oversight

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements.

Published by the Department of Education, Office of Inspector General on 2005-09-20.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                       UNITED STATES DEPARTMENT OF EDUCATION
                                       OFFICE OF THE INSPECTOR GENERAL




                                             September 20, 2005

                                                                                               ED-OIG/A03F0001
Ms. Theresa S. Shaw
Chief Operating Officer
Federal Student Aid
Union Center Plaza, Rm. 112G1
830 First Street, NE
Washington, DC 20202

Dear Ms. Shaw:

This Final Audit Report (Control Number ED-OIG/A03F0001) presents the results of
our audit of the School Eligibility Channel's (SEC) initial review and quality control
review process for electronic submissions of institutions' financial statements through the
Department's eZ-Audit system.

                                              BACKGROUND

The School Eligibility Channel (SEC) is one of four principal components within Federal
Student Aid's Application, School Eligibility and Delivery Services (ASEDS)
organization. The SEC administers the process by which institutions are determined to
be eligible to participate in the federal student financial assistance (SFA) programs and
certifies them for participation. This requires determining whether institutions meet the
regulatory requirements for administrative capability and financial responsibility.

To provide the Department with the information necessary to evaluate an institution's
financial responsibility, institutions are required to submit financial information to the
Department every year. An institution must provide this information in the form of
audited financial statements as part of a combined submission that also includes the
institution's compliance audit. Proprietary institutions have six months from the end of
their fiscal year to provide the combined submission; public and private non-profit
institutions have nine months.

The Department provided notice in the Federal Register on May 16, 2003 (Vol. 68, No.
95) of the implementation of a new electronic process for submitting financial statements
and compliance audits to the Department. The Department's system for this electronic
process is the eZ-Audit system. Institutions are required to submit audits and financial
statements using eZ-Audit for submissions due on or after June 16,2003.


                                  400 MARYLAND AVE., S.W., WASHINGTON, DC 20202-1510
                                                           www.ed.gov

          Our mission is to ensure equal access to education and to promote educational excellence throughout the nation.
Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements    ED-OIG/A03-FOOOl



eZ-Audit is a web-based, single point of submission for financial statements and
compliance audits to the Department. The new application replaces a manual process and
provides a paperless single point of receipt and access through the web. Institutions are
responsible for entering summary audit and financial data into a web form and attaching
an electronic file or files containing the audits and auditor's reports. Using the financial
data entered by the institution eZ-Audit computes a composite score. The composite
score is an important factor in determining an institution's financial responsibility under
the regulations. SEC did not use the composite score calculated by eZ-Audit to evaluate
financial responsibility, but had either a case team or the Document Receipt and Control
Center (DRCC) use a worksheet within eZ-Audit to calculate an "official" composite
score.

In response to the approval received from the Office of Management and Budget (OMB)
under the Paperwork Reduction Act, SEC developed an eZ-Audit quality control process
to demonstrate to OMB that the data utilized by eZ-Audit is valid and reliable. SEC
pledged to perform quality control reviews on 100 percent of the eZ-Audit submissions in
the early stages of eZ-Audit. Based on its analysis ofthe quality control data, on
September 1, 2004, SEC decided to suspend the 100 percent quality control process.
Effective October 1, 2004, SEC instituted a revised quality control process based on
sampling.

                                       AUDIT RESULTS

We found that SEC did not establish and implement procedures that provide reasonable
assurance that all institutions' required annual financial statement data was entered
accurately in eZ-Audit. Specifically, we found that SEC did not have adequate internal
controls in place to ensure that all of the detailed financial information entered by
institutions into the eZ-Audit templates was accurate and reliable. SEC did not utilize the
composite scores computed by eZ-Audit, based on the financial data entered by the
institution, in evaluating financial responsibility.

SEC and DRCC manually input financial data into an eZ-Audit worksheet that computed
the "official" composite score. We also found that the official composite scores
calculated by SEC and DRCC were not always correct.

In an Interim Audit Memorandum we informed SEC of the following conditions:

• 	 A regulatory exclusion, applicable only to private nonprofit institutions, of certain
    Title IV funds from the financial ratio calculations was improperly applied to
    proprietary institutions; and

• 	 The eZ-Audit system's program incorrectly excluded REA program funds, from
    "total revenues" in calculating the financial ratios.

