UNITED STATES DEPARTMENT OF EDUCATION OFFICE OF INSPECTOR GENERAL September 8, 2005 CONTROL NUMBER ED-OIG/A19F0001 Theresa S. Shaw Chief Operating Officer Federal Student Aid U.S. Department of Education Union Center Plaza 830 First Street, NE Washington, DC 20202 Dear Ms. Shaw: This Final Audit Report (Control Number ED-OIG/A19F0001) presents the results of our audit of the Audit Followup Process for Office of Inspector General Internal Audits in Federal Student Aid. The objective of our audit was to verify whether adequate documentation was maintained to support that corrective action items have been implemented as stated in the Department of Education’s (Department) corrective action plans (CAP). This audit is a part of a review of the Department’s internal audit followup process being performed in four principal offices (POs). A summary report will be provided to the Department’s Chief Financial Officer upon completion of the audits in individual offices. BACKGROUND Office of Management and Budget (OMB) Circular A-50, entitled “Audit Followup,” provides the requirements for establishing systems to assure prompt and proper resolution and implementation of audit recommendations. The Department established a Post Audit User Guide (Guide) to provide policy and procedures for the audit followup process. Section I, “Overview,” of the Guide states, The effectiveness of the post audit process depends upon taking appropriate, timely action to resolve audit findings and their underlying causes, as well as providing an effective system for audit close-out, record maintenance, and follow- up on corrective actions. 400 MARYLAND AVE., S.W. WASHINGTON, D.C. 20202-1510 Our mission is to ensure equal access to education and to promote educational excellence Ms. Shaw Page 2 of 10 While overall responsibility for the audit followup process is assigned to the Office of the Chief Financial Officer (OCFO), Post Audit Group (PAG), each Assistant Secretary (or equivalent office head) is responsible for ensuring that the overall audit followup process operates efficiently and consistently. The Guide defines further responsibilities of the Action Official (AO), generally the Assistant Secretary (or equivalent office head), to include: • Determining the action to be taken and the financial adjustments to be made in resolving findings in audit reports concerning respective program areas of responsibility, • Maintaining formal, documented systems of cooperative audit resolution and follow-up to ensure that audit recommendations are implemented, completion dates captured, and appropriate documentation maintained to support completed corrective actions. The Department tracks audit resolution and the completion of corrective action items through the Audit Accountability and Resolution Tracking System (AARTS). For each audit, AARTS stores detailed information on audit resolution, proposed corrective action items, Office of Inspector General (OIG) concurrence with these actions, responsible individuals, and completion and closure data. When a PO has completed all corrective action items for an internal OIG audit, the PO certifies this fact to PAG and requests closure of the audit in AARTS. PAG staff perform a review of the documentation in the audit resolution file maintained by the PO to determine whether implementation of corrective action items is supported. Once PAG is satisfied that implementation of the corrective action items reviewed is supported, the audit is closed in AARTS. PAG staff stated that until sometime in Fiscal Year (FY) 2004, only a sample of corrective action items was evaluated and that PO staff did not necessarily know that all corrective action items were not reviewed. PAG staff stated that currently all corrective action items are evaluated in these reviews. AUDIT RESULTS We found improvements are needed in Federal Student Aid’s (FSA) internal control over its audit followup process. While FSA maintained files with documentation regarding audit followup activity, we found FSA’s audit followup process did not support the completion of all corrective action items. In addition, this process did not always support completion of corrective action items on the date reported in AARTS. Finally, FSA used the PO Comments field in AARTS to modify agreed upon corrective action items instead of modifying the Action Item field. FSA audit resolution staff were aware of the Department’s documentation requirements for audit resolution files and generally believed that completion of corrective action items was adequately ED-OIG/A19F0001 Ms. Shaw Page 3 of 10 documented. However, we found documentation did not support completion of 10 of the 43 1 corrective action items reviewed. As a result, FSA does not have assurance that corrective action items were implemented. In addition, reporting corrective action items as completed before the actions have actually been taken compromises the integrity of the data included in AARTS, understates internal management reports and reports to Congress on