oversight

Audit Followup Process for Office of Inspector General Internal Audits in Federal Student Aid.

Published by the Department of Education, Office of Inspector General on 2005-09-08.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                      UNITED STATES DEPARTMENT OF EDUCATION

                                      OFFICE OF INSPECTOR GENERAL




                                             September 8, 2005

                                                                                        CONTROL NUMBER
                                                                                          ED-OIG/A19F0001

Theresa S. Shaw
Chief Operating Officer
Federal Student Aid
U.S. Department of Education
Union Center Plaza
830 First Street, NE
Washington, DC 20202

Dear Ms. Shaw:

This Final Audit Report (Control Number ED-OIG/A19F0001) presents the results of our audit
of the Audit Followup Process for Office of Inspector General Internal Audits in Federal Student
Aid. The objective of our audit was to verify whether adequate documentation was maintained to
support that corrective action items have been implemented as stated in the Department of
Education’s (Department) corrective action plans (CAP). This audit is a part of a review of the
Department’s internal audit followup process being performed in four principal offices (POs). A
summary report will be provided to the Department’s Chief Financial Officer upon completion
of the audits in individual offices.


                                           BACKGROUND
Office of Management and Budget (OMB) Circular A-50, entitled “Audit Followup,”
provides the requirements for establishing systems to assure prompt and proper
resolution and implementation of audit recommendations. The Department
established a Post Audit User Guide (Guide) to provide policy and procedures for the audit
followup process. Section I, “Overview,” of the Guide states,

       The effectiveness of the post audit process depends upon taking appropriate,
       timely action to resolve audit findings and their underlying causes, as well as
       providing an effective system for audit close-out, record maintenance, and follow-
       up on corrective actions.


                           400 MARYLAND AVE., S.W. WASHINGTON, D.C. 20202-1510

           Our mission is to ensure equal access to education and to promote educational excellence
   Ms. Shaw	                                                                         Page 2 of 10



While overall responsibility for the audit followup process is assigned to the Office of the Chief
Financial Officer (OCFO), Post Audit Group (PAG), each Assistant Secretary (or equivalent
office head) is responsible for ensuring that the overall audit followup process operates
efficiently and consistently. The Guide defines further responsibilities of the Action Official
(AO), generally the Assistant Secretary (or equivalent office head), to include:

   • 	 Determining the action to be taken and the financial adjustments to be made in resolving
       findings in audit reports concerning respective program areas of responsibility,
   • 	 Maintaining formal, documented systems of cooperative audit resolution and follow-up
       to ensure that audit recommendations are implemented, completion dates captured, and
       appropriate documentation maintained to support completed corrective actions.

The Department tracks audit resolution and the completion of corrective action items through the
Audit Accountability and Resolution Tracking System (AARTS). For each audit, AARTS stores
detailed information on audit resolution, proposed corrective action items, Office of Inspector
General (OIG) concurrence with these actions, responsible individuals, and completion and
closure data.

When a PO has completed all corrective action items for an internal OIG audit, the PO certifies
this fact to PAG and requests closure of the audit in AARTS. PAG staff perform a review of the
documentation in the audit resolution file maintained by the PO to determine whether
implementation of corrective action items is supported. Once PAG is satisfied that
implementation of the corrective action items reviewed is supported, the audit is closed in
AARTS. PAG staff stated that until sometime in Fiscal Year (FY) 2004, only a sample of
corrective action items was evaluated and that PO staff did not necessarily know that all
corrective action items were not reviewed. PAG staff stated that currently all corrective action
items are evaluated in these reviews.


                                     AUDIT RESULTS
We found improvements are needed in Federal Student Aid’s (FSA) internal control over its
audit followup process. While FSA maintained files with documentation regarding audit
followup activity, we found FSA’s audit followup process did not support the completion of all
corrective action items. In addition, this process did not always support completion of corrective
action items on the date reported in AARTS. Finally, FSA used the PO Comments field in
AARTS to modify agreed upon corrective action items instead of modifying the Action Item
field.