SEC took corrective action as a result of our Interim Audit Memorandum.




                                                  2

Audit of SEC's Procedures for Reviews ofeZ-Audit Financial Statements                    ED-OIG/A03-FOOOI



A draft of this report was provided to Federal Student Aid (FSA). In its response, FSA
indicated that it generally concurred with all of our findings and recommendations and
noted that it has either already implemented or will be implementing actions to address
the issues raised in the audit's findings. We summarized FSA's response after each
finding and a copy of the complete response is provided as an attachment to this report.

Finding No.1 	        SEC Did Not Have Adequate Internal Controls to Ensure the
                      Accuracy of eZ-Audit Data Entered by Institutions

SEC did not have adequate internal controls to ensure that the detail data entered by
institutions into the eZ-Audit financial statement templates was accurate and reliable.
This occurred even though institutional submissions during our audit period were
evaluated twice, once by DRCC and a second time by either the SEC's eZ-Audit Quality
Control (QC) Team or a Case Team. The DRCC, QC Team, and Case Teams generally
did not identify incorrect financial data entered by institutions. The errors occurred in the
eZ-Audit templates for the balance sheet and income statement of proprietary institutions
and the statement of financial position and statement of activities of private non-profit
institutions.

We reviewed a sample of 28 financial statements submitted during the period April 1,
2003, through September 30,2004. We found one or more incorrect data entries in the
eZ-Audit financial statement templates for all 28 financial statements. We classified an
entry to be an incorrect data entry when there were errors in the amount andlor
classification of an eZ-Audit financial statement template line item. For 25 ofthe 28
financial statements reviewed, the eZ-Audit financial statement templates included
unverifiable data entries. We classified an entry as an unverifiable entry when the eZ­
Audit financial statement template line items could not be traced to the audited financial
statements. The following tables show the breakdown ofthe incorrect and unverifiable
data entries for the 15 proprietary and 13 private non-profit institutions in our sample.

               Analysis of Proprietary Institutions eZ-Audit Financial Statement Templates

                                Balance Sheet                                    Income Statement
Number of   Included Both    Included     Included       Correctly     Included      Included     Included
 Reports     Incorrect and   Incorrect   Unverifiable    reflected   Incorrect and   Incorrect   Unverifiable
Analyzed     Unverifiable      Data      Data Entries       the      Unverifiable      Data      Data Entries
             Data Entries     Entries                     audited    Data Entries     Entries
                                                            BIS

   15             3             1             1              10           12             1            2




                                                        3

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements                      ED-OIG/A03-FOOOl


            Analysis of Private Non-Profit Institutions eZ-Audit Financial Statement Templates

                    Statement of Financial Position                          Statement of Activities
Number of       Included       Included       Included         Included       Included     Included      Correctly
 Reports      Incorrect and    Incorrect     Unverifiable    Incorrect and    Incorrect   Unverifiable   Reflected
Analyzed      Unverifiable       Data        Data Entries    Unverifiable       Data      Data Entries      the
              Data Entries      Entries                      Data Entries      Entries                    audited
                                                                                                           SOA

   13              7               4              2               5              5              1            2


During our audit period, DRCC was required to review and compare the audited financial
statements to the financial data entered into the eZ-Audit financial statement templates by
institutions. If the DRCC determined that there was a data entry error, the submission
would be deemed unacceptable and classified as incomplete.

An SEC official explained that a data entry error was an error in which "the numbers [in
a financial statement template] did not add up, e.g. Total Current Assets on the financial
statement are different from the Total Current Assets on the template." A DRCC official
added that, "a report would only be considered incomplete for a major discrepancy such
as if the totals (Total Assets, Liabilities, Revenues, Expenses) between the audited
financial statements and the templates were not in agreement." There was no
requirement to evaluate the accuracy and reliability of all the detail line items entered by
the institutions. An incomplete submission would be sent back to the institution for
resolution.

The DRCC also calculated the official composite score for non-flagged institutional
submissions by entering the required data elements into a composite score worksheet in
eZ-Audit. If the DRCC determined that all amounts in the eZ-Audit financial statement
templates were correct but needed to make a change in the classification or treatment of
an item that impacted the composite score while calculating the official composite score,
it would document the change, flag the submission, and refer it to a Case Team for
review. The DRCC also referred submissions that were flagged for any other reason to
the Case Teams.