corrective action items that have not yet been completed, and may negatively impact the Department’s credibility. Finally, when the AARTS PO Comments field is used to modify corrective action items, OIG does not have the opportunity to concur or nonconcur with the revised action item as being sufficient to address the issues noted during the audit. In response to the draft report, FSA concurred with our finding and provided corrective actions to address each of the recommendations included in our report. However, FSA noted that OIG’s standards for acceptable documentation were not the same standards used by FSA and PAG. FSA also cited weaknesses noted several years ago by the Government Accountability Office (GAO) with regard to OMB Circular A-50 guidance. OIG believes the supplemental guidance issued by PAG, specifically the Post Audit User Guide and the Guidelines for Establishing File Folders and Maintaining Documentation for GAO and ED-OIG Internal Audits and Alternative Products, is straightforward and includes appropriate examples of supporting documentation. Also, as noted in this report, we will be providing the results of our analysis of the effectiveness of PAG’s corrective action item review process in the audit followup summary report issued to the Chief Financial Officer upon completion of the audits in individual offices. The full text of the FSA response is included as Attachment 2 to this audit report. Finding 1 FSA Audit Followup Was Not Always Effective We found FSA’s audit followup process was not always effective. While FSA certified that corrective action items were completed, we found they were unable to support completion of 10 of the 43 corrective action items reviewed (23 percent). We were able to validate closure dates for 25 of the 33 supported corrective actions through FSA provided documentation.2 We found FSA reported 8 of these 25 action items (32 percent) as completed in the Department’s audit tracking system prior to dates reflected by supporting documentation. In addition, we noted FSA used the PO Comments field in AARTS to indicate that agreed upon corrective action items would not be completed as initially described instead of changing the Action Item field. 1 We initially reviewed a total of 45 corrective action items to verify if documentation was maintained in the audit resolution file to support completion of the action items. We could not assess the completion of 2 of the 45 corrective action items because data subsequently entered into the PO Comments field in the CAP changed the intent of the agreed upon action items without providing OIG an opportunity to either concur or nonconcur with the revised action items. 2 In eight cases, we could not validate closure dates because of limitations in the supporting documentation provided by FSA. ED-OIG/A19F0001 Ms. Shaw Page 4 of 10 Documentation Did Not Support Completion of Corrective Action Items FSA audit resolution file documentation did not initially support completion of 25 of the 43 corrective action items reviewed (58 percent). In response to an OIG request, FSA provided additional documentation that was not originally included in the audit resolution files. This documentation supported completion of 15 of the 25 originally unsupported corrective action items. Ultimately, FSA could not provide documentation to support completion of 10 of the 43 corrective action items (23 percent). Unsupported action items noted during this audit included the following: • In one audit, 3 the corrective action item stated: In accordance with an agreement reached with OIG to close this audit, FSA is sending a letter to all foreign schools whose loan volume is less than $500,000 to inform them of the audit requirements and request that they submit audits no later than 10/31/03. The letter will also include a "Dear Colleague Letter" to explain requirements related to enrollment verification and SSCR submissions. FSA's audit procedures have been changed to include foreign school audits in the DRCC's (Document Receipt and Control Center) normal audit processes... To support completion of the corrective action item, FSA staff provided a listing of the foreign schools that they believed were sent a letter regarding audit requirements. FSA stated the letter was mailed to applicable schools and a copy of the letter was placed in each school’s file. Correspondence in the audit file indicated the letters were mailed on 8/25/03. To determine if FSA maintained documentation as indicated, we attempted to review a sample of 16 foreign school files. In conducting this review we found FSA had not placed any of the letters in school files and instead maintained the documentation all together in one pile. Neither OIG nor FSA staff present could locate letters for 7 of the 16 selected schools in the documentation made available. • In another audit, 4 the corrective action item stated FSA would “Provide training and support to all project managers (PMs), Contracting Officer Representatives (CORs), all stakeholders and accountable contract entities on the new process and performance measures that monitor business case expectations/outcomes against achieved results.” Audit resolution file documentation showed FSA took some measures to provide training, however it did not show that those identified in the action item completed the training. In 3 Audit Control Number (ACN) A01-90005: “The Recertification Process for Foreign Schools Needs To Be Improved,” issued September 29, 2000, Corrective Action 1.1.5. 