oversight

Institutional Participation and Oversight Service has Opportunities to Improve the Recertification Process.

Published by the Department of Education, Office of Inspector General on 1998-08-27.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          Institutional Participation and Oversight Service has
          Opportunities to Improve the Recertification Process




                                 FINAL AUDIT REPORT




                                 Audit Control Number 05-80011
                                          August 1998




Our mission is to promote the efficient                          U.S. Department of Education
and effective use of taxpayer dollars                            Office of Inspector General
in support of American education                                 Chicago, IL
                             NOTICE

Statements that management practices need improvement, as well as other
 conclusions and recommendations in this report, represent the opinions of
 the Office of Inspector General. Determination of corrective action to be
taken will be made by appropriate Department of Education officials. This
 report may be released to members of the press and general public under
                      the Freedom of Information Act.
Table of Contents
         Institutional Participation and Oversight
         Service has Opportunities to Improve the
         Recertification Process
         Audit Control Number 05-80011

Transmittal Memorandum
Executive Summary                                                       1
Audit Results                                                           2

         Case Teams Did Not Always Document Work
         Performed To Reach Recertification Decisions                   2

         IPOS Can Improve Its Filing System                             4

Appendix
    Background, Purpose, Objectives, Scope,
    and Methodology, and Statement on Management
    Controls                                                            7




ED-OIG-AS, Audit Control Number 05-80011                FINAL AUDIT REPORT
MEMORANDUM

                                                                                    August 24, 1998

TO:            Dr. David A. Longanecker
               Assistant Secretary for Postsecondary Education


FROM:          Richard J. Dowd
               Regional Inspector General
               for Audit - Region V

SUBJECT:       Audit of the Institutional Participation and Oversight Service
               Recertifications (Audit Control Number 05-80011)

Attached is our subject final report that covers the results of our audit of the IPOS recertification
process. We incorporated the comments you provided in response to our finding point sheets.

Please provide the Supervisor, Post Audit Group, Financial Improvement, Receivables and Post
Audit Operations, Office of the Chief Financial And Chief Information Officer and the Office of
Inspector General, Planning, Analysis and Management Services with semiannual status reports
on promised corrective actions until all such actions have been completed or continued follow-up
is unnecessary.

In accordance with the Freedom of Information Act (Public Law 90-23), reports issued by the
Office of Inspector General are available, if requested, to members of the press and general public
to the extent information contained therein is not subject to exemptions in the Act. Copies of this
audit report have been provided to the offices shown on the distribution list enclosed in the report.

We appreciate the cooperation given us in the audit. If you have any questions or wish to discuss
the contents of this report, please contact me at 312-886-6503. Please refer to the above audit
control number in all correspondence relating to this report.




Attachment
                                   Executive Summary
The Higher Education Act of 1965 [HEA], as amended and enacted on July 23, 1992, provided that
institutional eligibility shall expire “not later than five years after such date of enactment.” As a result,
the Institutional Participation and Oversight Service [IPOS] needed to recertify all participating
institutions by July 23, 1997. Based on our audit, we believe that IPOS has generally completed all
recertifications required. We also believe that IPOS cannot be sure that case management teams [case
teams] always considered all pertinent information so they could reach the appropriate decision.
However, we generally did not find anything to indicate that the case teams made inappropriate
recertification decisions. Based on our audit, we concluded that IPOS has opportunities to improve the
recertification process.



Case Teams Did Not                         Case teams did not always document work performed,
Always Document Work                       including supervisory reviews, to reach recertification decisions
Performed To Reach                         because IPOS has not developed and documented adequate
Recertification Decisions                  management controls and case teams have not documented
                                           implementing procedures. The Office of Management and
                                           Budget [OMB] and General Accounting Office [GAO]
                                           guidance requires documentation of management controls,
                                           significant events, and adequate supervision. Without
                                           documentation of work performed, including supervisory
                                           review, IPOS cannot be sure the case teams considered all
                                           pertinent information to reach the appropriate recertification
                                           decision. We recommend that IPOS: (1) develop, document,
                                           and implement management controls to ensure (a) case teams
                                           adequately document all work performed to reach
                                           recertification decisions and (b) supervisors continuously
                                           review and approve the assigned work of the case teams; and
                                           (2) require each case team to document all implementing
                                           procedures.