Case Teams were responsible for financial analysis of all flagged financial statement
submissions. Case teams reviewed classification or treatment changes that impacted the
official composite score. They did not evaluate the accuracy or reliability of all the detail
line items entered by the institution.

Financial statement submissions that were not flagged were sent to the eZ-Audit QC
Team, which performed the same review steps as the DRCC. 1 Evaluating the accuracy
and rel4ibility all of the detail line items was not part of the eZ-Audit QC Team's



I During the period Aprill, 2003, through June 22, 2004, the eZ-Audit QC Team also reviewed flagged
fmancial statement submissions.


                                                        4

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements    ED-OIG/A03-FOOO 1


procedures. When the eZ-Audit QC Team identified submissions needing further review
and resolution, it referred them to a Case Team.

SEC's initial review and quality control review procedures for the electronic submissions
of institutions' financial statements through eZ-Audit did not require the DRCC, the eZ­
Audit QC Team, or the Case Teams to make certain all the line items in the eZ-Audit
financial statement templates were correct. Consequently, SEC cannot ensure the
reliability of all the data in the eZ-Audit financial statement templates. Further, without
reliable data, SEC will be unable to use the eZ-Audit financial statement template data
for the intended benefit of performing data trending analysis.

SEC explained that:

        The breakout of the [financial statement figures to the templates] ... is not
        relevant to the composite score ... they are not verified as part ofthe
        acceptability review. The financial statement submissions are not rejected
        for this reason. . .. where this breakdown is material to the calculation of
        the composite score, the case team may request additional information
        from the institution. The financial statement submissions are not rejected
        for this reason.

We provided the results of our testing to SEC. In response SEC stated that "[t]he
information collected on the eZ-Audit template is not intended for use in determining the
composite score for an institution. All institutions have a ratio analysis completed using
the source financial statements, and this is the official score used by the Department to
determine an institution's financial responsibility."

Pursuant to 5 C.F.R. § 1320.5(d)(1)(iii) "[t]o obtain OMB approval ofa collection of
information, an agency shall demonstrate that it has taken every reasonable step to ensure
that the proposed collection of information ... [has] practical utility. The agency shall
also seek to minimize the cost to itself of collecting, processing and using the
information, but shall not do so by means of shifting disproportionate costs or burdens
onto the public."

At 5 C.F.R. § 1320.3(1), practical utility "means the actual, not merely the theoretical or
potential, usefulness of information to or for an agency, taking into account its accuracy,
validity, adequacy, and reliability ...."

The detail line item data entered into the eZ-Audit templates do not have practical utility
as defined by OMB. The data are not accurate and reliable and are not used by FSA in
evaluating institutional financial responsibility. Requiring institutions to provide
information that is not verified and not used can only be considered a burden on
institutions.




                                                  5

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements   ED-OIG/A03-FOOOl



Subsequent to the completion of our audit fieldwork SEC provided additional
documentation regarding the eZ-Audit templates; however, that infonnation did not
change our original conclusions.

Recommendation:

We recommend that the Chief Operating Officer (COO) for Federal Student Aid (FSA):

1.1 	 Either improve its processes for reviewing institutions eZ-Audit financial statement
      template data to ensure the accuracy and reliability of all the data or eliminate the
      requirement that institutions complete the financial statement templates as part of
      the eZ-Audit annual financial statement submission.

FSA's Reply:

FSA concurred with this recommendation. FSA's response states that:

      FSA agrees to improve its processes for reviewing the financial statements
      template data and is currently developing these improvements as part of the
      SEC Standardization project. The updated procedures are scheduled to be in
      place by the end of March 2006. SEC currently has a quality control
      process in place to review the acceptability of reviews conducted by the
      contractor. For non-flagged financial statements, FSA selects a statistical
      sample and tests the acceptability reviews previously conducted. Flagged
      financial statements are reviewed by SEC's School Participation Teams.
      The use of the templates facilitates the identification of schools that may
      pose a potential risk to the Federal Student Aid programs. These
      submissions are flagged for review immediately upon receipt.

OIG's Response:

While FSA agrees to improve its process for reviewing financial statement template data,
it does not address the conditions and issues in the finding. There were two primary
conditions identified in the finding. The first was that institutions could not accurately
enter the detail line item data into the eZ-Audit financial statement templates. The
second was that FSA does not use and does not evaluate the detail line item data entered
by institutions.

