oversight

Audit of the Department of Education's Followup Process for External Audits.

Published by the Department of Education, Office of Inspector General on 2005-03-31.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                     Audit of the Department of Education’s
                      Followup Process for External Audits



                                  FINAL AUDIT REPORT




                                            ED-OIG/A19-D0007
                                               March 2005


Our mission is to promote the efficiency,                      U.S. Department of Education
effectiveness, and integrity of the                            Office of Inspector General
Department’s programs and operations.                          Operations Internal Audit Team
                                                               Washington, DC
    Statements that managerial practices need improvements, as well as other 

                 conclusions and recommendations in this report, 

   represent the opinions of the Office of Inspector General. Determinations of 

                   corrective action to be taken will be made by 

               the appropriate Department of Education Officials. 



In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued 

         by the Office of Inspector General are available to members of the 

     press and general public to the extent information contained therein is not 

                           subject to exemptions in the Act.

                         UNITED STATES DEPARTMENT OF EDUCATION

                                               OFFICE OF INSPECTOR GENERAL




MEMORANDUM
                                                                                                                          March 31, 2005

TO:	           Jack Martin
               Chief Financial Officer
               Office of the Chief Financial Officer


FROM:	         Helen Lew /s/
               Assistant Inspector General for Audit Services

SUBJECT:	 Final Audit Report
          Audit of the Department of Education’s Followup Process for External Audits
          Control Number ED-OIG/A19-D0007

Attached is the subject final audit report that covers the results of our review of the followup
process for external audits at various Principal Offices for external OIG audits issued during the
period October 1, 1997, through September 30, 2002. An electronic copy has been provided to
your Audit Liaison Officer. We received your comments which generally concurred with the
findings and most of the recommendations in our draft report.

Corrective actions proposed (resolution phase) and implemented (closure phase) by your office
will be monitored and tracked through the Department’s Audit Accountability and Resolution
Tracking System (AARTS). ED policy requires that you develop a final corrective action plan
(CAP) for our review in the automated system within 30 days of the issuance of this report. The
CAP should set forth the specific action items, and targeted completion dates, necessary to
implement final corrective actions on the findings and recommendations contained in this final
audit report.

In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector
General is required to report to Congress twice a year on the audits that remain unresolved after
six months from the date of issuance.

In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office
of Inspector General are available to members of the press and general public to the extent
information contained therein is not subject to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have any questions, please
call Michele Weaver Dugan at (202) 245-6941.

Enclosure

                                           400 MARYLAND AVE., S.W. WASHINGTON, D.C. 20202-1510

                  Our mission is to ensure equal access to education and to promote educational excellence throughout the Nation.
                                    TABLE OF CONTENTS 



                                                                                                         Page


EXECUTIVE SUMMARY .....................................................................................1 


BACKGROUND ..................................................................................................... 4 


AUDIT RESULTS................................................................................................... 6 


        Finding No. 1 – Office of the Chief Financial Officer Post Audit 

              Group Did Not Ensure the Department’s Audit Followup 

              System for External Office of Inspector General (OIG) Audits 

              Was Effective ...................................................................................... 6 


                 Recommendations ............................................................................. 10 


        Finding No. 2 –The Department Closed External OIG Audits Prior to 

              Completion of Corrective Actions .................................................... 11 


                 Recommendations ............................................................................. 14 


OBJECTIVE, SCOPE, AND METHODOLOGY................................................. 18 


STATEMENT ON INTERNAL CONTROLS...................................................... 21 


ATTACHMENTS 

        Attachment 1 – Principal Office Reports Issued in Conjunction with This Audit 

        Attachment 2 –Audit Reports Reviewed in This Audit 

        Attachment 3 – Department Response to Draft Audit Report 

                              EXECUTIVE SUMMARY 


Office of Management and Budget (OMB) Circular A-50, Audit Followup, states,

       Each agency shall establish systems to assure the prompt and proper resolution
       and implementation of audit recommendations. These systems shall provide for a
       complete record of action taken on both monetary and nonmonetary findings and
       recommendations.

The Circular requires that each agency designate a top management official to oversee followup,
including resolution and corrective action. The Department of Education’s (Department’s)
designated followup official is the Chief Financial Officer (CFO). Within the Office of the Chief
Financial Officer (OCFO), the Post Audit Group (PAG) is responsible for assisting the CFO in
the audit followup process.

The objective of our audit was to evaluate the effectiveness of the Department’s audit followup
process to ensure that external auditees implement corrective actions as a result of Office of
Inspector General (OIG) audits.

We found that the Department’s audit followup system was not always effective. PAG did not
fulfill its responsibilities to ensure that Action Officials (AOs) had systems in place to follow up
on corrective actions, monitor the Department’s compliance with OMB Circular A-50, and
ensure the overall effectiveness of the Department’s audit resolution and followup system. In
total, we found that audit followup activities were not effective for 17 of the 46 audits reviewed.
As a result, the Department did not have assurance that requested corrective actions were
completed for 40 of the 239 recommendations reviewed. The risks remain that related programs
are not being effectively managed and Department funds are not being used as intended.

We also found that Principal Office (PO) staff closed audits prior to completion of corrective
actions. As a result, PAG was no longer tracking audits for which all corrective actions had not
been completed, and these audits were underreported to Congress.

To correct the identified weaknesses, we recommend that the Chief Financial Officer:

       • 	 Develop and implement a process to periodically evaluate the appropriateness of the
           PO followup systems for external OIG audits.
       • 	 Develop and implement guidance that (a) defines the roles of PAG and the POs for
           followup activity for discretionary grant audits resolved by PAG, and (b) defines
           audit closure for external OIG audits, including audits on appeal and audits for which
           collection activity is ongoing.


ED-OIG/A19-D0007                              	                                      Page 1
       • 	 Provide training to PO audit resolution staff on the requirements for audit followup,
           the documentation that should be maintained, and the requirements that must be met
           before an audit should be considered closed.
       • 	 Develop and implement a process requiring AO certification and PAG validation that
           adequate documentation was received to support completion of corrective actions
           prior to closing external OIG audits.
       • 	 Ensure the status of external OIG audits currently in litigation, or awaiting re-
           evaluation, is reflected as resolved, but not closed, in the Audit Accountability
           Resolution Tracking System (AARTS) to accurately reflect status.
       • 	 Identify all external OIG audits that were closed since September 30, 2004, determine
           those audits for which corrective actions have been completed, and those for which
           corrective actions are still in process. For those audits where corrective action has
           been completed, ensure an appropriate “closed” date is reflected in AARTS. For
           those audits where corrective actions are still in process, correct the data in AARTS
           to accurately reflect the status of the audits, and continue tracking the completion of
           corrective actions.
       • 	 Ensure the Department’s Semiannual Report to Congress on Audit Follow-up
           accurately reports audits which have been resolved, but for which corrective actions
           have not been completed.

We discussed our findings and recommendations in our exit conference with OCFO and PO
staff. OCFO provided a written response to the preliminary findings and recommendations
presented at the exit conference. Where appropriate, we included and addressed elements of the
OCFO response to the exit conference in this draft report.

The Department concurred with our recommendations with two exceptions. The Department
stated our recommendation to develop and implement a process requiring AO certification and
the PAG review of the adequacy of audit follow-up documentation prior to closing external OIG
audits was impractical in terms of cost, travel and staff hours it will demand. The Department
added the PO should have discretion in how follow-up is accomplished based upon resources
available, and that implementing this recommendation would require a dedication of staff and
budgetary resources that far exceeds any marginal benefits to be realized.

We recognize the role and responsibility of the Department in resolving and closing OIG
external audits. However, in accordance with OMB Circular A-50, the Department’s Post Audit
User Guide, and the Department’s AARTS User Manual, when corrective actions are defined, the
Department has the responsibility to ensure they are taken. The Department also expressed
concern in certifying actions taken by external entities. Based on the Department’s comments
we modified the recommendation to clarify that the recommended certification and review
process relates to the adequacy of information obtained prior to closing the audit.