FSA audit resolution staff were aware of the Department’s documentation requirements for audit
resolution files and generally believed that completion of corrective action items was adequately




                                         ED-OIG/A19F0001

    Ms. Shaw                                                                                        Page 3 of 10



documented. However, we found documentation did not support completion of 10 of the 43 1
corrective action items reviewed. As a result, FSA does not have assurance that corrective action
items were implemented. In addition, reporting corrective action items as completed before the
actions have actually been taken compromises the integrity of the data included in AARTS,
understates internal management reports and reports to Congress on corrective action items that
have not yet been completed, and may negatively impact the Department’s credibility. Finally,
when the AARTS PO Comments field is used to modify corrective action items, OIG does not
have the opportunity to concur or nonconcur with the revised action item as being sufficient to
address the issues noted during the audit.

In response to the draft report, FSA concurred with our finding and provided corrective actions
to address each of the recommendations included in our report. However, FSA noted that OIG’s
standards for acceptable documentation were not the same standards used by FSA and PAG.
FSA also cited weaknesses noted several years ago by the Government Accountability Office
(GAO) with regard to OMB Circular A-50 guidance.

OIG believes the supplemental guidance issued by PAG, specifically the Post Audit User Guide
and the Guidelines for Establishing File Folders and Maintaining Documentation for GAO and
ED-OIG Internal Audits and Alternative Products, is straightforward and includes appropriate
examples of supporting documentation. Also, as noted in this report, we will be providing the
results of our analysis of the effectiveness of PAG’s corrective action item review process in the
audit followup summary report issued to the Chief Financial Officer upon completion of the
audits in individual offices.

The full text of the FSA response is included as Attachment 2 to this audit report.


Finding 1         FSA Audit Followup Was Not Always Effective
We found FSA’s audit followup process was not always effective. While FSA certified that
corrective action items were completed, we found they were unable to support completion of 10
of the 43 corrective action items reviewed (23 percent). We were able to validate closure dates
for 25 of the 33 supported corrective actions through FSA provided documentation.2 We found
FSA reported 8 of these 25 action items (32 percent) as completed in the Department’s audit
tracking system prior to dates reflected by supporting documentation.
In addition, we noted FSA used the PO Comments field in AARTS to indicate that agreed upon
corrective action items would not be completed as initially described instead of changing the
Action Item field.

1
  We initially reviewed a total of 45 corrective action items to verify if documentation was maintained in the audit
resolution file to support completion of the action items. We could not assess the completion of 2 of the 45
corrective action items because data subsequently entered into the PO Comments field in the CAP changed the
intent of the agreed upon action items without providing OIG an opportunity to either concur or nonconcur with the
revised action items.
2
  In eight cases, we could not validate closure dates because of limitations in the supporting documentation provided
by FSA.

                                                ED-OIG/A19F0001

    Ms. Shaw	                                                                              Page 4 of 10




Documentation Did Not Support Completion of Corrective Action Items

FSA audit resolution file documentation did not initially support completion of 25 of the 43
corrective action items reviewed (58 percent). In response to an OIG request, FSA provided
additional documentation that was not originally included in the audit resolution files. This
documentation supported completion of 15 of the 25 originally unsupported corrective action
items. Ultimately, FSA could not provide documentation to support completion of 10 of the 43
corrective action items (23 percent). Unsupported action items noted during this audit included
the following:

    • 	 In one audit, 3 the corrective action item stated:

                In accordance with an agreement reached with OIG to close this audit, FSA is
                sending a letter to all foreign schools whose loan volume is less than $500,000 to
                inform them of the audit requirements and request that they submit audits no later
                than 10/31/03. The letter will also include a "Dear Colleague Letter" to explain
                requirements related to enrollment verification and SSCR submissions. FSA's
                audit procedures have been changed to include foreign school audits in the
                DRCC's (Document Receipt and Control Center) normal audit processes...