While improved processes for reviewing the line item detail entered by institutions into
the eZ-Audit financial statement templates through the SEC Standardization Project may
help to correct institutions' input errors, it will not address the problem of unverifiable
amounts entered into the detail line items. The unverifiable amounts occur because of the
broad latitude provided for in financial reporting with regard to account classification.
SEC cannot determine the correct amounts for unverifiable financial statement template
line items without extensive communication with institutions. Unless a common chart of
accounts is required for all institutions, the financial statement template line items will



                                                  6

    Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements                  ED-OIG/A03-FOOOI


    continue to include unverifiable amounts. FSA does not explain how the Standardization
    Project will address this issue.

    The quality control process for reviews conducted by SEC's contractor during our audit
    period did not require an evaluation ofthe accuracy of the detail line items in the eZ­
    Audit templates. The only change from the quality control process used during our audit
    period and the one currently in place was to replace a 100 percent review of the work
    conducted by the contractor with a review of a sample of the work. The quality control
    process used by SEC does not address the problem of errors and unverifiable amounts in
    the detail line items ofthe eZ-Audit templates. In addition, SEC has not established an
    acceptable error rate to determine when a 100 percent review would again be required to
    correct problems with the contractor's work.

    FSA's response is silent on the fact that most of the detail line item data entered by
    institutions is not used in evaluating financial responsibility. Nor does FSA address the
    fact that the data problems with the detail line items make it impossible to use the data for
    any trend analysis in the future.

    Finding No.2          Institutions' Composite Scores Were Not Calculated Correctly

    Based on our review of a sample of 28 annual financial statements, we identified 14 

    institutions where, the eZ-Audit composite score worksheet screen data fields included 

    incorrect amounts and or missing amounts. 


    • 	 For 8 of the 14 institutions the error(s) had no effect on the composite score 

        calculation. 


    • 	 For 4 of the institutions the error(s) resulted in an incorrect composite score 

        calculation; however, there was no effect on the composite score scale zone. 


    • 	 For 1 institution the error(s) resulted in an incorrect composite score calculation and
        incorrect composite score scale zone. 2

    • 	 For 1 institution we were unable t,o properly calculate the composite score due to a 

        generally accepted accounting principles (GAAP) violation. 3 


    We also found that for three institutions the eZ-Audit composite score worksheet screen
I   was not completed, although the eZ-Audit status of the financial statements was
    Complete and Archived. 4

    2 SEC's calculated composite score was -.1 and our calculated composite score was 1.5.
    3 We noted that in three of the annual financial statements reviewed the statement of fmancial position did
    not conform to the format required by GAAP. As a result, there was insufficient information in the
    fmancial statements to properly calculate the composite scores. For two of the three fmancial statements
    we were able to obtain the necessary information from the institution and or the CPA finn to properly
    calculate the composite scores.
    4 During our review, we notified SEC that the eZ-Audit composite score worksheet screens had not been
    completed for three institutions' financial statements. Two of the three institutions were identified during


                                                          7

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements              ED-OIG/A03-F0001


In order to participate in any ofthe Title IV, Higher Education Act (HEA) programs, an
institution must demonstrate that it is financially responsible. An important factor in
determining an institution's financial responsibility status is its composite score. An
institution's composite score is determined by calculating the result of its primary
reserve, equity, and net income ratios (financial ratios). Once a composite score is
calculated, it is measured along a common scale from negative one to positive three. The
composite score could fall within three composite score scale zones. The composite
score scale zones are:

• 	 1.5 to 3.0 - Financially responsible without further oversight.
• 	 1.0 to 1.4 - "In the Zone." The institution is considered financially responsible but
    additional oversight is required.
• 	 -1.0 to .9 - Not financially responsible. The school must submit a letter of credit for
    at least 50 percent of its Title IV funding. The school may be permitted to participate
    under provisional certification with a smaller letter of credit, for at least 10 percent of
    its Title IV funding.

DRCC staff reviewed institutions' annual financial statements and completed an eZ­
Audit composite score worksheet screen for non-flagged financial statements. For
flagged financial statements, the Case Teams completed an eZ-Audit composite score
worksheet screen. Based on the input of the financial data in the composite score
worksheet screen, eZ-Audit computed the institution's official composite score.