The Department also disagreed with our recommendation to identify all external OIG audits that
have been closed since September 30, 2003, and review the status of each corrective action. The
Department stated this would be extremely resource intensive and detract from current resolution
efforts. Finally, the Department did not believe that the findings in the draft audit report warrant
this degree of scrutiny. Our audit determined that the Department closed recommendations prior

ED-OIG/A19-D0007                              	                                      Page 2
to the completion of corrective action in 24 of the 46 audits reviewed (52 percent). We found
that this caused data to be underreported to Congress in reports submitted by the Department and
the OIG. We believe it is imperative that data provided to Congress is complete and accurate.
We reconsidered this recommendation in response to the Department’s request at our exit
conference for this audit and reduced the time period subject to review from external OIG audits
closed over the past two years to those closed since September 30, 2003. We have subsequently
modified this period to those closed since September 30, 2004 to help ensure the data included in
the next reports to Congress are accurate.

In its response, the Department requested a meeting with OIG to further discuss these issues and
the impact of the recommendations before the final report is issued. OIG modified two of its
recommendations based on the Department's comments as detailed above, and is willing to meet
with the Department during the audit resolution process to discuss any concerns that may remain
in these areas. The entire text of the Department's response is provided as Attachment 3 to this
report.




ED-OIG/A19-D0007                                                                  Page 3
                                         BACKGROUND 


Office of Management and Budget (OMB) Circular A-50, Audit Followup, provides the
requirements for establishing systems to assure prompt and proper resolution and
implementation of audit recommendations. The Circular states,

        Audit followup is an integral part of good management, and is a shared
        responsibility of agency management officials and auditors. Corrective action
        taken by management on resolved findings and recommendations is essential to
        improving the effectiveness and efficiency of Government operations. Each
        agency shall establish systems to assure the prompt and proper resolution and
        implementation of audit recommendations. These systems shall provide for a
        complete record of action taken on both monetary and non-monetary findings and
        recommendations.

The Circular requires that each agency designate a top management official to oversee followup,
including resolution and corrective action. The Department of Education’s (Department’s)
designated followup official is the Chief Financial Officer (CFO). Within the Office of the Chief
Financial Officer (OCFO), the Post Audit Group (PAG) is responsible for assisting the CFO in
the audit followup process.

When an external Office of Inspector General (OIG) audit report is issued, Department officials
review available information including items such as the audit report and the auditee response.
They develop a resolution document that provides notice to the auditee of management decisions
or program determinations made by the Department.1 These determinations relate to the
monetary and non-monetary findings in the audit report. Once this document has been issued to
the auditee, the audit is considered “resolved.”

OMB Circular A-50 defines audit resolution as follows:

        For most audits, the point at which the audit organization and agency
        management or contracting officials agree on action to be taken on reported
        findings and recommendations; or, in the event of disagreement, the point at
        which the audit followup official determines the matter to be resolved.

OMB Circular A-50 further states that the audit followup official has the responsibility for
ensuring that corrective actions are taken.

The Department implemented the Audit Accountability and Resolution Tracking System
(AARTS) in July 2003. AARTS is a web-based application designed to assist the Department’s
management with audit reporting and followup activities. The AARTS User Manual for External
Audits states that an audit is considered “closed” when “. . .the PO [Principal Office] Specialist
1
 Audit resolution documents include Final Audit Determination Letters (FAD) issued by Federal Student Aid and
Program Determination Letters (PDL) issued by other Department Principal Offices.

ED-OIG/A19-D0007                                                                               Page 4
indicates that all required corrective action has been taken.” The Common Audit Resolution
System (CARS) preceded AARTS as the Department’s audit tracking system for external audits.

The Department has established a Post Audit User Guide (Guide) to provide policy and
procedures for the audit resolution and followup process. The Guide provides that,

         Each Assistant Secretary (or equivalent office head) with cooperative audit
         resolution or related responsibilities must ensure that the overall cooperative audit
         resolution process operates efficiently and consistently.

The Guide defines the responsibilities of an Action Official (AO) – generally an Assistant
Secretary or equivalent office head – to include:

    • 	 Determining the action to be taken and the financial adjustments to be made in resolving
        findings in audit reports concerning respective program areas of responsibility,
    • 	 Monitoring auditee actions in order to ensure implementation of recommendations
        sustained in program determinations, and
    • 	 Maintaining formal, documented systems of cooperative audit resolution and followup.

The Guide also defines roles and responsibilities for PAG that include:

    • 	 Ensuring that AOs have appropriate audit followup systems in place and that these
        systems are being effectively used,
    • 	 Monitoring the Department's compliance with OMB Circular A-50, and
    • 	 Ensuring the overall effectiveness of the Department’s audit followup system.

This report presents the results of our audit of the Department’s audit followup process for
external OIG audits. It combines the results of work conducted within seven POs. In conducting
this audit, separate reports were issued to POs with responsibility for audit resolution and
followup for the audits included in our scope. A listing of these reports is included as
Attachment 1 to this report. The following POs were included in our audit:

    •	   Federal Student Aid (FSA)
    •	   Office of Elementary and Secondary Education (OESE)2
    •	   Office of Postsecondary Education (OPE)
    •	   Office of Special Education and Rehabilitative Services (OSERS)
    •	   Office of the Chief Financial Officer (OCFO)
    •	   Institute of Educational Services (IES)3
    •	   Office of English Language Acquisition (OELA)

A listing of the audits reviewed is included as Attachment 2 to this report.


2
  Our review included four OIG audits of programs that were originally part of OESE. Followup activities for two

of the four audits became the responsibility of the Office of Safe and Drug-Free Schools (OSDFS). 

3
  This office was previously part of the Office of Educational Research and Improvement (OERI). 


ED-OIG/A19-D0007                                    	                                            Page 5
                                    AUDIT RESULTS 


We found that the Department’s audit followup system was not always effective. PAG did not
fulfill its responsibilities to ensure that AOs had systems in place to follow up on corrective
actions, monitor the Department’s compliance with OMB Circular A-50, and ensure the overall
effectiveness of the Department’s audit resolution and followup system. In total, we found that
audit followup activities were not effective for 17 of the 46 audits reviewed. As a result, the
Department did not have assurance that requested corrective actions were completed for 40 of
the 239 recommendations reviewed. The risks remain that related programs are not being
effectively managed and Department funds are not being used as intended.

We also found that PO staff closed audits prior to completion of corrective actions. As a result,
PAG was no longer tracking audits for which all corrective actions had not been completed, and
these audits were underreported to Congress.



Finding No. 1 –       PAG Did Not Ensure the Department’s Audit Followup
                      System for External OIG Audits was Effective

PAG did not fulfill its responsibilities to ensure that the Department’s audit followup system for
external OIG audits was operating effectively. Specifically, we found that PAG did not
effectively:

     •   Ensure that AOs had systems in place to follow up on corrective actions,
     •   Monitor the Department’s compliance with OMB Circular A-50, and
     •   Ensure the overall effectiveness of Department’s audit resolution and followup system.

During our review we evaluated audit resolution documents and the corrective actions requested
by the Department when resolving OIG external audits. The 46 audits reviewed included a total
of 239 recommendations sustained by the Department. We evaluated the resolution documents
to identify whether any corrective actions were requested in response to the recommendations.
We discussed the audit followup process with PO staff, and evaluated documentation maintained
by the POs to determine whether the Department had obtained assurance that requested
corrective actions were taken. We found that in 17 of the 46 audits, for 40 of the 239
recommendations, the Department did not have documentation adequate to support corrective
actions taken by the auditee.

We found that some PO staff were not familiar with the requirements included in OMB Circular
A-50 and the Post Audit User Guide regarding audit followup. Staff in one PO stated that they
did not followup on corrective actions once the audit resolution documents were issued. They

ED-OIG/A19-D0007                                                                    Page 6
stated that they assumed the auditee would take the corrective actions requested. Staff in one PO
stated that they did not have sufficient resources to follow up on all requested corrective actions.
Staff in one PO stated they were not familiar with the documentation needed and were unsure of
record retention requirements. Staff in one PO inappropriately relied on subsequent single or
compliance audits for assurance that actions taken during OIG audits were corrected. We also
found there was confusion as to whether PO staff or PAG were responsible for following up on
corrective actions requested for OIG discretionary grant audits resolved by PAG.