        To support completion of the corrective action item, FSA staff provided a listing of the
        foreign schools that they believed were sent a letter regarding audit requirements. FSA
        stated the letter was mailed to applicable schools and a copy of the letter was placed in
        each school’s file. Correspondence in the audit file indicated the letters were mailed on
        8/25/03.

        To determine if FSA maintained documentation as indicated, we attempted to review a
        sample of 16 foreign school files. In conducting this review we found FSA had not
        placed any of the letters in school files and instead maintained the documentation all
        together in one pile. Neither OIG nor FSA staff present could locate letters for 7 of the
        16 selected schools in the documentation made available.

    • 	 In another audit, 4 the corrective action item stated FSA would “Provide training and
        support to all project managers (PMs), Contracting Officer Representatives (CORs), all
        stakeholders and accountable contract entities on the new process and performance
        measures that monitor business case expectations/outcomes against achieved results.”

        Audit resolution file documentation showed FSA took some measures to provide training,
        however it did not show that those identified in the action item completed the training. In

3
  Audit Control Number (ACN) A01-90005: “The Recertification Process for Foreign Schools Needs To Be

Improved,” issued September 29, 2000, Corrective Action 1.1.5. 

4
  ACN A07-B0008: “Audit of FSA’s Modernization Partner Agreement,” issued November 20, 2002, Corrective 

Action 1.1.2. 


                                            ED-OIG/A19F0001

    Ms. Shaw                                                                            Page 5 of 10



        response to a request for additional information, FSA provided documentation that
        included training course titles, descriptions, and planned dates in 2004 and 2005 for these
        training courses. FSA also provided an email that included attachments outlining the
        response to the audit report recommendation. However, neither of these items showed
        FSA tracked attendees to ensure all identified positions completed the training.

PAG issued Audit Closure Memos for six of the nine audits included in this audit. These six
audits contained 31 of the 43 corrective action items we reviewed. We noted 2 of these 31 action
items were identified as reviewed by PAG prior to issuance of the Audit Closure Memos. We
determined one of the two action items reviewed by PAG was adequately supported by
documentation provided by FSA. The results of our analysis of the effectiveness of PAG’s
review process will be included in the audit followup summary report issued to the Chief
Financial Officer upon completion of the audits in individual offices.

Documentation Did Not Support Reported Completion Dates

For the 25 corrective action items for which completion dates could be verified, FSA reported 8
corrective action items (32 percent) as completed in AARTS prior to the dates reflected by
supporting documentation. These items were reported as completed from 4 days to 14 months
before dates noted on supporting documentation provided. Five of the eight actions were
reported as completed two or more months before dates noted on supporting documentation.

For example, a corrective action item for one audit was reported as completed on September 30,
2002. FSA provided us with several reports and the results of payment statistical studies that
showed the effort to reduce award error through Pell Grant verification. These items were
sufficient to support the completion of the corrective action item, but were dated through
November 21, 2003. 5

Principal Office Comment Field Used to Modify Proposed Corrective Action Items

In two additional corrective action items, data from the PO Comments field in the CAP indicated
action items would not be completed as initially described. This field was used instead of
modifying the agreed upon action item to accurately reflect the final decision of management.
For example, one corrective action item stated FSA would:

        Implement an integrated project management oversight of FSA system integration
        initiatives to ensure leadership, direction setting, and contract management for
        modernization and integration activities. System integration initiatives will be delivered
        in accordance with established project plans and milestones for each initiative. 6



5
  ACN A06-A0020, “Effectiveness of the Department’s Student Financial Aid Application
Verification Process,” issued March 28, 2002, Corrective Action 1.2.1
6
  A07-B0008, Corrective Action 1.1.5.

                                             ED-OIG/A19F0001

   Ms. Shaw                                                                        Page 6 of 10



However, the PO Comments field stated in part:

       FSA has established a project management oversight process and has implemented
       stronger reporting and control mechanisms for monitoring contracts. These are interim
       processes which will be finalized when FSA reorganization is completed.