IPOS Can Improve Its                       IPOS has an opportunity to improve its filing system to ensure
Filing System                              institutional files are properly maintained and readily available.
                                           We could not assess the recertification process for eighteen
                                           percent of the institutions for which we requested files because
                                           IPOS could not locate one or more of the files. The Standards
                                           for Internal Control in the Federal Government [Control
                                           Standards] require that significant events should be completely,
                                           clearly, and accurately documented. Documentation should
                                           facilitate tracing the event and be readily available for
                                           examination. Without the documentation, IPOS has no
                                           assurance case teams have the necessary information available
                                           for institutional recertification reviews and cannot support
                                           recertification decisions. We recommend Office of
                                           Postsecondary Education [OPE] allocate space to IPOS so it
                                           can develop a secure record and retrieval system which
                                           includes access, filing, tracking, and maintenance controls.


ED-OIG-AS, Audit Control Number 05-80011            Page 1                               FINAL AUDIT REPORT
                                                       Opportunities to Improve Recertification Process


                                           Audit Results
Based on our audit, we believe that IPOS has generally completed all recertifications required.
We also believe that IPOS cannot be sure that case teams always considered all pertinent
information so they could reach the appropriate decision. However, we generally did not find
anything to indicate that the case teams made inappropriate recertification decisions. Based on
the items reported, we concluded that IPOS can improve the recertification process as it relates to
documentation and filing.


       Case Teams Did Not Always Document Work Performed To
                   Reach Recertification Decisions

Case teams did not always document work performed, including supervisory reviews, to reach
recertification decisions because IPOS has not developed and documented adequate management
controls and the case teams have not documented their implementing procedures. OMB and
GAO guidance requires documentation of management controls, significant events, and adequate
supervision. Without documentation of work performed, including supervisory review, IPOS
cannot be sure the case teams considered all pertinent information to reach the appropriate
recertification decision. IPOS needs to ensure that case teams adequately document all work
performed, supervisors continuously review and approve the work, and case teams document all
implementing procedures.



Case Teams Perform                          Case teams review an institution’s application, financial
Recertification Reviews                     statements, compliance audit reports, program reviews, and
                                            other relevant information to reach a recertification
                                            decision. Different case team members perform different
                                            parts of the review and make individual recommendations
                                            based on the work they perform. The team members who
                                            work on the recertification review then reach an overall
                                            recommendation and provide it to the full case team for the
                                            final decision.

Management Controls And                     IPOS has established general management controls over the
Implementing Procedures                     recertification process. However, these general controls do
Are Incomplete Or                           not specify that case teams have to document work
Undocumented                                performed and send the documentation to headquarters to
                                            be filed in the eligibility file. IPOS has given each team the
                                            autonomy to perform the required work within the
                                            framework of the general management controls. Discussions
                                            with IPOS officials disclosed each case team has established
                                            similar implementing procedures, including a requirement
                                            for supervisory review. However, the procedures do not
ED-OIG-AS, Audit Control Number 05-80011             Page 2                            FINAL AUDIT REPORT
                                                      Opportunities to Improve Recertification Process

                                           include a requirement for team members to document their
                                           work. The case teams have not documented the
                                           implementing procedures they established.

Documentation Not In                       We reviewed institutional files and Case Management
Eligibility Files                          Information System [CMIS] data for 50 institutions that
                                           IPOS recertified after May 9, 1997. For 28 of the 50
                                           recertifications we reviewed [unduplicated count], case
                                           teams did not always document:

                                           " Reviews of financial statements, compliance audits, and
                                             program reviews prior to making recertification
                                             decisions. Of the 50 institutions in our sample, case
                                             teams did not document that they reviewed 2 financial
                                             statements, 4 compliance audits, and 3 program reviews.

                                           " Results of work performed in reviewing applications,
                                             financial statements, compliance audits, and program
                                             reviews to support conclusions reached. Of the 50
                                             institutions in our sample, case teams did not document
                                             the results of their reviews of 2 applications, 16 financial
                                             statements, 18 compliance audits, and 12 program
                                             reviews.

                                           " Determination of whether surety was needed before
                                             deciding to fully recertify three institutions.

                                           " Request for recommended surety prior to provisionally
                                             recertifying one institution.