Audit Followup Requirements

OMB Circular A-50, Section 7, “Responsibilities,” states:

       b. 	 Agency management officials are responsible for receiving and analyzing audit
            reports, providing timely responses to the audit organization, and taking corrective
            actions where appropriate….
       c. 	 The audit followup official has personal responsibility for ensuring that (1) systems of
            audit followup, resolution, and corrective action are documented and in place…(4)
            corrective actions are actually taken.

Government Accountability Office (GAO), “Standards for Internal Control for the Federal
Government,” defines the minimum level of quality acceptable for internal control in
government. The fifth standard for internal control, “Monitoring,” states,

       Internal control monitoring should assess the quality of performance over time
       and ensure that findings of audits and other reviews are promptly
       resolved…Managers are to…(3) complete, within established timeframes, all
       actions that correct or otherwise resolve the matters brought to management’s
       attention. . ..

OCFO’s Post Audit User Guide, Chapter 1, Part D, states the Chief Financial Officer is the
designated Audit Followup Official (AFUO) for the Department of Education. The Guide also
states the AFUO is responsible for:

       Ensuring that a system of cooperative audit resolution and follow-up is
       documented and in place, including follow-up to ensure corrective actions are
       implemented.

Part E of the same chapter states that the PAG within the OCFO provides support to the AFUO.
The Guide further states PAG/OCFO is responsible for, “. . .[M]onitoring the Department's
compliance with OMB Circular A-50, Audit Follow-up.”




ED-OIG/A19-D0007                              	                                      Page 7
Section III, “External Audits,” Chapter 5, Part B, of the Guide states:

          Primary responsibility for following up on nonmonetary determinations rests with
          AOs, who must have systems in place to ensure that recommended corrective
          actions are implemented by auditees. PAG/OCFO has responsibility for verifying
          that AOs have systems in place to followup on corrective actions and ensuring
          overall effectiveness of ED’s [Department of Education’s] audit resolution
          followup system.

This section also states, “Accurate records must be kept of all audit followup activities including
all correspondence, documentation, and analysis of documentation.”

While PAG did issue policy and procedures on audit followup requirements through the Post
Audit User Guide, and clarification in September 2002 on specific documentation requirements,
it had not established a process to verify that the POs fully understood the requirements, were in
compliance, and had appropriate systems in place to follow up on corrective actions. As a
corrective action to a prior OIG audit of the effectiveness of the audit followup process for OIG
internal audits,4 PAG implemented a process to review PO audit resolution files to ensure that
appropriate documentation had been obtained to assure that corrective actions were completed.
PAG’s process requires this review to be conducted before audits can be considered closed. This
process went into effect as of January 1, 2003, but only applies to internal OIG and GAO audits
of the Department. PAG does not review the adequacy of documentation obtained to support
corrective actions taken for external OIG audits.

Without this review, PAG could not evaluate the effectiveness of the PO systems for audit
followup and could not identify that PO staff did not always obtain and maintain appropriate
documentation that corrective actions were taken by the auditees. We also found that PAG was
not effectively following up on corrective actions requested for the discretionary grant audits it
resolved, or ensuring that the appropriate program office was following up on the requested
corrective actions. As a result, the Department was not in compliance with OMB Circular A-50,
and its audit resolution and followup system for external OIG audits was not always effective.
The Department did not have assurance that the requested corrective actions were taken and that
the issues noted in the audits were corrected. As such, the risks remain that related programs are
not being effectively managed and Department funds are not being used as intended.

In a written response to our preliminary findings and recommendations presented at the exit
conference, PAG stated:

          [T]here is a discrepancy in the definitions of the terms “resolved” and “closed” as
          interpreted by OIG in its point sheets versus the practicality of how these terms
          are currently defined by management. Once a management decision (PDL or
          FAD) is issued, the audit is both “resolved” and “closed” unless the decision


4
    Audit Controls Over of the Audit Followup Process, ED-OIG/A19-B0002, issued October 2001.



ED-OIG/A19-D0007                                                                                Page 8
       specifically requests follow-up activity from the auditee, e.g., within 60 days
       provide written policies….

PAG further stated:

       [T]he findings and recommendations are based on the premise that all external
       audit findings have equal value, either procedurally or monetarily, without
       consideration of management’s discretion to determine the degree of effort
       required based on the complexity or severity of the finding and staff resources.
       Triage is a process that has been effectively used throughout the Department, with
       OIG and OGC’s support and participation, for many years. It provides a
       consensus and direction on how to address audit findings. Requesting an entity to
       take a particular action for a finding determined by Triage members to be
       “minor,” and not obligating resources to follow up on the action, should not be
       construed as a management weakness; instead, it should be acknowledged as
       management using its discretion to dedicate staff resources responsibly.

OIG did not misinterpret the definitions of the terms “resolved” and “closed” as used by the
Department. Our audit began with closed audits for which the Department requested corrective
actions in the management decision. These audits would be considered resolved at the time of
the management decision, but not closed until corrective actions were completed. We confirmed
the definitions of these terms with PAG staff during our review. PAG staff confirmed our
understanding of these terms in verbal discussions, and also provided the following in an email
during our review:

       An audit is considered closed when all findings/recommendations are closed. A
       finding or recommendation is closed when a PDL has been issued or, if there are
       instructions in the PDL to provide additional data or assurances, when the
       material has been received, analyzed and determined sufficient.

This definition of “closed” agrees with that provided in the Department’s response to the exit
conference, and the definition in the AARTS User Manual for External Audits, which states that
an audit is considered “closed” when “. . .the PO Specialist indicates that all required corrective
actions have been taken.” This is the definition used in our review.

As stated above, our basis for determining corrective actions to review was the audit resolution
document. We identified the corrective actions requested by the Department and obtained and
evaluated the adequacy of supporting documentation for each corrective action. Since
Department managers made the determination as to what actions were required, we did not
evaluate the significance of the actions requested in the audit resolution document. We merely
identified that the Department did request corrective action. At no time during our review did
we find or were we provided with any documentation to indicate a recommendation was
determined to be “minor,” and/or that the Department did not intend to dedicate resources to
follow up on the corrective action.




ED-OIG/A19-D0007                                                                     Page 9
Our audit methodology was conveyed to PAG and other Department staff during our entrance
conference, discussions with PO staff, and interim status briefings with PAG staff. At no time
prior to or during our fieldwork within each office did Department staff indicate to us that they
had concerns with the audit methodology or selected audits/recommendations. The
Department’s position that some actions were considered minor and therefore would not require
followup was not mentioned until presentation of our findings at the exit conferences for one PO
and for the overall project.

OIG did not question the discretion of the Department in sustaining or not sustaining the
findings, or in determining the corrective actions needed. However, without documentation
regarding the Department’s determination that some corrective actions were considered minor,
and its intent not to follow up on those actions, we cannot conclude that such a decision process
took place prior to the presentation of our findings from this audit. In each case where we cited
ineffective followup, the Department had requested corrective actions from the auditee. In
resolving the audits, the Department had the discretion to concur with the finding but not require
any corrective action due to materiality, if that was its determination.

Recommendations
We recommend the Chief Financial Officer:


       1.1 	   Develop and implement a process to periodically evaluate the appropriateness of
               the PO followup systems for external OIG audits.

       1.2 	   Develop and implement procedures to periodically report on the adequacy of AO
               systems for followup on external corrective actions, and the overall effectiveness
               of the Department’s external audit followup system, based on the reviews of audit
               followup documentation and any other related factors currently tracked by the
               Department.

       1.3 	   Provide training to PO audit resolution staff on the requirements for audit
               followup and on the documentation that should be maintained to provide
               assurance that corrective actions are taken.

       1.4 	   Develop and implement guidance that defines the roles of PAG and the respective
               program offices in completing followup activity for external OIG discretionary
               grant audits resolved by PAG.


