements.
Published by the Department of Education, Office of Inspector General on 2005-09-20.
Below is a raw (and likely hideous) rendition of the original report. (PDF)