4 ACN A07-B0008: “Audit of FSA’s Modernization Partner Agreement,” issued November 20, 2002, Corrective Action 1.1.2. ED-OIG/A19F0001 Ms. Shaw Page 5 of 10 response to a request for additional information, FSA provided documentation that included training course titles, descriptions, and planned dates in 2004 and 2005 for these training courses. FSA also provided an email that included attachments outlining the response to the audit report recommendation. However, neither of these items showed FSA tracked attendees to ensure all identified positions completed the training. PAG issued Audit Closure Memos for six of the nine audits included in this audit. These six audits contained 31 of the 43 corrective action items we reviewed. We noted 2 of these 31 action items were identified as reviewed by PAG prior to issuance of the Audit Closure Memos. We determined one of the two action items reviewed by PAG was adequately supported by documentation provided by FSA. The results of our analysis of the effectiveness of PAG’s review process will be included in the audit followup summary report issued to the Chief Financial Officer upon completion of the audits in individual offices. Documentation Did Not Support Reported Completion Dates For the 25 corrective action items for which completion dates could be verified, FSA reported 8 corrective action items (32 percent) as completed in AARTS prior to the dates reflected by supporting documentation. These items were reported as completed from 4 days to 14 months before dates noted on supporting documentation provided. Five of the eight actions were reported as completed two or more months before dates noted on supporting documentation. For example, a corrective action item for one audit was reported as completed on September 30, 2002. FSA provided us with several reports and the results of payment statistical studies that showed the effort to reduce award error through Pell Grant verification. These items were sufficient to support the completion of the corrective action item, but were dated through November 21, 2003. 5 Principal Office Comment Field Used to Modify Proposed Corrective Action Items In two additional corrective action items, data from the PO Comments field in the CAP indicated action items would not be completed as initially described. This field was used instead of modifying the agreed upon action item to accurately reflect the final decision of management. For example, one corrective action item stated FSA would: Implement an integrated project management oversight of FSA system integration initiatives to ensure leadership, direction setting, and contract management for modernization and integration activities. System integration initiatives will be delivered in accordance with established project plans and milestones for each initiative. 6 5 ACN A06-A0020, “Effectiveness of the Department’s Student Financial Aid Application Verification Process,” issued March 28, 2002, Corrective Action 1.2.1 6 A07-B0008, Corrective Action 1.1.5. ED-OIG/A19F0001 Ms. Shaw Page 6 of 10 However, the PO Comments field stated in part: FSA has established a project management oversight process and has implemented stronger reporting and control mechanisms for monitoring contracts. These are interim processes which will be finalized when FSA reorganization is completed. An AARTS database administrator stated when information is entered or changed in the PO comment field there is no change to the resolution status and the OIG would not necessarily become aware of the change. He added when the Action Item text is changed within the system, the status reverts to "unresolved," OIG is notified of the change, and has the opportunity to concur or nonconcur with the revised action. Requirements for Audit Followup OMB Circular A-50, entitled “Audit Followup,” provides the requirements for establishing systems to assure prompt and proper resolution and implementation of audit recommendations. The Circular states: Audit followup is an integral part of good management, and is a shared responsibility of agency management officials and auditors. Corrective action taken by management on resolved findings and recommendations is essential to improving the effectiveness and efficiency of Government operations. Each agency shall establish systems to assure the prompt and proper resolution and implementation of audit recommendations. These systems shall provide for a complete record of action taken on both monetary and non-monetary findings and recommendations. The Department’s Post