Department of Education Response:

The Department generally concurred with each of the above recommendations. With respect to
recommendation 1.4, the Department stated a process had already been implemented in response
to an OIG recommendation from a prior audit report.



ED-OIG/A19-D0007                             	                                     Page 10
Finding No. 2 –           The Department Closed External OIG Audits Prior to
                          Completion of Corrective Actions


Principal Office staff closed external OIG audits prior to completion of corrective actions. We
identified nine audits that were reported as closed, but for which corrective action had not been
completed at the time of our review. We also identified 15 additional audits where the corrective
actions had been completed at the time of our review, but had not been completed at the time the
audits were closed. In total, we found that 24 of the 46 audits reviewed (52 percent) were closed
before corrective actions were completed. As a result, PAG was no longer tracking the status of
the corrective actions, and the number of audits for which corrective actions had not yet been
completed was underreported to Congress.

The results by PO were as follows:

                                              # Audits            # Closed Before Corrective
               Principal Office               Reviewed                Actions Completed
             FSA                                  27                          13
             Discretionary Grants5                 9                           3
             OESE                                  4                           3
             OCFO                                  3                           2
             OSERS                                 2                           2
             IES                                   1                           1
             Total                                46                          24

For the nine audits where corrective actions had not been completed at the time of our review,
we found PO staff:

    •   Closed two of the audits although corrective actions were ongoing,
    •   Were reevaluating the management decision for three audits, and
    •   Closed four audits although the management decision was under appeal.

Audit Followup Requirements

OMB Circular A-50, Section 8.a.(4), states that systems for resolution and corrective action
must, “[M]aintain accurate records of the status of audit reports or recommendations through the
entire process of resolution and corrective action.”




5
 Includes eight OPE discretionary grant audits, and one OELA discretionary grant audit. These audits are resolved
by PAG, rather than by program officials.

ED-OIG/A19-D0007                                                                                Page 11
Section 5(a) of the Inspector General Act of 1978, as amended, states:

       Each Inspector General shall, not later than April 30 and October 31 of each year,
       prepare semiannual reports summarizing the activities of the Office during the
       immediately preceding six-month periods ending March 31 and September 30.
       Such reports shall include. . .(3) an identification of each significant
       recommendation described in previous semiannual reports on which corrective
       action has not been completed. . ..

Since the Department is responsible for audit followup, information for this section of the OIG’s
Semiannual Report is received from the Department through its audit resolution and tracking
system.

Section 5(b)(4) of the Act also requires the Department to provide to Congress a semiannual
report along with the Inspector General’s report, which includes:

       [A] statement with respect to audit reports on which management decisions have
       been made but final action has not been taken, other than audit reports on which a
       management decision was made within the preceding year. . .except that such
       statement may exclude such audit reports that are under formal administrative or
       judicial appeal or upon which management of an establishment has agreed to
       pursue a legislative solution, but shall identify the number of reports in each
       category so excluded.

We found that audits were closed before corrective actions were completed in part because the
Department did not previously track external audits as resolved or closed. In CARS, the prior
audit resolution tracking system, one status code was entitled “Resolved (Closed).” The CARS
database provided another status code entitled, “All corrective actions completed,” but this status
code was not used. In addition, the database included separate fields for the audit resolution
document date (indicating an audit was resolved), and the closed date (indicating all corrective
actions were completed). However, the closed field was not always used appropriately and was
often the same as or within a short time after the audit resolution document date. Used in this
manner, the closed date did not accurately reflect the date all corrective actions were completed.

The Department’s current system, AARTS, also includes the ability to distinguish between these
phases of the audit resolution and followup process and accurately report status of the corrective
actions. While the recently issued AARTS User Manual for External Audits states that an audit
is considered “closed” when all required corrective actions have been taken, prior Department
guidance did not include any definition or instruction for closing external OIG audits.

As discussed in Finding 1, staff from one PO did not followup on actions requested in audit
resolution documents, and assumed that the auditees would take the requested actions. Some PO
staff stated that they did not have sufficient resources to followup on all requested corrective
actions. PAG stated that limited resources and an increasing workload made it difficult to ensure



ED-OIG/A19-D0007                                                                   Page 12
that corrective actions were taken for external audits. PAG also stated that in some cases prior
practice was to consider audits closed when the resolution documents were issued.

While OCFO’s Post Audit User Guide includes specific direction relating to closure for internal
OIG audits, it does not contain similar direction for external OIG audits. The Post Audit User
Guide also requires certification by AOs that all corrective actions were completed prior to
closure for internal OIG audits. However, it does not require a similar certification for external
OIG audits. As discussed in Finding 1, PAG reviews audit followup documentation for internal
OIG and GAO audits before the audits are considered closed. The same type of review is not
conducted for external audits.

As a result, audits that were reported as closed but for which corrective actions were still in
process may not have been appropriately tracked and could not be monitored by OCFO.
Department management may not have been aware of the audits for which corrective actions
were still in process. In addition, audits that were listed as closed, but for which all corrective
actions had not been completed, were underreported to Congress in the OIG Semiannual Report,
Table 1, “Recommendations Described in Previous Semiannual Reports on Which Corrective
Action Has Not Been Completed,” and in the Department’s Semiannual Report to Congress on
Audit Follow-up, Chapter Three, “Reports Pending Final Action One Year or More After
Issuance of a Management Decision.”

Of the nine audits we identified where corrective actions were not completed at the time of our
review, two were audits where corrective actions were currently ongoing, four were currently
under appeal, and the Department was reevaluating the management decision for three audits.
Only four of these nine audits were correctly reflected in statistical data in Department’s
semiannual reports. Two audits where a corrective action was ongoing and three audits still on
appeal were not reflected in the Department’s semiannual report. None of the nine audits were
correctly listed in OIG’s semiannual report since the audits were closed in the Department’s
audit resolution tracking system, OIG’s source for this information.

In a written response to our preliminary findings and recommendations presented at the audit exit
conference, PAG stated:

       It has been a long-standing practice, and one we support continuing, not to keep
       an external audit “open” that is on appeal or results in the establishment of a
       receivable. As discussed at the exit conference, PAG will work with POs, OGC
       [Office of General Counsel], and OIG to issue clearer guidance on audit follow-
       up, including precise definitions for the terms “resolved” and “closed.”

While OMB Circular A-50 does provide a definition for resolution, we could not identify a
definition of audit closure in the Circular or in the Department’s guidance for external OIG
audits. During our audit we contacted PAG regarding the definition of audit closure, to which it
provided the following:

       An audit is considered closed when all findings/recommendations are closed. A
       finding or recommendation is closed when a PDL has been issued or, if there are

ED-OIG/A19-D0007                                                                   Page 13
       instructions in the PDL to provide additional data or assurances, when the
       material has been received, analyzed and determined sufficient. Resolution
       specialists and AOs have the latitude to determine when material received in
       response to a request for additional information or information presented in the
       audit is sufficient to resolve and close a finding. Oftentimes, a decision to close a
       finding is reached after consultation from OGC and/or OIG. Because of the
       myriad of requirements unique to each program, there is no one-way to determine
       when a finding is closed. These decisions are reached on a finding by finding
       basis.

We recognize that issuing clearer guidance on audit follow-up, including precise definitions for
the terms “resolved” and “closed” could remove some of the confusion that exists in this area.
However, we do not concur that an audit should be “closed” when corrective action is under
appeal. OMB Circular A-50 allows that audits under appeal may still be considered resolved.
The Post Audit User Guide does not specify how audits under appeal should be reflected.
When an audit is appealed, the auditee does not concur with the management decision and
corrective actions requested. There is no certainty the requested corrective actions will be
upheld and ultimately completed by the auditee. As such, the audit cannot accurately be
considered closed.

With respect to audits for which a receivable has been established, but collection has not been
completed, OCFO policy does not address how to reflect the status of these audits. As such, it is
not clear whether these audits should be considered closed, since the return or repayment of
funds is a corrective action not yet completed. OCFO indicated in its response to the exit
conference that it would develop clearer guidance on audit followup and the definitions of
“resolved” and “closed.” The status of audits currently under appeal and in collection status
should also be addressed in this revised guidance. As appropriate separate categories for
tracking the status of these audits in AARTS should be established.


