Institutional Participation and Oversight Service has Opportunities to Improve the Recertification Process FINAL AUDIT REPORT Audit Control Number 05-80011 August 1998 Our mission is to promote the efficient U.S. Department of Education and effective use of taxpayer dollars Office of Inspector General in support of American education Chicago, IL NOTICE Statements that management practices need improvement, as well as other conclusions and recommendations in this report, represent the opinions of the Office of Inspector General. Determination of corrective action to be taken will be made by appropriate Department of Education officials. This report may be released to members of the press and general public under the Freedom of Information Act. Table of Contents Institutional Participation and Oversight Service has Opportunities to Improve the Recertification Process Audit Control Number 05-80011 Transmittal Memorandum Executive Summary 1 Audit Results 2 Case Teams Did Not Always Document Work Performed To Reach Recertification Decisions 2 IPOS Can Improve Its Filing System 4 Appendix Background, Purpose, Objectives, Scope, and Methodology, and Statement on Management Controls 7 ED-OIG-AS, Audit Control Number 05-80011 FINAL AUDIT REPORT MEMORANDUM August 24, 1998 TO: Dr. David A. Longanecker Assistant Secretary for Postsecondary Education FROM: Richard J. Dowd Regional Inspector General for Audit - Region V SUBJECT: Audit of the Institutional Participation and Oversight Service Recertifications (Audit Control Number 05-80011) Attached is our subject final report that covers the results of our audit of the IPOS recertification process. We incorporated the comments you provided in response to our finding point sheets. Please provide the Supervisor, Post Audit Group, Financial Improvement, Receivables and Post Audit Operations, Office of the Chief Financial And Chief Information Officer and the Office of Inspector General, Planning, Analysis and Management Services with semiannual status reports on promised corrective actions until all such actions have been completed or continued follow-up is unnecessary. In accordance with the Freedom of Information Act (Public Law 90-23), reports issued by the Office of Inspector General are available, if requested, to members of the press and general public to the extent information contained therein is not subject to exemptions in the Act. Copies of this audit report have been provided to the offices shown on the distribution list enclosed in the report. We appreciate the cooperation given us in the audit. If you have any questions or wish to discuss the contents of this report, please contact me at 312-886-6503. Please refer to the above audit control number in all correspondence relating to this report. Attachment Executive Summary The Higher Education Act of 1965 [HEA], as amended and enacted on July 23, 1992, provided that institutional eligibility shall expire “not later than five years after such date of enactment.” As a result, the Institutional Participation and Oversight Service [IPOS] needed to recertify all participating institutions by July 23, 1997. Based on our audit, we believe that IPOS has generally completed all recertifications required. We also believe that IPOS cannot be sure that case management teams [case teams] always considered all pertinent information so they could reach the appropriate decision. However, we generally did not find anything to indicate that the case teams made inappropriate recertification decisions. Based on our audit, we concluded that IPOS has opportunities to improve the recertification process. Case Teams Did Not Case teams did not always document work performed, Always Document Work including supervisory reviews, to reach recertification decisions Performed To Reach because IPOS has not developed and documented adequate Recertification Decisions management controls and case teams have not documented implementing procedures. The Office of Management and Budget [OMB] and General Accounting Office [GAO] guidance requires documentation of management controls, significant events, and adequate supervision. Without documentation of work performed, including supervisory review, IPOS cannot be sure the case teams considered all pertinent information to reach the appropriate recertification decision. We recommend that IPOS: (1) develop, document, and implement management controls to ensure (a) case teams adequately document all work performed to reach recertification decisions and (b) supervisors continuously review and approve the assigned work of the case teams; and (2) require each case team to document all implementing procedures. IPOS Can Improve Its IPOS has an opportunity to improve its filing system to ensure Filing System institutional files are properly maintained and readily available. We could not assess the recertification process for eighteen percent of the institutions for which we requested files because IPOS could not locate one or more of the files. The Standards for Internal Control in the Federal Government [Control Standards] require that significant events should be completely, clearly, and accurately documented. Documentation should facilitate tracing the event and be readily available for examination. Without the documentation, IPOS has no assurance case teams have the necessary information available for institutional recertification reviews and cannot support recertification decisions. We recommend Office of Postsecondary Education [OPE] allocate space to IPOS so it can develop a secure record and retrieval system which includes access, filing, tracking, and maintenance controls. ED-OIG-AS, Audit Control Number 05-80011 Page 1 FINAL AUDIT REPORT Opportunities to Improve Recertification Process Audit Results Based on our audit, we believe that IPOS has generally completed all recertifications required. We also believe that IPOS cannot be sure that case teams always considered all pertinent information so they could reach the appropriate decision. However, we generally