An AARTS database administrator stated when information is entered or changed in the PO
comment field there is no change to the resolution status and the OIG would not necessarily
become aware of the change. He added when the Action Item text is changed within the system,
the status reverts to "unresolved," OIG is notified of the change, and has the opportunity to
concur or nonconcur with the revised action.

Requirements for Audit Followup

OMB Circular A-50, entitled “Audit Followup,” provides the requirements for establishing
systems to assure prompt and proper resolution and implementation of audit recommendations.
The Circular states:

       Audit followup is an integral part of good management, and is a shared
       responsibility of agency management officials and auditors. Corrective action
       taken by management on resolved findings and recommendations is essential to
       improving the effectiveness and efficiency of Government operations. Each
       agency shall establish systems to assure the prompt and proper resolution and
       implementation of audit recommendations. These systems shall provide for a
       complete record of action taken on both monetary and non-monetary findings and
       recommendations.

The Department’s Post Audit User Guide, Section IV, “Internal Audits,” Chapter 1, “ED Office
of Inspector General (ED-OIG) Audit Reports and Alternative Products,” Part G, “Corrective
Actions,” states:

       Each AO must maintain documentation to support implementation of each
       corrective action in accordance with the Guidelines for Establishing File Folders
       and Maintaining Documentation. The documentation must be specifically
       identifiable to a corrective action to withstand any post audit closure review by
       PAG/OCFO, ED-OIG, [Government Accountability Office] GAO and/or OMB.
       All ED-OIG audit records must be retained by an AO for at least five years after
       ED-OIG is notified that all corrective actions have been completed.

The Department’s Guidelines for Establishing File Folders and Maintaining Documentation
states:

       A file folder should be established for each audit report beginning with the draft
       report. Each folder should contain . . .Documentation to support implementation
       of corrective actions or specific notes that indicate where said documents are

                                        ED-OIG/A19F0001

   Ms. Shaw	                                                                       Page 7 of 10



       located . . .Explanation of how such documentation supports the corrective action,
       if not readily understood or evident.

The Guidelines for Establishing File Folders and Maintaining Documentation also provides
examples of supporting documentation to include memos of understanding, final regulations,
Dear Colleague Letters, records from databases, and policies and procedures.

FSA audit resolution staff generally believed that available documentation was adequate to
support completion of action items. In a meeting subsequent to the exit conference, FSA
management indicated some of the action items questioned by OIG are still in the process of
being completed and that FSA would need to change the reported completion dates in AARTS.
FSA also provided documentation to show completion dates had recently been changed in
AARTS for the corrective action items OIG noted were reported as completed prior to the dates
reflected by supporting documentation.

Without appropriate documentation, FSA does not have assurance that identified deficiencies
were corrected. As such, the risk remains that related programs may not be effectively managed.

By reporting corrective action items as completed when they have not been, or in advance of the
actual completion date, FSA compromises the integrity of the data included in AARTS and may
negatively impact the Department’s credibility. Management reports on corrective action items
due for completion may be understated. In addition, the Department’s Semiannual Report to
Congress on Audit Followup may also underreport the audits for which corrective action items
have not been completed.

By documenting changes to agreed upon actions in the AARTS PO Comments field, OIG did not
have the opportunity to review and either concur or nonconcur with the revised actions as
sufficient to address the issues noted during the audit.

Recommendations:

We recommend that the Chief Operating Officer for Federal Student Aid:

   1.1 	   Establish and implement procedures to ensure that implementation of corrective
           action items is fully supported by adequate documentation, in accordance with the
           Department’s audit-related documentation and file requirements.

   1.2 	   Ensure that completion dates reported in AARTS are consistent with dates reflected
           in supporting documentation.

   1.3 	   Ensure AARTS is updated to reflect the actual completion dates for the action items
           noted in the audit with discrepancies in the reported completion dates.