Recommendations

We recommend that the Chief Financial Officer:


       2.1 	   Develop and implement a process requiring AO certification and PAG validation
               that adequate documentation was received to support completion of corrective
               actions prior to closing external OIG audits.

       2.2 	   Ensure the status of external OIG audits currently under appeal, awaiting re-
               evaluation, or in collection, is reflected as resolved, but not closed, in AARTS, to
               accurately reflect the status of the audit. Establish additional categories in
               AARTS as appropriate to allow for tracking these audits.

       2.3 	   Enhance the accuracy of AARTS data by identifying all external OIG audits that
               were closed since September 30, 2004, and coordinate with the program offices to


ED-OIG/A19-D0007                             	                                      Page 14
               identify those audits for which corrective actions have been completed, and those
               for which corrective actions are still in process. For those audits where corrective
               action has been completed, ensure an appropriate “closed” date is reflected in
               AARTS. For those audits where corrective actions are still in process, correct the
               data in AARTS to accurately reflect the status of the audits.

       2.4     	Ensure the Department’s Semiannual Report to Congress on Audit Follow-up
               accurately reports audits which have been resolved, but for which corrective
               actions have not been completed.

       2.5 	   Develop and implement guidance that defines audit closure for external audits.
               The guidance should be consistent with OMB policy and definitions identified in
               other documents such as AARTS User Manuals, and address audits on appeal and
               those for which the only remaining corrective action is collection of funds due the
               Department.

       2.6 	   Provide training to PO staff to ensure they are informed of the updated policy
               guidance and that audits should not be considered closed until all corrective
               actions have been completed.

Implementation of the recommendations made in Finding 1 will also strengthen controls and the
accuracy of reporting in this area.


Department of Education Response:

The Department generally concurred with recommendations 2.2, 2.4, 2.5, and 2.6. With respect
to recommendation 2.1, the Department stated:

       As discussed during the exit conference; program offices, OGC and OCFO have
       very serious concerns with this recommendation and respectfully request that the
       OIG reconsider its position. Certification does work well for internal audits.
       However, the AO is certifying the completion of corrective actions taken within
       the PO. The logistical and resource ramifications involved with having an AO
       certify the actions of an entity external to the Department of Education and
       subsequently with having PAG review the adequacy of follow-up documentation,
       is impractical in terms of cost, travel and staff hours it will demand. The PO
       should have discretion in how follow-up is accomplished based upon resources
       available. Implementing this recommendation would require a dedication of
       departmental staff and budgetary resources that far exceeds any marginal benefits
       to be realized. We believe that corrective actions taken on Recommendations 1.1,
       1.2 and 1.3 above will adequately address weaknesses in the audit follow-up
       process. We request that the OIG meet with the program offices, OGC and
       OCFO to further discuss the concerns expressed in implementing this
       recommendation.



ED-OIG/A19-D0007                             	                                     Page 15
With respect to recommendation 2.3 the Department stated:

       As discussed during the exit conference, program offices, OGC and OCFO have
       concerns with this recommendation. The task of determining OIG-issued external
       audits closed during the past year and a half and reviewing the status of each
       corrective action would be extremely labor intensive and would not add value to
       the process. We also do not believe that the findings in the draft audit report
       warrant this degree of scrutiny. The Department’s audit workload has increased
       dramatically over the past year; therefore, implementing this recommendation
       would have an adverse impact on efforts to resolve and close external audits that
       are currently in the follow-up process. During the exit conference, we requested
       that the OIG reconsider this recommendation, and we were given assurances that
       this would occur. We request that the OIG meet with the program offices, OGC
       and OCFO to further discuss the concerns expressed in implementing this
       recommendation.

Office of Inspector General Comments:

With respect to recommendation 2.1, during our audit we identified corrective actions sought by
the Department through the resolution document and obtained and evaluated the adequacy of
supporting information for each requested corrective action. We recognize the role and
responsibility of the Department in resolving and closing OIG external audits. However, when
corrective actions are defined the Department has the responsibility to ensure they are taken.

OIG agrees the Department’s discretion includes determining the means to gain assurance that
requested corrective actions were completed. The method chosen to ensure that corrective
actions were completed need not be resource intensive. For example, the Department could
require the auditee to submit documentation rather than conducting on-site visits. However, in
accordance with OMB Circular A-50, the Department’s Post Audit User Guide, and the
Department’s AARTS User Manual, the method chosen should provide evidence that the required
corrective action has been taken. During this review we noted instances where the applicable
method selected by the Department was not completed or did not provide adequate information
to show that corrective actions were completed. This included instances where planned on-site
monitoring was not conducted, documentation to support completion of requested actions was
not obtained, and single audits did not provide assurance that the independent auditor reviewed
the action item for completion.

Based on the Department’s comments regarding certifying actions taken by external entities, we
modified the recommendation to clarify that the suggested certification and review process relate
to the adequacy of information obtained prior to closing the audit.

With respect to recommendation 2.3, the audit determined that the Department closed
recommendations prior to the completion of corrective action in 24 of the 46 audits reviewed (52
percent). We found that this caused data to be underreported to Congress in reports submitted by
the Department and the OIG. We believe it is imperative that data provided to Congress is
complete and accurate. We reconsidered this recommendation in response to the Department’s

ED-OIG/A19-D0007                                                                 Page 16
request at our exit conference for this audit and reduced the time period subject to review from
external OIG audits closed over the past two years to those closed since September 30, 2003, in
the draft report. We have subsequently modified this period to those audits closed since
September 30, 2004, to help ensure data included in the next reports to Congress is accurate.

OIG modified two of its recommendations based on the Department's comments as detailed
above and is willing to meet with the Department during the audit resolution process to discuss
any concerns that may remain in these areas.




ED-OIG/A19-D0007                                                                  Page 17
             OBJECTIVES, SCOPE, AND METHODOLOGY



The objective of our audit was to evaluate the effectiveness of the Department’s process to ensure
that external auditees implement corrective action. To accomplish our objective, we reviewed
applicable laws and regulations, and Department policies and procedures. We conducted
interviews with Department staff responsible for resolving and following up on corrective actions
for the audits selected. We also reviewed documentation provided by Department staff to
support the corrective actions taken for the recommendations included in our review.

The universe for our audit included OIG audits of external entities issued during the period
October 1, 1997, through September 30, 2002. We identified a total of 204 audits in this
universe, as shown below by PO.

                                          Table 1

                              Audit Reports in Universe - By PO 


                                                                       Number of
                                                                      Reports in the
                                                                         Audit
                            PO Title                       PO Acronym   Universe
       Office of Federal Student Aid                          FSA         103
       Office of Elementary and Secondary Education        OESE/OSDFS      30
       and Office of Safe and Drug Free Schools
       Office of Special Education and Rehabilitative         OSERS               25
       Services
       Office of the Chief Financial Officer                   OCFO               18
       Office of Postsecondary Education                        OPE               18
       Institute of Education Sciences                          IES                5
       Office of Vocational and Adult Education                OVAE                3
       Office of the Chief Information Officer                 OCIO                1
       Office of English Language Acquisition,                 OELA                1
       Language Enhancement, and Academic
       Achievement for Limited English Proficient
       Students
       Total                                                                     204




ED-OIG/A19-D0007                                                                  Page 18
We refined our scope to include only those audits reported by the Department’s audit resolution
system as “closed” on or before September 30, 2002. We also excluded certain categories of
audits from our scope, including those relating to Year 2000 compliance, alternative products,
and discontinued programs. We determined a total of 75 audits were within the scope of our
audit. The number of audits and recommendations within our scope is shown below for each PO.