Although we did not determine the specific cause( s) for the incorrect data entries on the
composite score worksheet screens, they appear to be the result of errors on the part of
the DRCC and or Case Team staff. The three financial statements that did not have a
composite score worksheet screen completed prior to being processed in eZ-Audit as
Complete and Archived appear to have been inadvertent omissions on the part of the
DRCC and Case Team staff.

Erroneous data fields in the composite score worksheet screens may result in improper
financial responsibility determinations. Consequently, institutions that are not financially
responsible may continue to participate in the Title IV, HEA programs and Title IV HEA
program funds may be at risk.

Subsequent to the completion of our audit fieldwork, SEC provided documentation
indicating that:

• 	 A system edit would be implemented in eZ-Audit that will not allow a flagged or
    non-flagged submission to be archived without an ED composite score being
    completed.

our review of the sample of 28 fmancial statements. SEC completed the composite score worksheet
screens for these two institutions. A third institution's (ABI-Accu Tech Business Institute, OPEID
02288900) fmancial statement, for the fiscal year ended May 31, 2003, was identified during our review of
a sample of 50 institutions with composite scores less than 1.5. Its composite score worksheet screen has
not yet been completed.


                                                    8
Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements              ED-OIG/A03-FOOOI



• 	 A report of all submissions flagged and non-flagged that are archived in eZ-Audit
    without an ED composite score has been requested. SEC officials explained that the
    ED composite score would be calculated for any submissions listed on the report.

Recommendations:

We recommend that the COO for FSA:

2.1 	 Ensure that the system edit is implemented and verify that the eZ-Audit system will
      not allow a flagged or non-flagged submission to be archived without an ED
      composite score being completed.

2.2 	 Ensure that an official composite score has been calculated for all Complete and
      Archived annual financial statement submissions.

2.3 	 Ensure that DRCC and Case Team staff properly complete the eZ-Audit composite
      score worksheet screen for all proprietary and private non-profit institutions.

FSA's Reply:

FSA concurred with these recommendations.

Finding No.3           Regulatory Exclusion, Applicable Only to Private Nonprofit
                      Institutions, Was Improperly Applied to Proprietary Institutions

In an Interim Audit Memorandum dated May 17, 2005, we informed SEC that we had
reviewed a total of 39 proprietary institutions with eZ-Audit composite scores of less than
1.5. We found two instances where SEC entered the amount ofFFEL and Pell Grant
funds received, for the fiscal year, by each institution, in the "REA Program Funds
Revenues" field in the eZ-Audit composite score worksheet screen. The eZ-Audit
system's program incorrectly excluded the funds, from both "total expenses" and "total
revenues" in calculating the financial ratios. 5

The regulations provide that in certain circumstances funds received under REA grant
programs can be excluded from the composite score calculation. The regulations at 34
C.F.R. § 668.172(c)(5) specify that the Secretary-

        Excludes from the ratio calculation Federal funds provided to an institution
        by the Secretary under programs authorized by the REA only if­

        (i) In the notes to the institution's audited financial statement, or as a
        separate attestation, the auditor discloses by name and CFDA number, the
        amount of REA program funds reported as expenses in the Statement of
        Activities for the fiscal year covered by that audit or attestation; and

5Total expenses and total revenues are components of the primary reserve and net income ratio
calculations, respectively.


                                                    9

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements    ED-OIG/A03-FOOO 1




        (ii) The institution's composite score, as determined by the Secretary, is
        less than 1.5 before the reported expenses arising from those REA funds
        are excluded from the ratio calculations.

While the regulation permits the exclusion of REA program funds from reported
expenses, the regulation does not provide for a corresponding reduction in revenue.

In the preamble to the final regulations the Secretary explained the application of this
provision in response to a commenter who suggested eliminating Title IV expenditures
from "total expenses." The Secretary stated that ­

        ... most Title IV, REA program funds will not be included in total
        expenses of colleges and universities. For example, payments made to
        those institutions under the Direct Loan, Federal Family Education Loan,
        Federal Pell Grant, and Federal Supplemental Educational Opportunity
        Grant programs are not included in total expenses reported on the
        statement of activities.