                                           " Supervisory review of case team decisions. We found
                                             three files lacked documentation of Co-Team Leader
                                             reviews.

Appropriate Management                     OMB Circular A-123 [A-123] requires Federal agencies and
Controls Are Required                      managers to develop and implement appropriate
                                           management controls. A-123 requires: (1) management
                                           controls that reasonably ensure reliable and timely
                                           information is obtained, maintained, reported, and used for
                                           decision making and (2) appropriate oversight of
                                           organizational staff.




ED-OIG-AS, Audit Control Number 05-80011            Page 3                            FINAL AUDIT REPORT
                                                      Opportunities to Improve Recertification Process

Control Standards Require                  A-123 sets forth standards based on the Control Standards
Documentation And                          prescribed by the Comptroller General and issued by the
Supervisory Review                         GAO. The Control Standards require that management
                                           controls and significant events should be clearly
                                           documented. Documentation of significant events should be
                                           complete and accurate and facilitate tracing the event. In
                                           addition, the Control Standards require qualified and
                                           continuous supervision to ensure that management control
                                           objectives are achieved. Supervisors cannot review work
                                           performed if the case teams do not document it. If
                                           supervisors cannot review the work performed, IPOS has
                                           no assurance the case teams considered all the pertinent
                                           information to reach the appropriate recertification
                                           decisions.

                                           We recommend that IPOS: (1) develop, document, and
 RECOMMENDATIONS
                                           implement management controls to ensure (a) case teams
                                           adequately document all work performed to reach
                                           recertification decisions and (b) supervisors continuously
                                           review and approve the assigned work of the case teams;
                                           and (2) require each case team to document all
                                           implementing procedures.


                             IPOS Can Improve Its Filing System

IPOS has an opportunity to improve its filing system to ensure institutional files are properly
maintained and readily available. We could not assess the recertification process for eighteen percent
of the institutions for which we requested files because IPOS could not locate one or more of the files.
The Control Standards require that significant events should be completely, clearly, and accurately
documented. Documentation should facilitate tracing the event and be readily available for
examination. Without the documentation, IPOS has no assurance case teams have the necessary
information available for institutional recertification reviews and cannot support recertification
decisions. OPE needs to allocate space to IPOS so it can develop a secure record and retrieval
system.


Files Needed To Perform                    IPOS’s basic institutional file system consists of three
And Support                                separate files: eligibility, financial statement, and compliance
Recertifications                           audit files. In addition, IPOS maintains a separate program
                                           review file if it performed an institutional program review.
                                           IPOS maintains the documentation supporting the
                                           recertification review and decision in the eligibility files.
                                           Case teams use the information in the financial statement,
                                           compliance audit, and program review files to perform the

ED-OIG-AS, Audit Control Number 05-80011            Page 4                             FINAL AUDIT REPORT
                                                       Opportunities to Improve Recertification Process

                                           recertification reviews. In IPOS’s current system, it
                                           physically stores files in several unsecured locations. A
                                           contractor who studied the filing system found problems
                                           that included lack of management controls, missing files,
                                           and unfiled documents.

IPOS Could Not Locate                      We had to request files for 61 institutions before IPOS
Some Files                                 could provide all files so we could review a sample of 50
                                           institutions. We could not access the recertification process
                                           for 11 institutions [18 percent] because IPOS could not
                                           locate at least 1 file for each of them. Specifically, IPOS
                                           could not locate the eligibility files for 3 institutions, the
                                           financial statement file for 1 institution, the compliance audit
                                           file for 1 institution, and all files for 6 institutions. If IPOS
                                           cannot locate the institutional files, it has no assurance case
                                           teams had the necessary information available for
                                           performing recertifications and cannot support
                                           recertification decisions reached. Therefore, IPOS needs to
                                           improve its management controls to ensure institutional files
                                           are properly maintained and readily available.

Requirement To Obtain                      A-123 requires Federal departments to implement
Reliable Information                       management controls to ensure reliable and timely
                                           information is obtained, maintained, reported, and used for
                                           decision making. The Control Standards state that
                                           significant events should be clearly documented.
                                           Documentation of significant events should be complete and
                                           accurate and facilitate tracing the event. The
                                           documentation should be readily available for examination.

