oversight

The Department's Followup Process for External Audits

Published by the Department of Education, Office of Inspector General on 2016-07-01.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                       UNITED STATES DEPARTMENT OF EDUCATION
                                       OFFICE OF INSPECTOR GENERAL

                                                                                                             AUDIT SERVICES



                                                 July 1, 2016
                                                                                             Control Number
                                                                                             ED-OIG/A19O0001


Tim Soltis
Delegated to Perform Functions and Duties of the Chief Financial Officer
Office of the Chief Financial Officer
U.S. Department of Education
400 Maryland Avenue, S.W.
Washington, DC 20202

Dear Mr. Soltis:

This Final Audit Report, titled Audit of the Department’s Followup Process for External
Audits, presents the results of our audit. The objective of the audit was to evaluate the
effectiveness of the Department of Education’s (Department) process to ensure that external
auditees implement corrective actions as a result of Office of Inspector General (OIG) audits.



                                                BACKGROUND


Office of Management and Budget (OMB) Circular A-50, “Audit Followup,” provides the
requirements for establishing systems to assure prompt and proper resolution and
implementation of audit recommendations. The Circular provides that audit followup is an
integral part of good management, a shared responsibility of agency management officials and
auditors, and management’s corrective action on resolved findings and recommendations is
essential to improving the Government’s effectiveness and efficiency. Agencies are responsible
for establishing systems that provide a complete record of actions taken on findings and
recommendations to assure that audit recommendations are promptly and properly resolved.

The Circular requires that each agency designate a top management official to oversee followup,
including resolution and corrective action. The Department’s designated followup official is the
Chief Financial Officer (CFO). Within the Office of the Chief Financial Officer (OCFO), the
Post Audit Group (PAG) is responsible for assisting the CFO in the audit followup process.




                              400 MARYLAND AVENUE, S.W., WASHINGTON, DC 20202-1510

              Promoting the efficiency, effectiveness, and integrity of the Department’s programs and operations.
Final Audit Report
ED-OIG/A19O0001                                                                        Page 2 of 14

The Department established the “Handbook for the Post Audit Process” (OCFO-01), dated
June 22, 2007 (Handbook), to provide policies and procedures for the resolution and followup of
internal and external audits of Department programs, activities, and functions. External audits
are of external entities that receive funding from the Department, such as State educational
agencies, local educational agencies, institutions of higher education, contractors, and nonprofit
organizations. External OIG audit reports generally include recommendations for Department
management to require the external entity to take corrective action. These recommendations
may be either monetary, which recommend that the entity return funds to the Department, or
nonmonetary, which recommend that the entity improve operations, systems, or internal controls.
The audit resolution process begins with the issuance of a final audit report.

An external audit is considered resolved when the Department issues a program determination
letter to the external entity that is agreed to by the OIG. Upon resolution, the Department is
responsible for followup to ensure that corrective actions are actually taken. An audit is
considered closed when the Department ensures that all corrective actions have been
implemented including funds repaid or settlement made.

The Handbook provides that the CFO is responsible for ensuring that a system of cooperative
audit resolution and followup is documented and in place, including followup to ensure
corrective actions are implemented.

The Handbook notes specific responsibilities of the Assistant Secretaries or designated Action
Officials (AO) that include:

   •   Determining the action to be taken and the financial adjustments to be made in resolving
       findings in audit reports concerning respective program areas of responsibility,
   •   Monitoring auditee actions in order to ensure implementation of recommendations
       sustained in program determinations, and
   •   Maintaining formal, documented systems of cooperative audit resolution and followup.

The Handbook also defines roles and responsibilities for PAG that include:

   •   Ensuring that AOs have appropriate audit followup systems in place and that these
       systems are being effectively used,
   •   Monitoring the Department's compliance with OMB Circular A-50, and
   •   Ensuring the overall effectiveness of the Department’s audit followup system.

The Handbook specifies that accurate records must be kept of all audit followup activities,
including all correspondence, documentation and analysis of documentation. The Department’s
Audit Accountability and Resolution Tracking System (AARTS) is a web-based application
designed to assist Department management with audit followup and closure.