                                         Table 2

                         Audit Reports within Audit Scope - By PO 


                                       Number of              Number of
                                     Reports Within       Recommendations
                      PO              Audit Scope         Within Audit Scope
                FSA                       38                     181
                OESE/OSDFS                12                      49
                OPE                       10                      51
                OSERS                      7                      38
                OCFO                       4                      17
                IES                        3                      19
                OELA                       1                       2
                Total                     75                     357

To select audits within our scope for review, we evaluated the status of the recommendations and
corrective actions required by the Department. We excluded any internal or non-sustained
recommendations in these audits from our review. We judgmentally selected all 42 audits that
included monetary findings for this review. We also judgmentally selected four additional audits
from high-risk programs with no monetary findings.

In total, we selected 46 audits and 239 related recommendations for review. This represented 61
percent of the audits and 67 percent of the recommendations within our scope. The number of
selected audits and recommendations for each PO is shown below. A complete listing of the
selected audits is included as Attachment 2 to this report.

                                          Table 3

                      Selected Reports and Recommendations - By PO


                                                          Total Number of
                                      Number of           Recommendations
                       PO           Reports Selected          Selected
                FSA                       27                    136
                OESE/OSDFS                 4                     18
                OPE                        8                     46
                OSERS                      2                     15
                OCFO                       3                     13
                IES                        1                     9
                OELA                       1                      2
                Total                     46                    239

ED-OIG/A19-D0007                                                                Page 19
We relied on computer-processed data initially obtained from OIG’s Audit Tracking System to
identify OIG audits issued during the scope period. We reconciled this data to the Department’s
CARS, and to audits reported in the OIG semiannual reports to Congress to ensure that we had
captured all audits issued during the period. We also reviewed copies of the audit reports to
ensure the audits met the scope period under review. We confirmed data in the audit reports to
data in AARTS, which replaced CARS in July 2003. Based on these tests and assessments, we
determined that the computer-processed data was reliable for meeting our audit objective.

The focus of this audit was on assurance that corrective actions were completed. We based our
review on corrective actions requested in the issued final audit resolution document. We
reviewed and analyzed documentation provided by the Department to determine if sufficient
assurance was obtained that auditees implemented requested corrective actions. For monetary
findings, we also evaluated documentation supporting the return of funds to the Department.

We conducted fieldwork at Department offices in Washington, DC, during the period September
2003 through June 2004. We held an exit conference with PAG on July 1, 2004. Our audit was
performed in accordance with government auditing standards appropriate to the scope of the
review described above.




ED-OIG/A19-D0007                                                                Page 20
                STATEMENT ON INTERNAL CONTROLS



We made a study and evaluation of the internal control structure relating to the Department’s
audit followup process for external OIG audits in effect from September 2003 through June
2004. This study and evaluation was conducted in accordance with Government Auditing
Standards. For the purpose of this report, we assessed and classified the significant internal
control structure into the following categories:

   •   Documentation of Completed Corrective Actions
   •   Effectiveness of Followup Systems
   •   Timeliness of Resolution and Followup

Because of inherent limitations in any internal control structure, errors or irregularities may
occur and not be detected. Also, projection of any evaluation of the system to future periods is
subject to the risk that procedures may become inadequate because of changes in conditions, or
that the degree of compliance with the procedures may deteriorate.

Our assessment disclosed internal control weaknesses that adversely affected the Department’s
ability to ensure corrective actions were taken by external entities in response to OIG external
audits. These weaknesses and their effects are fully discussed in the AUDIT RESULTS section
of this report. These weaknesses resulted in more than a relatively low risk that errors,
irregularities and other inefficiencies may occur resulting in inefficient and/or ineffective
performance.




ED-OIG/A19-D0007                                                                  Page 21
                                                                                     Attachment 1
                                                                                       Page 1 of 1




      Attachment 1: PO Reports Issued in Conjunction with This Audit




         Audit Control                                                           Final Report
Number     Number                                 Title                              Date
                         Audit Followup Process – External Audits – OCFO
         A19-E0003 &     (includes results of audits resolved by Contracts and
  1                                                                                 9/23/04
          A19-E0005      Acquisitions Management within OCFO, and
                         discretionary grants resolved by PAG)
  2       A19-E0002      Audit Followup Process – External Audits – FSA             9/16/04
                         Audit Followup Process – External Audits –
  3       A19-E0004      OESE/OSDFS                                                 8/27/04
                         Audit Followup Process – External Audits – OSERS
  4       A19-E0006                                                                  6/2/04
                         Audit Followup Process – External Audits – IES
  5       A19-E0007      (Close-out letter – one audit reviewed, no issues           4/1/04
                         noted.)
                         Audit Followup Process – External Audits – OELA
                         (Close-out letter issued since PAG is responsible for
  6       A19-E0010                                                                 3/16/04
                         resolution of discretionary grant audits. Results
                         included in A19-E0003/A19-E0005 above.)
                         Audit Followup Process – External Audits – OPE
                         (Close-out letter issued since PAG is responsible for
  7       A19-E0011                                                                 3/16/04
                         resolution of discretionary grant audits. Results
                         included in A19-E0003/A19-E0005 above.)
                                                                                             Attachment 2
                                                                                               Page 1 of 4




                  Attachment 2: Audit Reports Reviewed in This Audit


                                                                                             Number of
       Audit Control                                                    Report Issue         Recommen-
Number   Number                        Report Title                        Date        PO      dations
                       Audit of the Direct Loan Program
  1      A02-70001     Administered by Dowling College                     10/6/97     FSA       10
                       Academy Pacific Business and Travel
  2      A09-80023     College Eligibility to Participate in Title IV     12/21/98     FSA        2
                       Programs
                       Antonelli College’s Administration of
  3      A05-80008                                                         2/19/99     FSA        5
                       Student Financial Assistance Programs
                       East-West University’s Administration of
  4      A05-90009     the Student Financial Assistance Programs           5/18/99     FSA        9

                       Pacific Travel Trade School Eligibility to
  5      A09-80029     Participate in Title IV Programs                    6/11/99     FSA        2
                       City Colleges of Chicago’s Administration
  6      A05-80016                                                         7/23/99     FSA       8
                       of the Federal Pell Grant Program
                       Audit of Texas Careers’ Compliance With
  7      A06-80011     the 85 Percent Rule                                  8/6/99     FSA       2

                       Audit of Collegiate Systems, Inc.,
  8      A06-80012                                                          8/9/99     FSA       1
                       Compliance With the 85 Percent Rule
                       The Illinois Student Assistance
                       Commission’s Administration of the
  9      A05-90002                                                        12/29/99     FSA       3
                       Federal Family Education Loan Program
                       Federal and Operating Funds
                       Audit of Capital City Trade and Technical
  10     A06-80008     School, Inc., Compliance with the 85                2/15/00     FSA       2
                       Percent Rule
                       Platt College - San Francisco
  11     A09-90011                                                         2/28/00     FSA      10
                       Administration of Title IV Programs
                       Hallmark Institute of Aeronautics’
  12     A06-80013                                                          3/6/00     FSA       2
                       Compliance with the 85 Percent Rule
                       St Augustine College’s Administration of
  13     A05-90053     the Federal Student Financial Assistance             3/8/00     FSA       2
                       Programs for the 1998-99 Award Year
                       University of Phoenix’s Management of
  14     A09-70022                                                         3/31/00     FSA       9
                       Student Financial Assistance Programs
                       Review of Student Financial Aid
  15     A06-90004                                                          8/7/00     FSA       3
                       Compliance at Success Institute of Business
                       Review of Student Financial Aid
  16     A06-90012     Compliance at the International Institute of         8/8/00     FSA       4
                       Chinese Medicine
                                                                                           Attachment 2
                                                                                             Page 2 of 4

                                                                                           Number of
       Audit Control                                                 Report Issue          Recommen-
Number   Number                       Report Title                      Date         PO      dations
                       Mount Senario College’s Administration of
  17     A05-90052     the Title IV HEA Programs for the Period         9/14/00     FSA       11
                       July 1, 1998, through June 30, 1999
                       Audit of the Title IV Higher Education Act
  18     A05-90054     Programs Administered by Cleveland State         9/28/00     FSA        9
                       University Cleveland, Ohio
                       Audit of Great Lakes Higher Education
  19    A05-A0002      Corporation’s Federal Family Education           3/30/01     FSA        4
                       Loan Programs
                       The Illinois Student Assistance
                       Commission’s Administration of the
  20    A05-A0028      Federal Family Education Loan Program            3/30/01     FSA       14
                       Federal and Operating Funds
                       Audit of the Michigan Guaranty Agency’s
                       Administration of the Federal Family
  21    A05-B0007      Education Loan Program Federal and               9/25/01     FSA        4
                       Operating Funds