did not find anything to indicate that the case teams made inappropriate recertification decisions. Based on the items reported, we concluded that IPOS can improve the recertification process as it relates to documentation and filing. Case Teams Did Not Always Document Work Performed To Reach Recertification Decisions Case teams did not always document work performed, including supervisory reviews, to reach recertification decisions because IPOS has not developed and documented adequate management controls and the case teams have not documented their implementing procedures. OMB and GAO guidance requires documentation of management controls, significant events, and adequate supervision. Without documentation of work performed, including supervisory review, IPOS cannot be sure the case teams considered all pertinent information to reach the appropriate recertification decision. IPOS needs to ensure that case teams adequately document all work performed, supervisors continuously review and approve the work, and case teams document all implementing procedures. Case Teams Perform Case teams review an institution’s application, financial Recertification Reviews statements, compliance audit reports, program reviews, and other relevant information to reach a recertification decision. Different case team members perform different parts of the review and make individual recommendations based on the work they perform. The team members who work on the recertification review then reach an overall recommendation and provide it to the full case team for the final decision. Management Controls And IPOS has established general management controls over the Implementing Procedures recertification process. However, these general controls do Are Incomplete Or not specify that case teams have to document work Undocumented performed and send the documentation to headquarters to be filed in the eligibility file. IPOS has given each team the autonomy to perform the required work within the framework of the general management controls. Discussions with IPOS officials disclosed each case team has established similar implementing procedures, including a requirement for supervisory review. However, the procedures do not ED-OIG-AS, Audit Control Number 05-80011 Page 2 FINAL AUDIT REPORT Opportunities to Improve Recertification Process include a requirement for team members to document their work. The case teams have not documented the implementing procedures they established. Documentation Not In We reviewed institutional files and Case Management Eligibility Files Information System [CMIS] data for 50 institutions that IPOS recertified after May 9, 1997. For 28 of the 50 recertifications we reviewed [unduplicated count], case teams did not always document: " Reviews of financial statements, compliance audits, and program reviews prior to making recertification decisions. Of the 50 institutions in our sample, case teams did not document that they reviewed 2 financial statements, 4 compliance audits, and 3 program reviews. " Results of work performed in reviewing applications, financial statements, compliance audits, and program reviews to support conclusions reached. Of the 50 institutions in our sample, case teams did not document the results of their reviews of 2 applications, 16 financial statements, 18 compliance audits, and 12 program reviews. " Determination of whether surety was needed before deciding to fully recertify three institutions. " Request for recommended surety prior to provisionally recertifying one institution. " Supervisory review of case team decisions. We found three files lacked documentation of Co-Team Leader reviews. Appropriate Management OMB Circular A-123 [A-123] requires Federal agencies and Controls Are Required managers to develop and implement appropriate management controls. A-123 requires: (1) management controls that reasonably ensure reliable and timely information is obtained, maintained, reported, and used for decision making and (2) appropriate oversight of organizational staff. ED-OIG-AS, Audit Control Number 05-80011 Page 3 FINAL AUDIT REPORT Opportunities to Improve Recertification Process Control Standards Require A-123 sets forth standards based on the Control Standards Documentation And prescribed by the Comptroller General and issued by the Supervisory Review GAO. The Control Standards require that management controls and significant events should be clearly documented. Documentation of significant events should be complete and accurate and facilitate tracing the event. In addition, the Control Standards require qualified and continuous supervision to ensure that management control objectives are achieved. Supervisors cannot review work performed if the case teams do not document it. If supervisors cannot review the work performed, IPOS has no assurance the case teams considered all the pertinent information to reach the appropriate recertification decisions. We recommend that IPOS: (1) develop, document, and RECOMMENDATIONS implement management controls to ensure (a) case teams adequately document all work performed to reach recertification decisions and (b) supervisors continuously review and approve the assigned work of the case teams; and (2) require each case team to document all implementing procedures. IPOS Can Improve Its Filing System IPOS has an opportunity to improve its filing system to ensure institutional files are properly maintained and readily available. We could not assess the recertification process for eighteen percent of the institutions for which we requested files because IPOS could not locate one or more of the files. The Control Standards require that significant events should be completely, clearly, and accurately documented. Documentation should facilitate tracing the event and be readily available for examination. Without the documentation, IPOS has no assurance case teams have the necessary information available for institutional recertification reviews and cannot support recertification decisions. OPE needs to