In March 2005, the OIG issued a report entitled: “Audit of the Department of Education’s
Followup Process for External Audits,” (Control Number ED-OIG A19D0007). OIG reported
that PAG did not fulfill its responsibilities to ensure that AOs had systems in place to follow up
on corrective actions, monitor the Department’s compliance with OMB Circular A-50, and
Final Audit Report
ED-OIG/A19O0001                                                                       Page 3 of 14

ensure the overall effectiveness of the Department’s audit resolution and followup system. In
addition, OIG found that audits were closed prior to completion of corrective actions. As a result
of these findings, OIG concluded that the Department did not have assurance that requested
corrective actions were completed and risks remained that related programs were not being
effectively managed and Department funds were not being used as intended.

This report presents the results of our audit of the Department’s audit followup process for
external OIG audits. It combines the results of work conducted within four principal offices
(POs). In conducting this audit, separate reports were issued to POs with responsibility for audit
resolution and followup for the audits included in our scope. A listing of these reports is
included as Attachment 2 to this report. The following POs were included in our audit:

   •   Federal Student Aid (FSA)
   •   Office of Elementary and Secondary Education (OESE)
   •   Office of Special Education and Rehabilitative Services (OSERS)
   •   Office of the Chief Financial Officer

A listing of the audits reviewed is included as Attachment 3 to this report.



                                      AUDIT RESULTS


We found that the Department’s audit followup system was not always effective. PAG did not
fulfill its responsibilities to ensure that AOs had systems in place to follow up on corrective
actions, monitor the Department’s compliance with OMB Circular A-50, and ensure the overall
effectiveness of the Department’s audit resolution and followup system.

We noted that the Department closed 241 OIG external audits between October 1, 2008 and
September 30, 2015. Of the 241 closed audits, 169 (70 percent) were closed more than 2 years
after resolution, 93 (39 percent) were closed more than 5 years after resolution, and 29 audits
(12 percent) were closed more than 7 years after resolution. In addition, adequate documentation
was not maintained for 75 out of 126 recommendations (60 percent) in the 28 closed audits we
reviewed, to include monetary corrective actions totaling $8,471,024.

As a result, the Department did not have assurance that requested corrective actions were taken
and that the issues noted in the OIG audits were corrected. Not ensuring that corrective actions
are taken as quickly as possible allows identified deficiencies to continue to exist. As such, the
risk remains that related programs may not be effectively managed and funds may not be used as
intended.

In its response to the draft audit report, OCFO concurred with all but one of the
recommendations. Specifically, OCFO did not concur with recommendation 1.7 with regard to
modifying AARTS so that only PAG staff are authorized to close audits in the system after the
issuance of a closure memorandum. OCFO stated that it believed this would disassociate
Final Audit Report
ED-OIG/A19O0001                                                                      Page 4 of 14

accountability and responsibility that AOs currently have to ensure that the grantee takes
appropriate corrective action and also to close out actions when they are deemed completed.

OCFO stated that it takes the responsibility of audit followup very seriously but acknowledged
that further improvements are needed, especially with respect to ensuring that AOs have
appropriate audit followup systems in place and are closing audits timely. OCFO stated that it
intends to more vigorously review and assist offices to ensure timely closure and maintenance of
effective documentation of both Single Audit and ED-OIG external audit findings.

OCFO’s comments are summarized at the end of the finding. As a result of OCFO’s comments,
we did not make any changes to the audit finding or the related recommendations. The full text
of OCFO’s response is included as Attachment 4 to this report.

FINDING NO. 1 – The Department’s Audit Followup Process Was Not Always
                Effective

The Department’s PAG did not fulfill its responsibilities to ensure that the Department’s audit
followup system for external OIG audits was operating effectively. Specifically, we found that
PAG did not effectively:

    •   Ensure that Action Officials had systems in place to follow up on corrective actions,
    •   Monitor the Department’s compliance with OMB Circular A-50, and
    •   Ensure the overall effectiveness of the Department’s audit resolution and followup
        system.