   1.4 	   Ensure that changes to agreed upon action items are identified by editing the Action
           Item field in AARTS rather than using the PO Comments field.

                                        ED-OIG/A19F0001

   Ms. Shaw                                                                         Page 8 of 10



FSA Response:

In its response to the draft report, FSA concurred with the finding and provided corrective
actions to address each of the recommendations included in our report. FSA stated they have
already implemented procedures that require FSA audit liaison staff to complete a documentation
checklist before submitting any corrective actions for closure in AARTS. Furthermore, FSA said
they will conduct periodic reviews of audit files to ensure that staff is following procedures for
each audit.

FSA noted that OIG’s standards for acceptable documentation were not the same
standards used by FSA and PAG. FSA also cited weaknesses noted in a 1992 GAO
report with regard to OMB Circular A-50 guidance. The GAO report noted the guidance
does not indicate when an audit recommendation should be closed and what kind of
documentation is sufficient to support the closure of an audit recommendation. FSA also
cited the GAO report as noting a lack of guidance pertaining to alternative actions that
are taken that essentially meet the auditors’ intent or when circumstances have changed
and the recommendations are no longer valid. FSA stated this was the case in two of the
corrective action plans sampled in our audit.

OIG Comments:

While weaknesses may exist in OMB Circular A-50 guidance, OIG believes the supplemental
guidance issued by PAG, specifically the Post Audit User Guide and the Guidelines for
Establishing File Folders and Maintaining Documentation for GAO and ED-OIG Internal
Audits and Alternative Products, is straightforward and includes appropriate examples of
supporting documentation. It would be impossible for PAG to issue guidance on what type of
documentation would be sufficient for every corrective action the Department takes. Also, as
previously noted, we will be providing the results of our analysis of the effectiveness of PAG’s
corrective action item review process in the audit followup summary report issued to the Chief
Financial Officer upon completion of the audits in individual offices.

In addition, while we understand circumstances can change after OIG accepts a CAP, we believe
it is imperative that OIG have the opportunity to independently review any revised corrective
actions to ensure they address the deficiencies noted during the audit, or agree that a
recommendation is no longer valid to warrant any corrective action.


                  OBJECTIVE, SCOPE, AND METHODOLOGY
The objective of our audit was to verify whether adequate documentation was maintained to
support that corrective action items have been implemented as stated in the Department’s CAPs.

To accomplish our objective, we performed a review of internal control applicable to FSA’s
audit followup process. We reviewed applicable laws and regulations, and Department policies


                                        ED-OIG/A19F0001

   Ms. Shaw                                                                         Page 9 of 10



and procedures. We conducted interviews with OCFO/PAG staff regarding Department policy
and procedures, and AARTS operation. We conducted interviews with FSA staff responsible for
resolving and following up on corrective action items for the audits selected. We also reviewed
documentation provided by FSA staff to support completion of corrective action items for the
recommendations included in our review.

The scope of our audit was limited to corrective action items developed in response to internal
OIG audits of FSA processes and programs. Our scope included only those corrective action
items reported as “completed” in AARTS during the period July 1, 2002, through July 30, 2004.
We excluded from our review corrective action items for recurring audits, such as annual
financial statement audits, information security audits, or those with prior or planned followup
audits so as not to duplicate audit effort. This resulted in a universe consisting of 9 FSA related
audits with 45 corrective action items. We could not review 2 of the 45 items due to the use of
the PO Comments field to change the intent of the corrective action. Therefore, only 43 action
items were reviewed for adequacy of supporting documentation. The audits and corrective action
items reviewed are listed in Attachment 1 to this report.

We relied on computer-processed data initially obtained from AARTS to identify action items
applicable to the scope period. An alternative data source is not available to directly test the
completeness of the corrective action items as reported in AARTS. However, we tested the
accuracy of AARTS data by comparing AARTS data to supporting documentation. We also
conducted a limited review of AARTS data controls and relied on feedback from resolution staff
to gain additional assurance relating to the completeness and accuracy of AARTS data. Based on
these tests and assessments, we determined that the computer-processed data was sufficiently
reliable for the purpose of our audit.