                       University of Arkansas at Little Rock’s
                       Compliance with the Title IV Student
  22    A06-B0013                                                       9/28/01     FSA        1
                       Financial Assistance Verification
                       Requirements
                       Southwest Texas State University
                       Compliance with the Title IV Student
  23    A06-B0009                                                       9/28/01     FSA        3
                       Financial Assistance Verification
                       Requirements
                       Audit of Drake College of Business’
  24    A02-B0006      Compliance with the Title IV Higher               3/5/02     FSA        6
                       Education Act Program Requirements
                       Audit of Glendale Career College's
  25    A09-B0017      Administration of the Higher Education Act       3/18/02     FSA        3
                       Title IV Programs
                       South Texas Vocational Technical Institute
  26   A06-B0026       – Brownsville’s Administration of the Title      3/20/02     FSA        3
                       IV Student Financial Assistance Programs
                       Livingstone College’s Compliance with the
  27   A06-B0011       Title IV Student Financial Assistance            3/29/02     FSA        4
                       Verification Requirements

                       Title VII Systemwide Improvement Grant
  28   A05-A0004       Administered by Community Unit School            12/6/00     OELA       2
                       District 300, Carpentersville, Illinois
                                                                                             Attachment 2
                                                                                               Page 3 of 4

                                                                                             Number of
       Audit Control                                                  Report Issue           Recommen-
Number   Number                       Report Title                       Date         PO       dations
                       Recipient Financial Management System
  29   A02-80002       Contract, Computer Data Systems,                  9/22/00     OCFO        2
                       Incorporated, Rockville, Maryland
                       Audit of Title IV Wide Area Network,
  30   A07-80018       Contract, National Computer Systems, Iowa          5/6/99     OCFO        6
                       City, IA

                       Audit of the Central Processing System
  31   A07-90003                                                         3/15/00     OCFO        5
                       Contract

                       WestEd’s Administration of the Regional
  32   A09-60009                                                         3/31/98     OERI        9
                       Education Laboratory Contracts


  33   A02-A0001       Audit of New York City Oversight of Title I       3/28/01     OESE        2

                       The Chicago Public Schools’ Administration
  34   A05-B0005       of Title I, Part A, Funds for Providing           3/29/02     OESE        8
                       Services to Private School Children
                       New Mexico State and Local Education
                                                                                     OESE/
  35   A06-A0006       Agencies' Compliance with the Gun-Free            9/28/00                 6
                                                                                     OSDFS
                       Schools Act of 1994
                       Colorado State and Local Educational
                                                                                     OESE/
  36   A03-A0008       Agencies’ Compliance with the Gun-Free            9/13/00                 2
                                                                                     OSDFS
                       Schools Act of 1994

                       Audit of Lincoln University’s Administration
  37   A03-A0019                                                         7/27/01     OPE         7
                       of the Title III Grant

                       Higher Education Act Title III, Part A,
  38   A04-A0009                                                         9/29/00     OPE         2
                       Higher Education Grant at Mars Hill College

                       Central State University Student Support
  39   A05-80005                                                         3/16/98     OPE         2
                       Services Program

                       Audit of the Student Support Services
  40   A05-90045       Project Administered by Marian College,           3/27/00     OPE        10
                       Fond Du Lac, Wisconsin
                       Audit of the Student Support Services
  41   A05-A0003       Project Administered by Mount Senario             9/28/00     OPE         9
                       College, Ladysmith, Wisconsin
                                                                                             Attachment 2
                                                                                               Page 4 of 4

                                                                                             Number of
       Audit Control                                                  Report Issue           Recommen-
Number   Number                       Report Title                       Date         PO       dations
                       Audit of Selected Aspects of the Talent
  42   A05-A0022       Search Grant Administered by South                1/22/01     OPE         4
                       Suburban College, South Holland, Illinois

                       Audit of Creighton University’s
  43   A07-80027                                                         3/31/00     OPE         4
                       Administration of its Federal TRIO Projects

                       Audit of Independence Community
  44   A07-A0006       College’s Administration of its Federal TRIO     10/15/01     OPE         8
                       Projects
                       Arizona Department of Education
  45   A09-A0001       Management Controls Over IDEA, Part B-            9/22/00     OSERS       7
                       Special Education Performance Data
                       California Department of Education
  46   A09-A0016       Management Controls Over IDEA, Part B-            3/30/01     OSERS       8
                       Special Education Performance Data



       Total                                                                                    239
                                                                                                    Attachment 3
                         UNITED STATES DEPARTMENT OF EDUCATION
                                     OFFICE OF THE CHIEF FINANCIAL OFFICER

                                                                                         THE CHIEF FINANCIAL OFFICER

                                            MAR - 4 2005
Memorandum

To:                 Michelle Weaver-Dugan, Director
                    Operations Internal Audit Team
                    Office of Inspector General

From:               ja£k Martinf/-Irttlit:
Subject:            OCFO Response to Draft Audit Report: Audit of the Department of
                    Education's Follow-up Process for External Audits
                    ACN: ED-OIG/A19-D0007

We appreciate the opportunity to respond to the referenced draft audit report. Audit
follow-up is an integral part of good management and is a shared responsibility of agency
management officials, program staff and auditors. The Office of the Chief Financial
Officer (OCFO) has long recognized this fact, and as a result, has put in place policies,
procedures and systems for tracking, resolving and closing audit findings, in compliance
with Office of Management and Budget (OMB) Circular A-50.

While we agree with the thrust of the overall findings and most ofthe report's
recommendations to improve the audit follow-up system, we believe the report could be
more balanced to reflect improvements in the process. In this regard, the Department has
made great strides over the last few years to enhance the efficiency and effectiveness of
the Department's audit follow-up process. Significant efforts have been taken to: (1)
improve policies and procedures for audit follow-up, (2) continually enhance the Audit
Accountability and Resolution Tracking System (AARTS) to effectively track the
Department's follow-up and resolution activities, (3) provide appropriate training to
departmental staff on AARTS, the single audit process, and the Federal Audit
Clearinghouse, (4) promote communications and consistency across the Department
regarding audit follow-up, and (5) issue improved guidance on maintaining supporting
documentation for corrective actions taken and on the role of OCFO and the Principal
Offices (POs) in following up on discretionary grant audits. These actions and other
enhancements we have taken to improve the process provide a reasonable assurance that
OIG external audits are receiving appropriate attention and timely follow-up actions.
This assurance is also supported by the report's findings showing a low percentage (11 %)
of audit recommendations with incomplete corrective actions and finding significance.
But, as with any process, there is always room for improvement, and we are constantly
looking for additional ways to build upon the progress we have achieved to-date.

As discussed during the exit conference on this audit, we have concerns with a couple of
the report's recommendations. Specifically, we have concerns with the recommendation
that the Department develop and implement a process, similar to that established for



                             400 MARYLAND AVE" S.W.        WASHINGTON, D.C. 20202-4300 


   Our   mission is to ensure equal access to education and to promote educational excellence throughout the Nation. 

                                                                                       p.2

internal OIG audits, requiring Action Official (AO) certification and the OCFO's Post
Audit Group's (PAG) review of the adequacy of audit follow-up documentation prior to
closing external OIG audits. This recommendation is impractical in terms ofthe
resources it will demand to document corrective actions taken by entities prior to closing
external OIG audits. As the OIG does in its audit plans and in its choice of activities to
audit and investigate, priority and follow-up attention given to corrective actions should
be weighted and "triaged" appropriately. Based on such factors as risk and the
significance of the underlying violation being corrected, resolution officials should have
discretion to decide which corrective actions to track by on-site monitoring, which to
monitor by other means, which to review in writing, and which to leave to single auditors
to review in subsequent years. Some of the audit findings and corrective actions chosen
by the OIG to review were relatively minor, and some follow-up actions suggested by the
OIG would use more resources than the value of the corrective action to be taken.
Additionally, the recommendation requiring the Department to identify all external OIG
audits that have been closed since September 30, 2003, and review the status of each
corrective action would be extremely resource intensive and detract from current
resolution efforts.