Timeliness of Audit Closure

During our review, we evaluated the Department’s AARTS data to determine the number of
external OIG audits that were closed between October 1, 2008 and September 30, 2015. We
noted that the Department closed 241 audits during this time period. Of the 241 closed audits,
169 (70 percent) were closed more than 2 years after resolution, 93 (39 percent) were closed
more than 5 years after resolution, and 29 audits (12 percent) were closed more than 7 years after
resolution. The total of the monetary recommendations associated with the 241 audits was
$2,444,490,404 as depicted in Table 1.
Final Audit Report
ED-OIG/A19O0001                                                                                   Page 5 of 14

              Table 1. Count and Percentage of Closed Audits by Elapsed Time Between
                                      Resolution and Closure

    Elapsed Time            Number         Percentage of       Total of Monetary           Percentage of
                            of Audits         Audits           Recommendations              Monetary
                                                                                         Recommendations
Greater than 84                 29              12%                $35,700,120                  1%
months
73 to 84 months                  24             10%                $23,730,260                    1%
61 to 72 months                  40             17%               $206,327,030                    8%
49 to 60 months                  25             10%                $42,625,903                    2%
37 to 48 months                  29             12%               $405,699,468                   17%
25 to 36 months                  22              9%                 $5,679,401                    0%
Less than 25 months              72             30%              $1,724,728,222                  71% 1
Total                           241                              $2,444,490,404

Further, we noted that median timeliness of audit closure was 1,174 days for the most recent
fiscal year. While that appears to be an improvement from the prior year, time between audit
resolution and closure has not shown consistent improvement, as depicted in Table 2, and still
needs continued focus.

        Table 2. Median 2 Days Between Audit Resolution and Closure by Fiscal Year


                                                       Median Number
                           Fiscal Year of Number of of Days Between
                           Audit Closure Closed Audits Audit Resolution
                                                         and Closure

                                 2009                 20                 1,093
                                 2010                 20                 1,228
                                 2011                  7                  611
                                 2012                 38                 2,090
                                 2013                 40                 1,365
                                 2014                 64                 2,242
                                 2015                 52                 1,174




1
  The audit Special Allowance Payments to Nelnet for Loans Funded by Tax-Exempt Obligations
(ED-OIG/A07F0017) represents $1,160,000,000 (67 percent) of the $1,724,728,222 total for audits that had an
elapsed time of 2 years or less.
2
  We used the median to reduce the potential impact of extreme values.
Final Audit Report
ED-OIG/A19O0001                                                                                         Page 6 of 14

Documentation of Audit Followup Activities

We also found that POs did not always adequately maintain documentation of audit followup
activities. This included not maintaining supporting documentation of corrective actions in the
official audit file as well as not maintaining documentation that supported that requested
corrective actions were actually taken prior to audit closure. We reviewed audit followup
activities in four of the Department’s POs, to include a nonstatistical sample of 31 resolved and
closed audits. 3 Of these 31 audits, 22 were closed between October 1, 2008 and
September 30, 2013, while 6 were closed during our audit fieldwork. Three of the selected
audits remained in resolved status at the completion of our fieldwork. For the 28 closed audits,
the POs determined that 126 recommendations required corrective actions, to include
$31,607,083 in monetary corrective actions. We found that PO files did not adequately maintain
documentation for 75 out of 126 recommendations (60 percent), to include monetary corrective
actions totaling $8,471,024. Additionally, for two of the three audits that were not yet closed,
the PO was not able to provide documentation to support that any followup activities were taking
place since the audits were resolved. Resolution dates for these audits were August 2010 and
March 2011.

Of the 75 recommendations for which POs did not adequately maintain documentation, we found
that 40 (53 percent) were attributable to audits associated with entities that have been designated
by the Department as either high-risk or active engagement grantees. We found that audit
followup and closure of these audits was a collaborative effort between the Department’s Risk
Management Services (RMS) and the PO designated in AARTS as the primary or lead office for
the applicable audits. This PO noted that it did not have access to the RMS files and therefore
could not ensure appropriate supporting documentation was maintained to support completion of
corrective actions. Additionally, this PO noted that in some audits it may be assigned as the lead
office for followup and closure but other principal offices are assigned responsibility for
following up on specific findings/recommendations within the audits. The PO stated that it may
complete work on its assigned findings, but it does not have the authority to require timeframes
within which other POs must complete work on theirs. This PO noted that there is a disconnect
in the process under these circumstances as the lead office is given responsibility for something
that it does not have complete control over.