IPOS Is Implementing A                     IPOS is in the process of developing a new institutional
New System                                 filing system. The new filing system will have a secured,
                                           central location where only authorized personnel from select
                                           offices can retrieve and return the files. IPOS is considering
                                           color-coding to identify files by type, bar codes to identify
                                           individual files, and an automated system to track files.
                                           IPOS is currently awaiting the allocation of space to begin
                                           development of the planned filing system. It hopes to have
                                           the new system operational by November or December
                                           1998.

                                           We recommend that OPE allocate space so IPOS can begin
 RECOMMENDATIONS
                                           developing the planned filing system. Once IPOS obtains
                                           the space, it should quickly develop and implement the plan
                                           to ensure it maintains files for all eligible institutions
                                           participating in the Title IV programs. As part of the
                                           process, we suggest that IPOS compare a list of all eligible

ED-OIG-AS, Audit Control Number 05-80011            Page 5                              FINAL AUDIT REPORT
                                                      Opportunities to Improve Recertification Process

                                           institutions from the Postsecondary Education Participants
                                           System [PEPS] to the institutional files in the current system
                                           to identify any missing files that need to be located or
                                           created.

                                           We also recommend IPOS develop and implement controls
                                           which:

                                              " Limit access to the institutional files. Access
                                                controls include the use of combination or key entry
                                                locks and periodic combination or key changes.

                                              " Ensure only authorized personnel obtain custody of
                                                records. We suggest IPOS require identification and
                                                signatures to obtain custody. We also suggest IPOS
                                                set a time limit within which files should be returned.

                                              " Track checked out files. We suggest capturing
                                                information such as: (1) date files are checked out,
                                                (2) phone number, (3) anticipated location of files,
                                                and (4) estimate of how long files will be out. IPOS
                                                needs to perform periodic reviews of the information
                                                to identify files that have been checked out for
                                                extended periods of time. The personnel with
                                                custody of the files could then be contacted to
                                                determine why they have not returned the files.

                                              " Ensure documents are properly filed. All
                                                institutional files should be in one location.
                                                Documents within each file should be filed in
                                                chronological order and periodically reviewed to
                                                ensure outdated documents are purged.

                                              " Ensure records are maintained for a reasonable time
                                                period after an institution no longer participates in
                                                the Title IV programs.




ED-OIG-AS, Audit Control Number 05-80011            Page 6                            FINAL AUDIT REPORT
                                                                                             Appendix


                                           Background
IPOS is one of six services within the Student Financial Assistance Programs of the U.S.
Department of Education [ED] OPE. IPOS is divided into nine separate divisions. Four of those
nine divisions are case management divisions and correspond to one of the following geographic
sections: Northeast, Southeast, Northwest, and Southwest. A Director in Washington, D.C.
heads each case management division comprised of two or three case teams that correspond to
each of the ten regional offices. Each case team is compromised of members in both Washington,
D.C. and the regional offices. The case teams are responsible for the day to day operations
including recertifications.

IPOS is responsible for: (1) conducting program reviews of participating educational institutions
to ensure compliance with Federal legislation, regulation, and policies; (2) initiating fine,
limitation, suspension, termination, and emergency actions against institutions; (3) initiating
suspension and debarment actions against individuals and corporations to preclude their
involvement in any Federal activities; (4) resolving issues that arise when schools close, declare
bankruptcy, or are otherwise in financial or administrative jeopardy; (5) implementing and
coordinating the activities of the Secretary’s default reduction initiative; (6) developing and
implementing procedures to evaluate and recognize accrediting agencies and associations as
reliable authorities to determine the quality of education and training offered by educational
institutions; and (7) determining the eligibility for, and the certification of, all institutions that
participate in the Title IV programs.

The HEA, as amended and enacted on July 23, 1992, provided that institutional eligibility shall
expire “not later than five years after such date of enactment.” As a result, IPOS had to recertify
about 7,600 participating institutions in the five-year period ending July 23, 1997.

To recertify an institution, IPOS must ensure it meets regulatory requirements for administrative
capacity and financial responsibility. To make these determinations, IPOS reviews financial
statements, compliance audits, program review reports, and the recertification application. Some
specific items IPOS checks are: (1) financial ratios; (2) significant findings and liabilities; (3)
accreditation; (4) state approval; (5) complaints against the institution; and (6) default rates.