Audit User Guide, Section IV, “Internal Audits,” Chapter 1, “ED Office of Inspector General (ED-OIG) Audit Reports and Alternative Products,” Part G, “Corrective Actions,” states: Each AO must maintain documentation to support implementation of each corrective action in accordance with the Guidelines for Establishing File Folders and Maintaining Documentation. The documentation must be specifically identifiable to a corrective action to withstand any post audit closure review by PAG/OCFO, ED-OIG, [Government Accountability Office] GAO and/or OMB. All ED-OIG audit records must be retained by an AO for at least five years after ED-OIG is notified that all corrective actions have been completed. The Department’s Guidelines for Establishing File Folders and Maintaining Documentation states: A file folder should be established for each audit report beginning with the draft report. Each folder should contain . . .Documentation to support implementation of corrective actions or specific notes that indicate where said documents are ED-OIG/A19F0001 Ms. Shaw Page 7 of 10 located . . .Explanation of how such documentation supports the corrective action, if not readily understood or evident. The Guidelines for Establishing File Folders and Maintaining Documentation also provides examples of supporting documentation to include memos of understanding, final regulations, Dear Colleague Letters, records from databases, and policies and procedures. FSA audit resolution staff generally believed that available documentation was adequate to support completion of action items. In a meeting subsequent to the exit conference, FSA management indicated some of the action items questioned by OIG are still in the process of being completed and that FSA would need to change the reported completion dates in AARTS. FSA also provided documentation to show completion dates had recently been changed in AARTS for the corrective action items OIG noted were reported as completed prior to the dates reflected by supporting documentation. Without appropriate documentation, FSA does not have assurance that identified deficiencies were corrected. As such, the risk remains that related programs may not be effectively managed. By reporting corrective action items as completed when they have not been, or in advance of the actual completion date, FSA compromises the integrity of the data included in AARTS and may negatively impact the Department’s credibility. Management reports on corrective action items due for completion may be understated. In addition, the Department’s Semiannual Report to Congress on Audit Followup may also underreport the audits for which corrective action items have not been completed. By documenting changes to agreed upon actions in the AARTS PO Comments field, OIG did not have the opportunity to review and either concur or nonconcur with the revised actions as sufficient to address the issues noted during the audit. Recommendations: We recommend that the Chief Operating Officer for Federal Student Aid: 1.1 Establish and implement procedures to ensure that implementation of corrective action items is fully supported by adequate documentation, in accordance with the Department’s audit-related documentation and file requirements. 1.2 Ensure that completion dates reported in AARTS are consistent with dates reflected in supporting documentation. 1.3 Ensure AARTS is updated to reflect the actual completion dates for the action items noted in the audit with discrepancies in the reported completion dates. 1.4 Ensure that changes to agreed upon action items are identified by editing the Action Item field in AARTS rather than using the PO Comments field. ED-OIG/A19F0001 Ms. Shaw Page 8 of 10 FSA Response: In its response to the draft report, FSA concurred with the finding and provided corrective actions to address each of the recommendations included in our report. FSA stated they have already implemented procedures that require FSA audit liaison staff to complete a documentation checklist before submitting any corrective actions for closure in AARTS. Furthermore, FSA said they will conduct periodic reviews of audit files to ensure that staff is following procedures for each audit. FSA noted that OIG’s standards for acceptable documentation were not the same standards used by FSA and PAG. FSA also cited weaknesses noted in a 1992 GAO report with regard to OMB Circular A-50 guidance. The GAO report noted the guidance does not indicate when an audit recommendation should be closed and what kind of documentation is sufficient to support the closure of an audit recommendation. FSA also cited the GAO report as noting a lack of guidance pertaining to alternative actions that are taken that essentially meet the auditors’ intent or when circumstances have changed and the recommendations are no longer valid. FSA stated this was the case in two of the corrective action plans sampled in our audit. OIG Comments: While weaknesses may exist in OMB Circular A-50 guidance, OIG believes the supplemental guidance