We noted that some PO staff were not familiar with the Department’s related audit followup
policies and procedures and there appeared to be a general lack of understanding of
requirements. POs also noted that followup and closure activities were not the individuals’
primary responsibilities and as such did not appear to be a priority. One PO added that that there
has been an emphasis on the resolution of audits rather than the followup and closure of audits.
Another PO stated that many of the selected audits were closed in terms of verifying that all


3
 We selected the three POs with the largest number of audits closed between October 1, 2008 and
September 30, 2013. We also selected one PO based on the low proportion of audits closed to the large number of
audits resolved during the same time period. This resulted in selected audits that were still in resolved status during
our audit fieldwork. Selected audits included those with monetary recommendations totaling $5 million or greater.
In addition, we selected an audit from a grantee designated by the Department as high-risk that had significant
monetary findings albeit less than the threshold noted.
Final Audit Report
ED-OIG/A19O0001                                                                        Page 7 of 14

corrective actions have been taken by the entity. However, there were weaknesses in its process
in terms of documenting and officially closing these audits in AARTS.

OMB Circular A-50, “Audit Followup,” states that each agency shall establish systems to assure
the prompt and proper resolution and implementation of audit recommendations. These systems
shall provide for a complete record of action taken on both monetary and nonmonetary findings
and recommendations. It further states that corrective action is essential to improving the
effectiveness and efficiency of Government operations and should proceed as rapidly as possible.
It adds that the Audit Followup Official (AFUO) has personal responsibility for ensuring that
systems of audit followup, resolution, and corrective action are documented and in place and that
corrective actions are actually taken.

The Handbook, Section V, Chapter 1, Part D, states the CFO is the designated AFUO for the
Department of Education. The Handbook also states the AFUO is responsible for ensuring that a
system of cooperative audit resolution and followup is documented and in place, including
followup to ensure corrective actions are implemented.

Part F of the same chapter states that PAG within OCFO provides support to the AFUO. The
Guide further states PAG/OCFO is responsible for monitoring the Department's compliance with
OMB Circular A-50, Audit Follow-up.

Section III, “External Audits,” Chapter 5, Part B, of the Handbook states:

       Primary responsibility for following up on non-monetary determinations rests
       with AOs, who must have systems in place to ensure that recommended
       corrective actions are implemented by auditees. PAG/OCFO has responsibility
       for verifying that AOs have systems in place to followup on corrective actions
       and ensuring overall effectiveness of ED’s [Department of Education’s] audit
       resolution followup system.

This section also states, “Accurate records must be kept of all audit follow-up activities including
all correspondence, documentation, and analysis of documentation.”

OCFO policies and procedures, “Revised Procedures for the Closure of ED-OIG External
Audits,” dated June 3, 2008, states that when all corrective actions have been implemented and
all recommendations completed, the Action Official or Action Official designee should request
closure of the audit report by submitting a Request for Closure Memorandum to the Director of
PAG/OCFO. The Request for Closure Memorandum should state at a minimum that (1) all non-
monetary corrective actions have been implemented, (2) there are no outstanding collections or
active appeals, if applicable, (3) there is adequate documentation to support implementation of
all non-monetary corrective actions, and (4) the documentation is available for review.

The procedures further state that PAG will perform a review of the PO’s supporting
documentation of corrective action taken. PAG will approve or deny the POs request for audit
closure based upon its review of the supporting documentation.
Final Audit Report
ED-OIG/A19O0001                                                                                       Page 8 of 14

With regard to timeliness, the Director of PAG stated that PAG does not have a process in place
to periodically review the status of audits to ensure audits are closed timely. Similarly, there is
no policy that addresses the roles and responsibilities of PAG and affected POs, to include RMS,
when there is more than one PO assigned to an audit.

As a result of our previous external audit followup work, 4 in July 2007 PAG implemented a
process to review PO audit resolution files to ensure that appropriate documentation had been
obtained to assure that corrective actions were completed. PAG’s process required this review to
be conducted before audits could be considered closed and a closure memo issued. However, we
noted several weaknesses with this process, as follows.