Our review was based on the corrective action items defined by FSA in its CAPs and agreed
upon by OIG in the audit resolution process. We reviewed and analyzed documentation in FSA’s
audit resolution files to determine whether completion of each selected corrective action item was
supported. In cases where documentation in the file did not support completion of the action
item, we provided FSA with an opportunity to provide additional documentation from other
sources. We reviewed any additional documentation subsequently provided to make a final
determination as to whether completion of the corrective actions was then supported. In addition,
we verified the reported completion dates in AARTS against the supporting documentation
provided, where possible, for those corrective action items that were supported.

We conducted fieldwork at FSA offices in Washington, DC, during the period September 2004
through May 2005. We held an exit conference with FSA staff on May 17, 2005. Our audit was
performed in accordance with generally accepted government auditing standards appropriate to
the scope of the review described above.




                                        ED-OIG/A19F0001

    Ms. Shaw	                                                                      Page 10 of 10



                            ADMINISTRATIVE MATTERS 

Corrective actions proposed (resolution phase) and implemented (closure phase) by your office
will be monitored and tracked through the Department’s Audit Accountability and Resolution
Tracking System. Department policy requires you develop a final CAP for our review in the
automated system within 30 days of the issuance of this report. The CAP should set forth the
specific action items, and targeted completion dates, necessary to implement final corrective
actions on the finding and recommendations contained in this final audit report.

In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector
General is required to report to Congress twice a year on the audits that remain unresolved after
six months from the date of issuance.

Statements that managerial practices need improvements, as well as other conclusions and
recommendations in this report, represent the opinions of the Office of Inspector General.
Determinations of corrective action to be taken will be made by the appropriate Department of
Education officials.

In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office
of Inspector General are available to members of the press and general public to the extent
information contained therein is not subject to exemptions in the Act.

We appreciate the cooperation provided to us during this review. Should you have any questions
concerning this report, please call Michele Weaver-Dugan at (202) 245-6941. Please refer to the
control number in all correspondence related to the report.

                                      Sincerely,       



                                      Helen Lew /s/         

                                      Assistant Inspector General for Audit Services         





cc: 	   Marge White, Audit Liaison Officer, FSA
        Charles Miller, Supervisor, PAG/OCFO




                                        ED-OIG/A19F0001

            ATTACHMENT 1 – Audits and Corrective Action Items Reviewed


Number    Audit            Title               Issue   Corrective Unsupported Unsupported
         Control                               Date   Action Items Action Items Completion
         Number                                        Reviewed                   Dates
  1       A05-     Audit of Educational       3/20/03 1.1.1, 1.2.1     None       1.2.1
          D0001    Credit Management
                   Corporation’s
                   Administration of the
                   Federal Family
                   Education Loan
                   Program Federal and
                   Operating Funds for the
                   period April 1, 2000
                   through March 31,
                   2001.