issued by PAG, specifically the Post Audit User Guide and the Guidelines for Establishing File Folders and Maintaining Documentation for GAO and ED-OIG Internal Audits and Alternative Products, is straightforward and includes appropriate examples of supporting documentation. It would be impossible for PAG to issue guidance on what type of documentation would be sufficient for every corrective action the Department takes. Also, as previously noted, we will be providing the results of our analysis of the effectiveness of PAG’s corrective action item review process in the audit followup summary report issued to the Chief Financial Officer upon completion of the audits in individual offices. In addition, while we understand circumstances can change after OIG accepts a CAP, we believe it is imperative that OIG have the opportunity to independently review any revised corrective actions to ensure they address the deficiencies noted during the audit, or agree that a recommendation is no longer valid to warrant any corrective action. OBJECTIVE, SCOPE, AND METHODOLOGY The objective of our audit was to verify whether adequate documentation was maintained to support that corrective action items have been implemented as stated in the Department’s CAPs. To accomplish our objective, we performed a review of internal control applicable to FSA’s audit followup process. We reviewed applicable laws and regulations, and Department policies ED-OIG/A19F0001 Ms. Shaw Page 9 of 10 and procedures. We conducted interviews with OCFO/PAG staff regarding Department policy and procedures, and AARTS operation. We conducted interviews with FSA staff responsible for resolving and following up on corrective action items for the audits selected. We also reviewed documentation provided by FSA staff to support completion of corrective action items for the recommendations included in our review. The scope of our audit was limited to corrective action items developed in response to internal OIG audits of FSA processes and programs. Our scope included only those corrective action items reported as “completed” in AARTS during the period July 1, 2002, through July 30, 2004. We excluded from our review corrective action items for recurring audits, such as annual financial statement audits, information security audits, or those with prior or planned followup audits so as not to duplicate audit effort. This resulted in a universe consisting of 9 FSA related audits with 45 corrective action items. We could not review 2 of the 45 items due to the use of the PO Comments field to change the intent of the corrective action. Therefore, only 43 action items were reviewed for adequacy of supporting documentation. The audits and corrective action items reviewed are listed in Attachment 1 to this report. We relied on computer-processed data initially obtained from AARTS to identify action items applicable to the scope period. An alternative data source is not available to directly test the completeness of the corrective action items as reported in AARTS. However, we tested the accuracy of AARTS data by comparing AARTS data to supporting documentation. We also conducted a limited review of AARTS data controls and relied on feedback from resolution staff to gain additional assurance relating to the completeness and accuracy of AARTS data. Based on these tests and assessments, we determined that the computer-processed data was sufficiently reliable for the purpose of our audit. Our review was based on the corrective action items defined by FSA in its CAPs and agreed upon by OIG in the audit resolution process. We reviewed and analyzed documentation in FSA’s audit resolution files to determine whether completion of each selected corrective action item was supported. In cases where documentation in the file did not support completion of the action item, we provided FSA with an opportunity to provide additional documentation from other sources. We reviewed any additional documentation subsequently provided to make a final determination as to whether completion of the corrective actions was then supported. In addition, we verified the reported completion dates in AARTS against the supporting documentation provided, where possible, for those corrective action items that were supported. We conducted fieldwork at FSA offices in Washington, DC, during the period September 2004 through May 2005. We held an exit conference with FSA staff on May 17, 2005. Our audit was performed in accordance with generally accepted government auditing standards appropriate to the scope of the review described above. ED-OIG/A19F0001 Ms. Shaw Page 10 of 10 ADMINISTRATIVE MATTERS Corrective actions proposed (resolution phase) and implemented (closure phase) by your office will be monitored and tracked through the Department’s Audit Accountability and Resolution Tracking System. Department policy requires you develop a final CAP for our review in the automated system within 30 days of the issuance of this report. The CAP should set forth the specific action