The Secretary further stated that ­

        ... in certain instances sponsored program expenses should be excluded
        from the ratio calculations. The Secretary believes that an institution that
        receives REA grant program funds, especially those associated with
        programs that strengthen institutions or expand access to higher education,
        should not fail the composite score solely because of the expenditure of
        those funds. Therefore, the amount of REA funds that an institution
        reports as expenses in its Statement of Activities for a fiscal year are
        excluded from the ratio calculations, but only if those reported expenses
        alone are responsible for the institution's failure to achieve a composite
        score of 1.5 for that fiscal year.6 [emphasis added]                   .

Proprietary institutions are not eligible to participate in the REA programs that would
result in the type of expense that would be excluded. Both the preamble and the
regulation reference the "statement of activities" which, under Generally Accepted
Accounting Principles, is included in the financial statements of nonprofit institutions.
Proprietary institutions have an income statement.

In its response to the memorandum FSA agreed with the OIG findings and stated:

        We have identified 16 schools (11 proprietary and five non-profit) where
        the regulatory exclusion was applied and are taking the following
        corrective actions:



662 Fed. Reg. 62,830, 62,845-6 (Nov. 25, 1997).


                                                  10 

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements                  ED-OIG/A03-FOOO I



           • 	 Immediately issued new/amended Performance Improvement
               Procedures to the School Participation Teams and contractor for
               properly applying the regulatory exclusion - completed June 1,2005;

           • 	 Analyzed the 16 affected schools to determine the impact of the
               composite score calculation error - completed June 8, 2005;

           • 	 Develop action plan for each school- to be completed by June 16,
               2005; and

           • 	 Initiate system changes to correct worksheet calculation and eliminate
               proprietary schools - to be completed by June 26, 2005. Manual
               workarounds are in place until the system changes are implemented.

On June 16,2005, FSA provided us with documentation confirming that the
corrective actions had been taken.

FSA's Reply:

FSA concurred with the finding.

                                           OTHER MATTERS

SEC's Quality Control Process did not ensure that all the eZ-Audit Financial
Statement Information Screens were completed correctly

We noted an error on the eZ-Audit Financial Statement Information Screen for 4 of the
30 financial statements reviewed. 7 On June 1,2005, we informed the SEC that in two
instances the institutions provided incorrect auditor information, and in another two
instances the institutions failed to provide the audit opinion type for the financial
statements.

On June 27,2005, SEC provided the following response regarding these issues:

           The auditor information is verified and entered in the database at the time
           of resolution by the School Participation Team, if the financial statements
           are flagged, or by the eZ-Audit Team ifthe financial statements are not
           flagged. The auditor information for these schools will be corrected. . ..

           The eZ-Audit system has edit checks that do not allow a submission to be
           accepted at all if this field [opinion type] is blank. A systems error caused
           the data not to display, however, the data is saved on the database. This
           error was reported and is currently being investigated. In these cases the
           financial statements show that the audit opinion was unqualified. The


7   Public institutions are required to complete the eZ-Audit Financial Statement Information Screen.


                                                       11 

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements    ED-OIG/A03-FOOO 1


        submission summary shows that the submission was flagged for other
        reasons but not for a "qualified" opinion therefore, the system is treating
        this as an unqualified opinion.

Subsequent to the completion of our audit fieldwork SEC provided documentation
indicating that:

• 	 The auditor information lor the two schools was corrected.

• 	 An eZ-Audit production support request had been prepared to ensure that the opinion
    type field data displays properly.

                      OBJECTIVE, SCOPE AND METHODOLOGY

The objective of our audit was to determine whether FSA's SEC established and
implemented procedures that provide reasonable assurance that all institutions' required
annual financial statement data is entered accurately in eZ-Audit.

To accomplish our objective, we obtained and analyzed a data file that SEC provided.
This file listed every financial statement report received through eZ-Audit during the
period April 1, 2003, through September 30, 2004. The file included all types of
financial statements. We limited our universe to include 2,490 annual financial statement
submissions that had a status of complete and archived for this period. We randomly
selected and reviewed the eZ-Audit financial statement data for 30 financial statement
reports from the universe of 2,490 complete and archived annual financial statement
submissions. The 30 financial statement reports included:

    • 	 15 proprietary institutions;
    • 	 13 private non-profit institutions; and
    • 	 2 public institutions.