  2      A06-      Audit of the               3/28/02    1.2.1, 1.3.1,      None        1.2.1, 1.3.1,
         A0020     Effectiveness of the                  1.3.2, 1.3.3,                     1.3.2
                   Department’s Student
                   Financial Aid
                   Application Verification
                   Process
  3      A19-      Audit of the Department    10/31/02   1.1.1, 1.1.2,   1.2.1, 1.3.1      None
         C0006     of Education’s Controls               1.2.1, 1.2.2,
                   Over the Access,                      1.3.1, 1.4.1,
                   Disclosure, and Use of                    1.4.2
                   Social Security
                   Numbers by Third
                   Parties.
  4      A19-      Audit of the Department    12/23/03   1.1.1, 1.1.2,      None           None
         D0002     of Education’s                        1.1.3, 1.2.1,
                   Monitoring of Private                 1.2.2, 1.3.1,
                   Collection Agency                     1.4.1, 1.5.1
                   Contractors
  5       A01-     Audit of the               9/29/00       1.1.5           1.1.5          None
          90005    Recertification Process
                   for Foreign Schools
Number    Audit            Title             Issue   Corrective Unsupported Unsupported
         Control                             Date   Action Items Action Items Completion
         Number                                      Reviewed                   Dates
  6       A05-     Audit of Oversight       7/31/03 1.2.1, 2.1.1     2.1.1      None
          D0010    Issues Related to
                   Guaranty Agencies’
                   Administration of the
                   Federal Family
                   Education Loan
                   Program Federal and
                   Operating Funds.
  7      A07-      Audit of FSA’s           11/20/02   1.1.1, 1.1.2,   1.1.2, 3.3.1       2.1.1
         B0008     Modernization Partner               1.1.3, 1.1.4,
                   Agreement                           1.5.5, 2.1.1,
                                                       2.1.2, 3.1.1,
                                                           3.3.1
  8      A19-      Audit of Controls over   3/15/02    1.1.1, 1.1.2,   1.1.3, 1.1.4,      1.1.2
         B0001     Government Property                 1.1.3, 1.1.4,   1.3.2, 1.3.3
                   Provided under Federal              1.2.1, 1.2.2,
                   Student Aid Contracts               1.3.1, 1.3.2,
                                                           1.3.3
  9      A03-      Audit of Procedures at 8/22/02      1.1.1, 1.2.1,      None         1.1.1, 1.2.1
         B0001     Federal Student Aid for                 2.1.1
                   Monitoring the Ability-
                   to-Benefit Test
                   Publishers Approved by
                   the U.S. Department of
                   Education
TOTAL                                                       45              10              8
                                              FEDERAL                              Attachment 2
                                              STUDENT AID




                                  CH IEF OPERATING OFFICER


TO:             Helen Lew
                Ass istant Inspector General for Audit Services
                Office of Inspecto r General

FROM:           Theresa S. Shaw
                Chi ef Operating Officer

SUBJECT:        Draft Audit Repo rt ­ "Audit Follow-Up Process for Offlce of Inspecto r
                General Internal Audits in Federal Student Aid"
                Control No. ED-OIG/A 19-FOOO I

Thank you fo r providing us with an opportunity to respond to the Office of Inspector
General's (OIG) draft audit report, "Audit rollow-Up Process for Office of In spector
General Intellla l Audits in Federal Studen t A id ," Con trol Number ED-O IG/AI9-F0001,
dated Jul y 13,2005.

We agree that internal audit fo ll ow- up procedures should be impro ved to ensure that
completed correcti ve actions arc adequate ly documented before we report them
compl eted in the Departm ent 's aud it tracki ng system .

During the co urse of thi s audit it became clear that OIG's standards fo r acceptab le
documentation were not the same standards used by FSA and the Office of the Chief
Financial Officer's Po st Audit Group (PAG) , th e o ffi ce with overall responsibility for the
audit follow-up process. As the report no tes, yo ur auditors found insuffi cient
doc umentation of compl e ti on for five audits that P AG closed.

In 1992 th e Government Acco untability Office (GAO) recomm ended that the Office of
Management and Budget (OM B) revise C irc ular A-50, "Audit Followup," because it
do es not indicate when an audit recomme ndation should be closed and does not state
what kind of documentati on is sufficient to support th e closurc of an audit
recommendation. ("Audit Resolution: Strengthened Guidance Needed To Ensure
Effective Action" GAO/AFMD-92- 16). Despite GAO's recomm endation, OMB 's
C irc ular A-50 has not been updated si nce 1982, but it rema ins o ur autho ritati ve guid ance
for audit follow-up.

That GAO report also pointed o ut a weakness in OMB's guidance to agencies when
alternative actions have bcen taken th at essc ntiall y meet the auditors' intent or when
circumsta nces have changed and the reco illm end at io ns are no lo nger val id. This was the
case in two o f the cOITective acti on plans yo u samp led in w hich FSA reported the
impl ementati o n o f alternati ve cOITecti ve act io ns for recommendation s.