We appreciate the thoughtful review the OIG performed and the professional approach
followed by the auditors throughout the engagement. Given our above concerns and
more detailed comments below, we believe the OIG should carefully reconsider the
viability of the two above-mentioned recommendations. We also believe that prior to
issuing a final report that a meeting be held among the OIG, affected program offices,
OGC and OCFO to discuss these issues and the impact of recommendations in more
detail.

The following are our specific comments in response to the report's findings and
recommendations.

Finding #1 	   PAG Did Not Ensure the Department's Audit Follow-up System for
               External OIG Audits was Effective

1.1 	 Develop and implement a process to periodically evaluate the appropriateness
      of the PO follow-up systems for external OIG audits.

     OCFO Response

    Current practice in the Department is to give the POs discretion in the type of follow­
    up that is appropriate for individual programs. OCFO provides written formal
    guidance through the Post Audit User Guide and periodically provides updates to the
    policy and procedures on an interim basis until such time that the guide is formally
    updated. Since the guide was issued in 2003, we have issued guidance on
    maintaining supporting documentation for corrective actions taken and on the role of
    OCFO and the POs in following up on discretionary grant audits. Based upon the
    low percentage (11 %) of audit recommendations with incomplete corrective actions,
    we believe that audit follow-up in OCFO and the POs is being performed well. We
                                                                                      p.3


   will, however, look for ways to strengthen the process through continued staff
   training and sample testing of PO follow-up.

1.2 Develop and implement procedures to periodically report on the adequacy of
    Action Official (AO) systems for follow-up on external corrective actions, and
    the overall effectiveness of the Department's external audit follow-up system,
    based on the reviews of audit follow-up documentation and any other related
    factors currently tracked by the Department.

    OCFO Response

    As is stated in 1.1 above, we will look for ways to strengthen the process based on
    sample testing of PO follow-up.

1.3 Provide training to PO audit resolution staff on the requirements for audit
    follow-up and on the documentation that should be maintained to provide
    assurance that corrective actions are taken.

    OCFO Response

    We concur with this recommendation and will train audit resolution staff on the
    requirement for follow-up and documentation maintenance. We are currently
    working with OM to establish an Audit Resolution Curriculum, and will ensure that
    training on follow-up activities is included. In March 2005, we began the process of
    updating the Post Audit User Guide, and once the guide is updated, staff training on
    updates and revisions will take place.

1.4 Develop and implement guidance that defines the responsibilities ofPAG and
    the respective program offices in completing follow-up activity for external OIG
    discretionary grant audits resolved by PAG.

    OCFO Response

    This recommendation is a duplicate of a recommendation in the OIG Audit Report
    on the Audit Follow-up Process for OCFO (ACN: ED-OIG/A19-E0003). On
    November 10, 2004, PAG issued a notice via e-mail to all appropriate parties titled
    "Clarification of Audit Resolution Policy for Audits Resolved in PAG and CAM."
    The OIG concurred with this action on November 29,2004. Therefore, this
    recommendation has been implemented.
                                                                                     p.4


Finding #2 	   The Department Closed External OIG Audits Prior to Completion of
               Corrective Actions.

2.1 	 Develop and implement a process, similar to that established for Internal OIG
      audits, requiring AO certification and PAG review of the adequacy of audit
      follow-up documentation prior to closing external OIG audits.

    OCFO Response

    As discussed during the exit conference; program offices, OGC and OCFO have
    very serious concerns with this recommendation and respectfully request that the
    OIG reconsider its position. Certification does work well for internal audits.
    However, the AO is certifying the completion of corrective actions taken within the
    PO. The logistical and resource ramifications involved with having an AO certify
    the actions of an entity external to the Department of Education and subsequently
    with having PAG review the adequacy of follow-up documentation, is impractical in
    terms of cost, travel and staff hours it will demand. The PO should have discretion
    in how follow-up is accomplished based upon resources available. Implementing
    this recommendation would require a dedication of departmental staff and budgetary
    resources that far exceeds any marginal benefits to be realized. We believe that
    corrective actions taken on Recommendations 1.1, 1.2 and 1.3 above will adequately
    address weaknesses in the audit follow-up process. We request that the OIG meet
    with the program offices, OGC and OCFO to further discuss the concerns expressed
    in implementing this recommendation.

2.2 	 Ensure the status of external OIG audits currently under appeal, awaiting
      reevaluation, or in collection, is reflected as resolved, but not closed, in AARTS,
      to accurately reflect the status of the audit. Establish additional categories in
      AARTS as appropriate to allow for tracking these audits.

    OCFO Response

    This recommendation, to establish in AARTS additional categories for tracking the
    status of audits under appeal or in receivables, is one we support. Our contract
    resources for this year have been finalized, but we will discuss these enhancements
    with the AARTS team and include them as future improvements to AARTS.
                                                                                        p.5



2.3 	 Enhance the accuracy of AARTS data by identifying all external OIG audits
      that were closed since September 30, 2003, and coordinate with the program
      offices to identify those audits for which corrective actions have been completed,
      and those for which corrective actions are still in process. For those audits
      where corrective action has been completed, ensure appropriate "closed" date is
      reflected in AARTS. For those audits where corrective actions are still in
      process, correct the data in AARTS to accurately reflect the status of the audits.

    OCFO Response

    As discussed during the exit conference, program offices, OGC and OCFO have
    concerns with this recommendation. The task of determining OIG-issued external
    audits closed during the past year and a half and reviewing the status of each
    corrective action would be extremely labor intensive and would not add value to the
    process. We also do not believe that the findings in the draft audit report warrant this
    degree of scrutiny. The Department's audit workload has increased dramatically
    over the past year; therefore, implementing this recommendation would have an
    adverse impact on efforts to resolve and close external audits that are currently in the
    follow-up process. During the exit conference, we requested that the OIG reconsider
    this recommendation, and we were given assurances that this would occur. We
    request that the OIG meet with the program offices, OGC and OCFO to further
    discuss the concerns expressed in implementing this recommendation.

2.4 Ensure the Department's Semiannual Report to Congress on Audit Follow-up
    accurately reports audits which have been resolved, but for which corrective
    actions have not been completed.

    OCFO Response

    Once Recommendation 2.2 above is implemented, data can be drawn from AARTS
    for use in preparing management's Semiannual Report to Congress on Audit Follow­
    up that will differentiate in the report, OIG audits that are resolved, but for which
    corrective actions have not been completed.

2.5 	 Develop and implement guidance that defines audit closure for external audits.
      The guidance should be consistent with OMB policy and definitions identified in
      other documents such as AARTS User Manuals, and address audits on appeal
      and those for which the only remaining corrective action is collection of funds
      due the Department.

    OCFO Response

    We will issue guidance that defines audit closure for external OIG audits. The
    guidance will be incorporated into the Post Audit User Guide. In March 2005, we
                                                                                      p.6


    began the process of updating the guide. We will ensure that the AARTS User
    Manuals are also revised.

2.6 	 Provide training to PO staff to ensure they are informed of the updated policy
      guidance and that audits should not be considered closed until all corrective
      actions have been completed.

    OCFO Response

    We concur with this recommendation and will train audit resolution staff on the
    updated policy guidance, that audits not be considered closed until all corrective
    actions have been completed. We are currently working with OM to establish an
    Audit Resolution Curriculum, and will ensure that training regarding this matter is
    included in the course.

Thank you for the opportunity to respond to the draft audit report. We look forward to
meeting with you to discuss further Recommendations 2.1 and 2.3. Please contact Randy
Prindle of the Post Audit Group at 202-377-3821 with dates and times convenient to you.
We will continue to work with you and other offices in the Department to improve upon
the audit follow-up process.