items, and targeted completion dates, necessary to implement final corrective actions on the finding and recommendations contained in this final audit report. In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector General is required to report to Congress twice a year on the audits that remain unresolved after six months from the date of issuance. Statements that managerial practices need improvements, as well as other conclusions and recommendations in this report, represent the opinions of the Office of Inspector General. Determinations of corrective action to be taken will be made by the appropriate Department of Education officials. In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office of Inspector General are available to members of the press and general public to the extent information contained therein is not subject to exemptions in the Act. We appreciate the cooperation provided to us during this review. Should you have any questions concerning this report, please call Michele Weaver-Dugan at (202) 245-6941. Please refer to the control number in all correspondence related to the report. Sincerely, Helen Lew /s/ Assistant Inspector General for Audit Services cc: Marge White, Audit Liaison Officer, FSA Charles Miller, Supervisor, PAG/OCFO ED-OIG/A19F0001 ATTACHMENT 1 – Audits and Corrective Action Items Reviewed Number Audit Title Issue Corrective Unsupported Unsupported Control Date Action Items Action Items Completion Number Reviewed Dates 1 A05- Audit of Educational 3/20/03 1.1.1, 1.2.1 None 1.2.1 D0001 Credit Management Corporation’s Administration of the Federal Family Education Loan Program Federal and Operating Funds for the period April 1, 2000 through March 31, 2001. 2 A06- Audit of the 3/28/02 1.2.1, 1.3.1, None 1.2.1, 1.3.1, A0020 Effectiveness of the 1.3.2, 1.3.3, 1.3.2 Department’s Student Financial Aid Application Verification Process 3 A19- Audit of the Department 10/31/02 1.1.1, 1.1.2, 1.2.1, 1.3.1 None C0006 of Education’s Controls 1.2.1, 1.2.2, Over the Access, 1.3.1, 1.4.1, Disclosure, and Use of 1.4.2 Social Security Numbers by Third Parties. 4 A19- Audit of the Department 12/23/03 1.1.1, 1.1.2, None None D0002 of Education’s 1.1.3, 1.2.1, Monitoring of Private 1.2.2, 1.3.1, Collection Agency 1.4.1, 1.5.1 Contractors 5 A01- Audit of the 9/29/00 1.1.5 1.1.5 None 90005 Recertification Process for Foreign Schools Number Audit Title Issue Corrective Unsupported Unsupported Control Date Action Items Action Items Completion Number Reviewed Dates 6 A05- Audit of Oversight 7/31/03 1.2.1, 2.1.1 2.1.1 None D0010 Issues Related to Guaranty Agencies’ Administration of the Federal Family Education Loan Program Federal and Operating Funds. 7 A07- Audit of FSA’s 11/20/02 1.1.1, 1.1.2, 1.1.2, 3.3.1 2.1.1 B0008 Modernization Partner 1.1.3, 1.1.4, Agreement 1.5.5, 2.1.1, 2.1.2, 3.1.1, 3.3.1 8 A19- Audit of Controls over 3/15/02 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.2 B0001 Government Property 1.1.3, 1.1.4, 1.3.2, 1.3.3 Provided under Federal 1.2.1, 1.2.2, Student Aid Contracts 1.3.1, 1.3.2, 1.3.3 9 A03- Audit of Procedures at 8/22/02 1.1.1, 1.2.1, None 1.1.1, 1.2.1 B0001 Federal Student Aid for 2.1.1 Monitoring the Ability- to-Benefit Test Publishers Approved by the U.S. Department of Education TOTAL 45 10 8 FEDERAL Attachment 2 STUDENT AID CH IEF OPERATING OFFICER TO: Helen Lew Ass istant Inspector General for Audit Services Office of Inspecto r General FROM: Theresa S. Shaw Chi ef Operating Officer SUBJECT: Draft Audit Repo rt "Audit Follow-Up Process for Offlce of Inspecto r General Internal Audits in Federal Student Aid" Control No. ED-OIG/A 19-FOOO I Thank you fo r providing us with an opportunity to respond to the Office of Inspector General's (OIG) draft audit report, "Audit rollow-Up Process for Office of In spector General Intellla l Audits in Federal Studen t A id ," Con trol Number ED-O IG/AI9-F0001, dated Jul y 13,2005. We agree that internal audit fo ll ow- up procedures should be impro ved to ensure that completed correcti ve actions arc adequate ly documented before we report them compl eted in the Departm ent 's aud it tracki ng system . During the co urse of thi s audit it became clear that OIG's standards fo r acceptab le documentation were not the same standards used by FSA and the Office of the Chief Financial Officer's Po st Audit Group (PAG) , th e o ffi ce with overall responsibility for the audit follow-up process. As the report no tes, yo ur auditors found insuffi cient doc umentation of compl e ti on for five audits that P AG closed. In 1992 th e Government Acco untability Office (GAO) recomm ended that the Office of Management and Budget (OM B) revise C irc ular A-50, "Audit Followup," because it do es not indicate when an audit recomme ndation should be closed and does not state what kind of documentati on is sufficient to support th e closurc of an audit recommendation. ("Audit Resolution: Strengthened Guidance Needed To Ensure Effective Action" GAO/AFMD-92- 16). Despite GAO's recomm endation, OMB 's C irc ular A-50 has not been updated si nce 1982, but it rema ins o ur autho ritati ve guid ance for audit follow-up. That GAO report also pointed o ut a weakness in OMB's guidance to agencies when alternative actions have bcen taken th at essc ntiall y meet the auditors' intent or when circumsta nces have changed and the reco illm end at io ns are no lo nger val id. This was the case in two o f the cOITective acti on plans yo u samp led in w hich FSA reported the impl ementati o n o f alternati ve cOITecti ve act io ns for recommendation s. 830 hrst Street, NE, Wa shingt.on, o.c. 20202 1-800-4-FEo.