We determined whether the regulatory exclusion of certain Title IV funds from the
financial ratio calculations, applicable only to private non-profit institutions, was applied
properly. To accomplish this we reviewed eZ-Audit financial statement data for a sample
of 50 financial statement reports randomly selected from the universe of 252 complete
and archived annual financial statement reports, submitted through eZ-Audit during the
period April 1, 2003, through September 30,2004, that had a flag reason field of "fail" or
"zone."

We reviewed SEC's procedures for the initial review and quality control reviews of
electronic submissions of institutions' financial statements through the eZ-Audit system.
We also interviewed DRCC and SEC personnel to obtain an understanding of these
procedures.




                                                  12 

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements    ED-OIG/A03-FOOOI



We did not rely on computer-processed data contained in the Department's eZ-Audit
system. However, we determined the universe of eZ-Audit computer-processed data (for
financial statements received through eZ-Audit during the period April 1, 2003, through
September 30, 2004) was complete. We compared theeZ-Audit data for our sample of
30 financial statement reports to source documents. Therefore, we believe the data used
was adequate for sampling and testing purposes for our audit objective.

We conducted our on-site fieldwork at SEC's headquarters in Washington, DC. from
November 8,2004, through November 10, 2004, and from November 15, 2004, through
November 16, 2004. Our audit was performed in accordance with generally accepted
government auditing standards appropriate to the scope ofthe review described above.

                        STATEMENT ON INTERNAL CONTROL

We have made a study and evaluation of SEC's internal control to ensure the accuracy of
eZ-Audit financial statement data for the period April 1, 2003 through September 30,
2004. Our study and evaluation was conducted in accordance with Government Auditing
Standards.

For the purpose ofthis report, we assessed and classified the significant internal control
into the following category:

Procedures for the initial review and quality control reviews of electronic submissions of
institutions' financial statements through the Department's eZ-Audit system.

The management of SEC is responsible for establishing and maintaining internal control.
In fulfilling this responsibility, estimates and judgments by management are required to
assess the expected benefits and related costs of control procedures. The objective of
internal control over the eZ-Audit system is to provide management with reasonable, but
not absolute, assurance that institutions' eZ-Audit financial statement data is valid and
reliable.

Because of inherent limitations in any internal control structure, errors or irregularities
may occur and not be detected. Also, projection of any evaluation ofthe system to future
periods is subject to the risk that procedures may become inadequate because of changes
in conditions, or that the degree of the compliance with the procedures may deteriorate.

Our assessment disclosed weaknesses in SEC's internal control for the period April 1,
2003, through September 30, 2004, which, in our opinion, result in more than a relatively
low risk that errors, irregularities and other inefficiencies may occur resulting in
inefficient and/or ineffective performance. These weaknesses are fully described in the
Audit Results. section of this report.




                                                  13 

Audit of SEC's Procedures for Reviews of eZ-Audit Financial Statements       ED-OIG/A03-FOOOl



                               ADMINISTRATIVE MATTERS 


Statements that managerial practices need improvements, as well as other conclusions
and recommendations in this report, represent the opinions of the Office of Inspector
General. Determinations of corrective action to be taken will be made by the appropriate
Department of Education officials.

Corrective actions proposed and implemented by your office will be monitored and
tracked through the Department's Audit Accountability and Resolution Tracking System
(AARTS). ED policy requires that you develop a final corrective action plan (CAP) for
our review in the automated system within 30 days ofthe issuance of this report. The
CAP should set forth the specific action items, and targeted completion dates, necessary
to implement final corrective actions on the findings and recommendations contained in
this final audit report.

In accordance with the Inspector General Act of 1978, as amended, the Office of
Inspector General is required to report to Congress twice a year on the audits that remain
unresolved after six months from the date of issuance.

In accordance with the Freedom ofInformation Act (5 U.S.C. §552), reports issued by
the Office of Inspector General are available to members ofthe press and general public
to the extent information contained therein is not subj ect to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have any questions,
please call Bernard Tadley, Regional Inspector General for Audit, at 215-656-6279.




                                                   Helen Lew
                                                   Assistant Inspector General for Audit


Attachment




                                                  14 

                                                                                                             .. 