                Purpose, Objectives, Scope, and Methodology
The purpose of our audit was to determine whether IPOS (1) completed all recertifications
required and (2) made appropriate recertification decisions. Our specific objectives included
determining: (1) if IPOS developed and implemented adequate management controls over
recertifications; (2) how legislative changes affect recertification; (3) if IPOS identified all
institutions requiring recertification; (4) if IPOS made an appropriate recertification decision
considering all relevant information and adequately documented the basis for the recertification
decision; and (5) if IPOS management information systems provided the right personnel with the
necessary information in a format useful for making informed recertification decisions.




ED-OIG-AS, Audit Control Number 05-80011         Page 7                             FINAL AUDIT REPORT
                                                                                             Appendix

To achieve the purpose and specific objectives, we tested institutions with recertification decisions
after May 9, 1997, when IPOS issued guidance for processing recertification applications. We
reviewed 50 randomly selected institutional files from a universe of 2,367 institutions recertified
after May 9, 1997. In addition, we reviewed IPOS CMIS information for the 50 selected
institutions. To prevent duplication of effort, we reviewed prior audits of IPOS, held a discussion
with Price Waterhouse personnel, and reviewed a copy of the ED-OIG Kansas City office’s
provisional recertification audit program. We reviewed IPOS’s recertification policies and
procedures and interviewed IPOS personnel to obtain an understanding of the management
controls over recertifications. We reviewed the 1997 Federal Managers’Financial Integrity Act
Report as well as current and future legislative changes affecting recertifications.

To achieve the assignment’s objectives, we extensively relied on computer-processed data
contained in the CMIS and PEPS. We assessed the reliability of this data including relevant
general and application controls and found them to be adequate. We also conducted sufficient
tests of the data. Based on these tests and assessments, we conclude the data are sufficiently
reliable to be used in meeting the assignment’s objectives.

We conducted the on-site field work at IPOS headquarters in Washington, D.C. from March 30,
1998 through May 8, 1998. Our audit was performed in accordance with government auditing
standards appropriate to the scope of audit described above.


                          Statement on Management Controls
As part of our audit, we made an assessment of IPOS's management control structure, policies,
procedures, and practices applicable to the scope of the audit. The purpose of our assessment
was to determine the level of control risk; that is, the risk that material errors, irregularities, or
illegal acts may occur. The control risk assessment was performed to assist us in determining the
nature, extent, and timing of substantive tests needed to accomplish our audit purpose and
objectives.

To make the assessment, we identified and classified the significant management controls into the
following categories:

     " Documentation

     " Recertification process through supervisory review

     " File maintenance

Because of inherent limitations, a study and evaluation made for the limited purpose described
above would not necessarily disclose all material weaknesses in the control structure. However,
our assessment disclosed weaknesses specifically related to the areas of: (1) documenting
management controls, recertification work performed, and supervisory reviews; and (2)
maintaining readily available institutional files. These weaknesses are discussed in the "Audit
Results" section of this report.


ED-OIG-AS, Audit Control Number 05-80011         Page 8                             FINAL AUDIT REPORT
                             REPORT DISTRIBUTION LIST
                           AUDIT CONTROL NUMBER 05-80011

                                                                                          No. of
                                                                                          Copies
Action Official
    Dr. David A. Longanecker
    Assistant Secretary for Postsecondary Education

Other ED Offices
    Deputy Secretary                                                                          1
    Deputy Assistant Secretary for Student Financial Assistance Programs                      1
    Service Director, Institutional Participation and Oversight Service                       1
    Service Director, Accounting and Financial Management Service, OPE (electronically)       1
    Office of Public Affairs                                                                  1
    Secretary’s Regional Representative, Region V                                             1
    Institutional Participation and Oversight Service, Region V                               1

ED-OIG (electronically)
   Inspector General                                                                           1
   Deputy Inspector General                                                                    1
   Assistant Inspector General for Audit                                                       1
   Assistant Inspector General for Investigations                                              1
   Assistant Inspectors General for Operations                                            1 each
   Director, Advisory & Assistance, SFA                                                        1
   Director, PAMS                                                                              1
   Regional Inspectors General for Audit                                                  1 each