We found that 16 of the 28 (57 percent) closed audits we reviewed from the selected POs did not
have adequate supporting documentation provided as part of the closure package submitted to
PAG. Of the 28 closed audits in our sample, 102 of the 126 (81 percent) recommendations that
required corrective action did not have appropriate support cited and attached to the
Documentation Review Sheet. Further, we found no evidence that PAG requested additional
information prior to approving closure. Examples of documentation accepted by PAG as
adequate to close the audits are noted below.

         •   In one audit, the Documentation Review Sheet noted the “Final Audit Report” was
             being provided as the supporting documentation for all of the recommendations
             requiring corrective action. According to an explanation provided to us by RMS
             during our review, the appropriate support should have been a copy of a third party
             fiduciary agreement and related statement of work.

         •   In four audits, the Documentation Review Sheet noted the Program Determination
             Letter (PDL) was being provided as support for closure of monetary and nonmonetary
             corrective actions. As the PDL is the document that communicates the corrective
             actions that need to be taken, it would not provide support of completion of the
             corrective actions.

         •   In one audit, the PO submitted supporting documentation that had already been
             submitted by the auditee prior to issuance of the PDL and deemed by the PO to be
             insufficient as evidence that corrective action was taken.

         •   In one audit, we found that 4 of the 12 recommendations requiring corrective actions
             (33 percent) were not addressed by the PO in the Documentation Review Sheet.

         •   In another audit, the PO provided single audit reports 5 as supporting documentation
             that did not specifically address the OIG audit recommendations.

4
  Audit of the Department of Education’s Followup Process for External Audits, ED-OIG/A19D0007, issued
March 2005.
5
  Single audits require comprehensive testing of compliance and internal controls over federal programs for entities
expending annual federal assistance equal to or in excess of $500,000 ($750,000 for fiscal years beginning on or
after December 26, 2014). These audits may be performed by an independent public accountant selected by the
entity.
Final Audit Report
ED-OIG/A19O0001                                                                      Page 9 of 14

We also found that PAG did not always initial and date the Documentation Review Sheet to
show that it had reviewed and accepted the supporting documentation submitted by the PO prior
to the issuance of the closure memorandum. We noted that only 4 of the 28 audits (14 percent)
had evidence of PAG review and approval on the Documentation Review Sheet, and only 1 of
the 28 audits (4 percent) had a Documentation Review Sheet that was dated. In addition, we
found 4 audits that were closed without a closure memorandum.

Further it appears that the associated PAG guidance provided some inappropriate examples of
supporting documentation for corrective action completion. In a sample closure package
provided by PAG to POs, dated June 3, 2008, the example of supporting documentation provided
was a letter from the external auditee to the Department stating the corrective actions that had
been taken. However, this alone does not provide support that the Department verified that the
auditee actually implemented the corrective actions.

According to former staff, the validation process was created to provide an objective review
process to ensure corrective action was taken. However, a former PAG Director streamlined the
process, making it clerical in function. The current director of PAG stated that the process to
validate the supporting documentation for audit closure is administrative only. The Director and
PAG staff noted that they rely on the documentation submitted by the program offices and
simply validate that something has been provided as support for audit closure. The Director of
PAG noted that AOs have the ability to close audits at any time in AARTS since there are no
system controls restricting when an audit can be closed. During the exit conference, OCFO
noted that it is in the process of updating the AARTS system controls so that only PAG can close
an audit in AARTS.

Lastly, it appears that OCFO did not complete prior corrective actions as a result of our previous
external audit followup work. 6 Specifically, as part of its identified correction actions in
response to our prior audit, PAG stated it would develop and implement a process to periodically
evaluate the appropriateness of the PO followup systems for external OIG audits. It also noted it
would develop and implement procedures to periodically report on the adequacy of AO systems
for followup on external corrective actions, and the overall effectiveness of the Department's
external audit followup system, based on the reviews of audit followup documentation and any
other related factors currently tracked by the Department. According to the Director of PAG, a
formalized evaluation process has not been implemented and there are no processes in place to
periodically report on the adequacy of the external audit followup system.