Audit of SEC's Procedures for Reviews of eZ-Audit Fmancial Statements                   ED-OIGI A03-FOOO 1



                                                                     Attachment - Auditee's Response

                                                             FEDERAL
                                                             STUDENT AID
                                                              We Help Put America Through School



                                CHIEF OPERATING OFFICER 


                                                                                         SEP 122005
TO:             Bernard Tadley
                RegIOnal Inspector General for AudIt

FROM:           Theresa S. Shaw
                ChIef Operatmg Officer

SUBJECT:        Draft AudIt Report
                School Eligibility Channel's Review Process for eZ-Audit Financial SubmisSIOns
                ED-OIG/A03-FOOOI

ThIS is m response to your August 11, 2005 Draft AudIt Report. In general, FSA agrees WIth the
OIG findings and recommendations. The following responses address the referenced findmgs
and recommendatIOns m the memorandum.

Finding 1: School Eligibility Channel (SEC) Did Not Have Adequate Internal Controls to
Ensure the Accuracy of eZ-Audit Data Entered by Institutions.

Recommendation 1.1: Either Improve its processes for reviewing institutions eZ-Audit
financial statement template data to ensure the accuracy and reliability of all the data or
eliminate the requirement that institutions complete the financial statement templates as
part of the eZ-Audit annual financial statement submission.

FSA Response: FSA agrees to Improve ItS processes for reviewmg the finanCIal statements
template data and IS currently developmg these Improvements as part of the SEC StandardIzation
project. The updated procedures are scheduled to be m place by the end of March 2006. SEC
currently has a qualIty control process m place to reVIew the acceptablhty of reviews conducted
by the contractor. For non-flagged financial statements, FSA selects a statistIcal sample and tests
the acceptablhty reVlews preVlously conducted. Flagged finanCIal statements are reVIewed by
SEC's School Participation Teams. The use of the templates facll1tates the IdentificatIon of
schools that may pose a potential nsk to the Federal Student AId programs. These submISSIOns
are flagged for reVIew ImmedIately upon receIpt.

Finding 2: Institutions' Composite Scores Were Not Calculated Correctly.

Recommendation 2.1: Ensure that the system edit is implemented and verify that the eZ­
Audit system will not allow a flagged or non-flagged submission to be archived without an
ED composite score being calculated.

                                 830 First Street, NE, Washmgton, DC 20202 

                                               J-800-4-FED-AID 

                                            www studentmd ed gOY 





                                                    15
                                                                                                  •

Audit of SEC's Procedures for Reviews of eZ-Audit Fmancial Statements        ED-OIGI A03-FOOO 1


FSA Response: FSA agrees wIth the recommendatIOn and WIll Implement an enhancement to
the eZ-AudIt system planned for February 24, 2006, as part of a scheduled eZ-Audit release.
Begmnmg m August 2005, and untIl the system edIt IS Implemented a monthly report wIll be used
to Identlty submissIOns where an ED composite score has not been calculated.

Recommendation 2.2: Ensure that an official composite score has been calculated for all
Complete and Archived annual financial statement submissions.

FSA Response: FSA agrees wIth the recommendatIOn and has identified those financial
statement submissions where an ED composIte score has not been calculated. A composite score
calculatIOn WIll be completed for these submIssions by December 31, 2005.

Recommendation 2.3: Ensure that the Document Receipt and Control Center (DRCC) and
Case Team staff properly complete the eZ-Audit composite score worksheet screen for all
proprietary and private non-profit institutions.

FSA Response: FSA has a quality control process in place to reVIew the composIte scores
completed by the contractor. As errors are identIfied, they are communicated to DRCC and
documented, and modIficatIOns are made to established procedures as appropriate. As part of the
SEC StandardIzatIOn project, SEC WIll be strengthemng ItS procedures regardmg the completion
of the composIte score worksheets by the Case Team and DRCC staff and will Implement quality
control processes to ensure that the composIte score worksheets are properly completed. ThIS is
scheduled for Implementation by the end of March 2006.

Finding 3: Regulatory Exclusion, Applicable Only to Private Nonprofit Institutions, Was
Improperly Applied to Proprietary Institutions.

FSA Response: FSA agreed WIth the OIG findings and provided documentatIon on June 16,
2005, to confirm that correctIVe actions were taken.

If you have any questIOns, you may contact Molly Wyatt, DIrector, Integrated Partner
ManagementieZ-Audit at (202) 377-3358.

cc: Pat Howard




                                                16