allocate space to IPOS so it can develop a secure record and retrieval system. Files Needed To Perform IPOS’s basic institutional file system consists of three And Support separate files: eligibility, financial statement, and compliance Recertifications audit files. In addition, IPOS maintains a separate program review file if it performed an institutional program review. IPOS maintains the documentation supporting the recertification review and decision in the eligibility files. Case teams use the information in the financial statement, compliance audit, and program review files to perform the ED-OIG-AS, Audit Control Number 05-80011 Page 4 FINAL AUDIT REPORT Opportunities to Improve Recertification Process recertification reviews. In IPOS’s current system, it physically stores files in several unsecured locations. A contractor who studied the filing system found problems that included lack of management controls, missing files, and unfiled documents. IPOS Could Not Locate We had to request files for 61 institutions before IPOS Some Files could provide all files so we could review a sample of 50 institutions. We could not access the recertification process for 11 institutions [18 percent] because IPOS could not locate at least 1 file for each of them. Specifically, IPOS could not locate the eligibility files for 3 institutions, the financial statement file for 1 institution, the compliance audit file for 1 institution, and all files for 6 institutions. If IPOS cannot locate the institutional files, it has no assurance case teams had the necessary information available for performing recertifications and cannot support recertification decisions reached. Therefore, IPOS needs to improve its management controls to ensure institutional files are properly maintained and readily available. Requirement To Obtain A-123 requires Federal departments to implement Reliable Information management controls to ensure reliable and timely information is obtained, maintained, reported, and used for decision making. The Control Standards state that significant events should be clearly documented. Documentation of significant events should be complete and accurate and facilitate tracing the event. The documentation should be readily available for examination. IPOS Is Implementing A IPOS is in the process of developing a new institutional New System filing system. The new filing system will have a secured, central location where only authorized personnel from select offices can retrieve and return the files. IPOS is considering color-coding to identify files by type, bar codes to identify individual files, and an automated system to track files. IPOS is currently awaiting the allocation of space to begin development of the planned filing system. It hopes to have the new system operational by November or December 1998. We recommend that OPE allocate space so IPOS can begin RECOMMENDATIONS developing the planned filing system. Once IPOS obtains the space, it should quickly develop and implement the plan to ensure it maintains files for all eligible institutions participating in the Title IV programs. As part of the process, we suggest that IPOS compare a list of all eligible ED-OIG-AS, Audit Control Number 05-80011 Page 5 FINAL AUDIT REPORT Opportunities to Improve Recertification Process institutions from the Postsecondary Education Participants System [PEPS] to the institutional files in the current system to identify any missing files that need to be located or created. We also recommend IPOS develop and implement controls which: " Limit access to the institutional files. Access controls include the use of combination or key entry locks and periodic combination or key changes. " Ensure only authorized personnel obtain custody of records. We suggest IPOS require identification and signatures to obtain custody. We also suggest IPOS set a time limit within which files should be returned. " Track checked out files. We suggest capturing information such as: (1) date files are checked out, (2) phone number, (3) anticipated location of files, and (4) estimate of how long files will be out. IPOS needs to perform periodic reviews of the information to identify files that have been checked out for extended periods of time. The personnel with custody of the files could then be contacted to determine why they have not returned the files. " Ensure documents are properly filed. All institutional files should be in one location. Documents within each file should be filed in chronological order and periodically reviewed to ensure outdated documents are purged. " Ensure records are maintained for a reasonable time period after an institution no longer participates in the Title IV programs. ED-OIG-AS, Audit Control Number 05-80011 Page 6 FINAL AUDIT REPORT Appendix Background IPOS is one of six services within the Student Financial Assistance Programs of the U.S. Department of Education [ED] OPE. IPOS is divided into nine separate divisions. Four of those nine divisions are case management divisions and correspond to one of the following geographic sections: Northeast, Southeast, Northwest, and Southwest. A Director in Washington, D.C. heads each case management division comprised of two or three case teams that correspond to each of the ten regional offices. Each case team is compromised of members in both Washington, D.C. and the regional offices. The case teams are responsible for the day to day operations including recertifications. IPOS is responsible for: (1) conducting program reviews of participating educational institutions to ensure compliance with Federal legislation, regulation, and policies; (2) initiating fine, limitation, suspension, termination, and emergency actions against institutions; (3) initiating suspension and debarment actions against individuals and corporations to preclude their involvement in any Federal activities; (4) resolving issues that arise when schools close, declare bankruptcy, or are otherwise in financial or administrative jeopardy; (5) implementing and coordinating