Following the exit conference, OCFO provided additional information related to efforts to
improve the audit followup process. Specifically, in the Fiscal Year (FY) 2015 Federal
Managers’ Financial Integrity Act (FMFIA) Assurance Statement, dated September 30, 2015,
OCFO noted that, based upon the series of reports that OIG issued related to this audit during
FY 2015, timely and well documented external audit followup activities remain a significant
deficiency for OCFO and the Department. OCFO noted efforts were being made to remediate
timeliness and documentation deficiencies with external audit followup during FY 2016, to
include improvements made to the timeliness of audit resolution which will allow them to focus

6
    See footnote 4.
Final Audit Report
ED-OIG/A19O0001                                                                                  Page 10 of 14

additional efforts on the audit followup and closure process and enhancements to AARTS to
enable electronic record-keeping. OCFO stated it has reorganized PAG to improve management
oversight and decrease the ratio of line staff to supervisors and began a new outreach initiative to
better integrate audit followup with grant monitoring functions across the Department. OCFO
also noted that it continues to leverage the potential of the Audit Governance Panel 7 to improve
audit followup activities, and plans to expand the Panel’s focus beyond the resolution of OIG
external audits to all aspects of audit followup.

As stated in the Department’s Handbook, “The effectiveness of the post audit process depends
upon taking appropriate, timely action to resolve audit findings and their underlying causes, as
well as providing an effective system for audit close-out, record maintenance, and followup on
corrective actions.” As a result of our review, we found the Department was not in compliance
with OMB Circular A-50 and its audit followup system for external audits was not always
effective. The Department did not have assurance that requested corrective actions were taken
and that the issues noted in the OIG audits were corrected. Not ensuring that corrective actions
are taken as quickly as possible allows identified deficiencies to continue to exist. As such, the
risk remains that related programs may not be effectively managed and funds are not being used
as intended.

Recommendations

We recommend that the CFO:

1.1     Develop and implement a process to periodically evaluate the appropriateness of the PO
        followup systems for external OIG audits, to include tracking timeliness of closure.

1.2     Develop and implement procedures to periodically report on the adequacy of AO systems
        for followup on external corrective actions and the overall effectiveness of the
        Department’s external audit followup system, based on the reviews of audit followup
        documentation, timeliness of audit closure, and any other related factors currently tracked
        by the Department.

1.3     Develop and implement guidance with regard to the audit followup and closure of audits
        involving multiple principal offices, to include PAG’s involvement in facilitating and
        getting involved as necessary to ensure the timely closure of external audits. Also
        address documentation requirements to ensure the office responsible for closure has all
        appropriate supporting documentation.

1.4     Revise the procedures for closure to include appropriate examples of supporting
        documentation.

1.5     Provide training to PO audit resolution staff on the requirements for audit followup and
        closure, including the new guidance noted above and the documentation that should be
7
 The Audit Governance Panel was established in 2012. It is a committee chaired by the PAG Director and
comprised of representatives from the Department’s POs. The team’s original purpose was to address the significant
backlog of unresolved ED-OIG audits.
Final Audit Report
ED-OIG/A19O0001                                                                      Page 11 of 14

       maintained and provided with the Documentation Review Sheet to provide assurance that
       corrective actions are taken.

1.6    Ensure PAG staff accept from POs only documentation that adequately supports
       completion of the stated corrective action items prior to closing audits.

1.7    Modify AARTS so that PAG staff are the only individuals authorized to close audits in
       the system after the issuance of a closure memorandum.

OCFO Comments

In its response to the draft audit report, OCFO concurred with recommendations 1.1 through 1.6
but did not concur with recommendation 1.7. Specifically, OCFO did not agree with modifying
AARTS so that only PAG staff are authorized to close audits in the system after the issuance of a
closure memorandum. OCFO believed this would disassociate accountability and responsibility
that AOs currently have to ensure that the grantee takes appropriate corrective action and also to
close out actions when they are deemed completed. OCFO stated that it was not aware of any
instances where a PO actually closed an audit prior to submitting a request for closure to and
receiving approval from PAG. OCFO noted that it believed additional oversight, training, and
support provided by OCFO will be sufficient to strengthen internal controls over audit closure.

OCFO stated that it takes the responsibility of audit followup very seriously and noted that audit
followup has been incorporated into the Department’s Strategic Plan and Organizational
Performance Review processes. OCFO added that over the last few years priority has been given
to the timely resolution of external audits, stating that the Department has reduced the percentage
of overdue external audits, but acknowledged that further improvements are needed, especially
with respect to ensuring that AOs have appropriate audit followup systems in place and are
closing audits timely. OCFO noted that it intends to more vigorously review and assist offices to
ensure timely closure and maintenance of effective documentation of both Single Audit and ED-
OIG external audit findings.