                           830 hrst Street, NE, Wa shingt.on,   o.c.   20202
                                         1-800-4-FEo.-A I0.
                                      www.5wtietJttlid .ed.gou
FSA takes its responsibility for audit follow-up quite seriously and continually seeks to
improve the effectiveness of the audit follow-up process. Since OMS's Circular A-50
guidance does not currently address these matters, we would welcome the opportunity to
work with your office and the Office of the Chief Financial Officer to close this long­
standing guidance gap at the agency level. This would help us to ensure that future
completed corrective actions are fully supported, properly reported, and sustainable in
any review conducted by your office.

In the meantime, we are pleased to report that FSA has taken immediate action to address
each of the audit's recommendations. Our response to the finding and each oCthe
recommendations is included in the attachment.

Thank you again for the opportunity to review and comment on this report.

Attachment

cc: 	   Michele Weaver-Dllgan , Director, OIG Operations Internal Audit Team
        Patrick 1. Howard, Director, OIG Student Financial Assistance Advisory &
        Assistance Team
        Charles Miller, Director, OCFO Post Audit Group




                                            2

AllaclU11ent
Audit Follow-Up Process for Oflice of Inspector General Intemal Audits in Federal
Student Aid
(A I9-FOOOI)


Finding No.1 - FSA Audit Follow-Up Was Not Always Effective

We concur that FSA 's audit foll ow- up did not always meet the OrG's standards. We
sincere ly hope OIG will work with the Department's audit follow-up officials to establish
appropriate standards for docum entation requirements that all Departm ent of Education
offices can use to ensure effective and proper audit follow-up.

Recommendation 1.1

Establish and implem ent procedures to ensure that implementation of cOITecti ve action
items is fully supported by adequate documentat ion, in accordance with the Department's
audit-related documentation and fil e requirements.

FSA's Response:

COITecti ve action was completed on May 19,2005. We implemented proced ures that
require FSA's audit liaiso n sta ff to compl ete a documentation checklist before submitting
any corrective actions for closure in the Audit Accountability and Reso lution Tracking
System (AARTS). Furthermore, peri odi c reviews will be conducted of audit fil es to
ensure that staff is followin g proced ures for each audit.

Recommendation 1.2

Ensure that completion dates repol1ed in AARTS are consistent with dates reflected in
supporting documentation.

FSA's Response:

Con ective action was compl eted o n May 19,2005. We impl emen ted procedures th at
require FSA's audit liai son sta ff to compl ete a documentation checklist before submitting
any conective actions [or c losure in AARTS. The documentation checklist spec ifi ca ll y
states that staff cannot enter a complction date in AARTS that do es not match the date on
the documentation. As stated previously, periodic rev iews will be co nducted o f audit
files to ensure that staffi s following procedures.
Attachment
Audit Follow-Up Process for Office ofTnspector General Intemal Audits in Federal
Student Aid
(AI9-F0001)

Recommendation 1.3

Ensure AARTS is updated to reOect the action completion dates for the action items
noted in the audit with discrepancies in the reported completion dates.

FSA's Response:

We completed this corrective action on May 26,2005, when we cotTected the completion
dates in AARTS. We also provided your office with the documentation to support the
completion of this action.

Recommendation 1.4

Ensure that changes to agreed upon action items are identified by editing the Action Item
field in AARTS rather than using the PO Comments field.

FSA's Response:

We concur with this recommendation; however, we believe the specific audit cited in
your report was not reOective of changes to the original action item. The PO Comment
field is a way for program offices to record more detailed infotmation on what was done
to accomplish the corrective action.

We included a section in our May 2005 procedures to address this recommendation; and
on July 21,2005, we reminded FSA audit liaison staff that they are to submit changes to
agreed-upon corrective actions to OIG for concurrence by editing the Action Item field in
AMTS rather than using the PO Comments field.




                                            2