-A I0. www.5wtietJttlid .ed.gou FSA takes its responsibility for audit follow-up quite seriously and continually seeks to improve the effectiveness of the audit follow-up process. Since OMS's Circular A-50 guidance does not currently address these matters, we would welcome the opportunity to work with your office and the Office of the Chief Financial Officer to close this long standing guidance gap at the agency level. This would help us to ensure that future completed corrective actions are fully supported, properly reported, and sustainable in any review conducted by your office. In the meantime, we are pleased to report that FSA has taken immediate action to address each of the audit's recommendations. Our response to the finding and each oCthe recommendations is included in the attachment. Thank you again for the opportunity to review and comment on this report. Attachment cc: Michele Weaver-Dllgan , Director, OIG Operations Internal Audit Team Patrick 1. Howard, Director, OIG Student Financial Assistance Advisory & Assistance Team Charles Miller, Director, OCFO Post Audit Group 2 AllaclU11ent Audit Follow-Up Process for Oflice of Inspector General Intemal Audits in Federal Student Aid (A I9-FOOOI) Finding No.1 - FSA Audit Follow-Up Was Not Always Effective We concur that FSA 's audit foll ow- up did not always meet the OrG's standards. We sincere ly hope OIG will work with the Department's audit follow-up officials to establish appropriate standards for docum entation requirements that all Departm ent of Education offices can use to ensure effective and proper audit follow-up. Recommendation 1.1 Establish and implem ent procedures to ensure that implementation of cOITecti ve action items is fully supported by adequate documentat ion, in accordance with the Department's audit-related documentation and fil e requirements. FSA's Response: COITecti ve action was completed on May 19,2005. We implemented proced ures that require FSA's audit liaiso n sta ff to compl ete a documentation checklist before submitting any corrective actions for closure in the Audit Accountability and Reso lution Tracking System (AARTS). Furthermore, peri odi c reviews will be conducted of audit fil es to ensure that staff is followin g proced ures for each audit. Recommendation 1.2 Ensure that completion dates repol1ed in AARTS are consistent with dates reflected in supporting documentation. FSA's Response: Con ective action was compl eted o n May 19,2005. We impl emen ted procedures th at require FSA's audit liai son sta ff to compl ete a documentation checklist before submitting any conective actions [or c losure in AARTS. The documentation checklist spec ifi ca ll y states that staff cannot enter a complction date in AARTS that do es not match the date on the documentation. As stated previously, periodic rev iews will be co nducted o f audit files to ensure that staffi s following procedures. Attachment Audit Follow-Up Process for Office ofTnspector General Intemal Audits in Federal Student Aid (AI9-F0001) Recommendation 1.3 Ensure AARTS is updated to reOect the action completion dates for the action items noted in the audit with discrepancies in the reported completion dates. FSA's Response: We completed this corrective action on May 26,2005, when we cotTected the completion dates in AARTS. We also provided your office with the documentation to support the completion of this action. Recommendation 1.4 Ensure that changes to agreed upon action items are identified by editing the Action Item field in AARTS rather than using the PO Comments field. FSA's Response: We concur with this recommendation; however, we believe the specific audit cited in your report was not reOective of changes to the original action item. The PO Comment field is a way for program offices to record more detailed infotmation on what was done to accomplish the corrective action. We included a section in our May 2005 procedures to address this recommendation; and on July 21,2005, we reminded FSA audit liaison staff that they are to submit changes to agreed-upon corrective actions to OIG for concurrence by editing the Action Item field in AMTS rather than using the PO Comments field. 2
Audit Followup Process for Office of Inspector General Internal Audits in Federal Student Aid.
Published by the Department of Education, Office of Inspector General on 2005-09-08.
Below is a raw (and likely hideous) rendition of the original report. (PDF)