the activities of the Secretary’s default reduction initiative; (6) developing and implementing procedures to evaluate and recognize accrediting agencies and associations as reliable authorities to determine the quality of education and training offered by educational institutions; and (7) determining the eligibility for, and the certification of, all institutions that participate in the Title IV programs. The HEA, as amended and enacted on July 23, 1992, provided that institutional eligibility shall expire “not later than five years after such date of enactment.” As a result, IPOS had to recertify about 7,600 participating institutions in the five-year period ending July 23, 1997. To recertify an institution, IPOS must ensure it meets regulatory requirements for administrative capacity and financial responsibility. To make these determinations, IPOS reviews financial statements, compliance audits, program review reports, and the recertification application. Some specific items IPOS checks are: (1) financial ratios; (2) significant findings and liabilities; (3) accreditation; (4) state approval; (5) complaints against the institution; and (6) default rates. Purpose, Objectives, Scope, and Methodology The purpose of our audit was to determine whether IPOS (1) completed all recertifications required and (2) made appropriate recertification decisions. Our specific objectives included determining: (1) if IPOS developed and implemented adequate management controls over recertifications; (2) how legislative changes affect recertification; (3) if IPOS identified all institutions requiring recertification; (4) if IPOS made an appropriate recertification decision considering all relevant information and adequately documented the basis for the recertification decision; and (5) if IPOS management information systems provided the right personnel with the necessary information in a format useful for making informed recertification decisions. ED-OIG-AS, Audit Control Number 05-80011 Page 7 FINAL AUDIT REPORT Appendix To achieve the purpose and specific objectives, we tested institutions with recertification decisions after May 9, 1997, when IPOS issued guidance for processing recertification applications. We reviewed 50 randomly selected institutional files from a universe of 2,367 institutions recertified after May 9, 1997. In addition, we reviewed IPOS CMIS information for the 50 selected institutions. To prevent duplication of effort, we reviewed prior audits of IPOS, held a discussion with Price Waterhouse personnel, and reviewed a copy of the ED-OIG Kansas City office’s provisional recertification audit program. We reviewed IPOS’s recertification policies and procedures and interviewed IPOS personnel to obtain an understanding of the management controls over recertifications. We reviewed the 1997 Federal Managers’Financial Integrity Act Report as well as current and future legislative changes affecting recertifications. To achieve the assignment’s objectives, we extensively relied on computer-processed data contained in the CMIS and PEPS. We assessed the reliability of this data including relevant general and application controls and found them to be adequate. We also conducted sufficient tests of the data. Based on these tests and assessments, we conclude the data are sufficiently reliable to be used in meeting the assignment’s objectives. We conducted the on-site field work at IPOS headquarters in Washington, D.C. from March 30, 1998 through May 8, 1998. Our audit was performed in accordance with government auditing standards appropriate to the scope of audit described above. Statement on Management Controls As part of our audit, we made an assessment of IPOS's management control structure, policies, procedures, and practices applicable to the scope of the audit. The purpose of our assessment was to determine the level of control risk; that is, the risk that material errors, irregularities, or illegal acts may occur. The control risk assessment was performed to assist us in determining the nature, extent, and timing of substantive tests needed to accomplish our audit purpose and objectives. To make the assessment, we identified and classified the significant management controls into the following categories: " Documentation " Recertification process through supervisory review " File maintenance Because of inherent limitations, a study and evaluation made for the limited purpose described above would not necessarily disclose all material weaknesses in the control structure. However, our assessment disclosed weaknesses specifically related to the areas of: (1) documenting management controls, recertification work performed, and supervisory reviews; and (2) maintaining readily available institutional files. These weaknesses are discussed in the "Audit Results" section of this report. ED-OIG-AS, Audit Control Number 05-80011 Page 8 FINAL AUDIT REPORT REPORT DISTRIBUTION LIST AUDIT CONTROL NUMBER 05-80011 No. of Copies Action Official Dr. David A. Longanecker Assistant Secretary for Postsecondary Education Other ED Offices Deputy Secretary 1 Deputy Assistant Secretary for Student Financial Assistance Programs 1 Service Director, Institutional Participation and Oversight Service 1 Service Director, Accounting and Financial Management Service, OPE (electronically) 1 Office of Public Affairs 1 Secretary’s Regional Representative, Region V 1 Institutional Participation and Oversight Service, Region V 1 ED-OIG (electronically) Inspector General 1 Deputy Inspector General 1 Assistant Inspector General for Audit 1 Assistant Inspector General for Investigations 1 Assistant Inspectors General for Operations 1 each Director, Advisory & Assistance, SFA 1 Director, PAMS 1 Regional Inspectors General for Audit 1 each
Institutional Participation and Oversight Service has Opportunities to Improve the Recertification Process.
Published by the Department of Education, Office of Inspector General on 1998-08-27.
Below is a raw (and likely hideous) rendition of the original report. (PDF)