OIG Response

We appreciate the efforts noted by OCFO to improve the audit followup process. We considered
OCFO’s comments regarding recommendation 1.7 but did not make any changes to it. Our
position remains that only PAG staff should be authorized to close audits in AARTS after the
issuance of a closure memorandum. While OCFO noted that it was not aware of any instances
where a PO actually closed an audit prior to submitting a request for closure to and receiving
approval from PAG, we identified three audits during our audit fieldwork that were closed in
AARTS without a closure memorandum. This issue was communicated to OCFO at that time.
OCFO subsequently confirmed the premature closures and noted that these audits were reset to
“Resolved” status in AARTS while the applicable POs prepared closure packages and the proper
audit closure approval process was followed. OCFO stated it was possible for an audit to be
closed in AARTS without going through the PAG closure process because the two closure
processes are separate, noting that AARTS is not configured to require that PAG closure be
Final Audit Report
ED-OIG/A19O0001                                                                                      Page 12 of 14

verified nor is there a regular process to reconcile closure in AARTS and the PAG closure
process.

We do not agree that providing PAG with sole authority for closing audits in AARTS would
disassociate the accountability and responsibility that AOs currently have to ensure that the
grantee takes appropriate corrective action and also to close out actions when they are deemed
completed. AOs would still be required to submit an audit closure package to PAG that provides
documentation supporting that all actions were completed. PAG is then responsible for
approving or denying the AOs request for audit closure based upon its review of supporting
documentation. If approved, PAG would issue the closure memo to the PO and PAG would set
the audit to closed status in AARTS. This would be an effective and efficient control to prevent
a PO from prematurely closing an audit before ensuring actions are completed. It would also
assist with AARTS data reliability. As reported in our audit finding, OCFO had noted at the
audit exit conference that it was in the process of updating AARTS so that only PAG staff could
close an audit.

As a result of OCFO’s comments, we did not make any changes to the audit finding or the
related recommendations.



                      OBJECTIVE, SCOPE, AND METHODOLOGY


The objective of our audit was to evaluate the effectiveness of the Department’s process to
ensure that external auditees implement corrective actions as a result of OIG audits. To
accomplish our objective, we gained an understanding of the Department’s followup and closure
processes for external OIG audits. We reviewed applicable laws and regulations and Department
policies and procedures including OMB Circular A-50 and the Department’s Handbook for the
Post Audit Process, dated June 22, 2007. We also reviewed prior OIG audit reports relevant to
our audit objective. We conducted interviews with Department staff responsible for following
up on corrective actions for the audits selected and audit closure. We also reviewed
documentation provided by Department staff to support the corrective actions taken for the
recommendations included in our review as identified in the PDL.

The scope of our audit included OIG audits of programs at external entities with monetary or
nonmonetary findings that were reported by the Department’s AARTS and the OIG’s Audit
Tracking System (ATS) as closed during the period October 1, 2008 to September 30, 2013. 8
We identified a total of 136 audits in this universe, as shown by PO in Table 3 below.




8
  To provide more current analysis of timeliness, we expanded the scope prior to the issuance of this report to
include audits closed through September 30, 2015. This resulted in a universe of 241 audits.
Final Audit Report
ED-OIG/A19O0001                                                                                    Page 13 of 14

                            Table 3. Audit Reports in the Universe by PO

                                                                      Number of
                                                               PO   Closed Audits in
                             PO Title                        Acronym the Universe
     Office of Elementary and Secondary Education             OESE         87
     Office of the Chief Financial Officer                    OCFO         29
     Office of Special Education and Rehabilitative Services OSERS         14
     Office of the Deputy Secretary                            ODS          2
     Office of Postsecondary Education                         OPE          1
     Office of Career, Technical, and Adult Education        OCTAE          2
     Federal Student Aid                                       FSA          1
     Total                                                                136

To select audits for review, we identified the three POs with the largest number of audits closed
between October 1, 2008 and September 30, 2013. We also selected an additional PO based on
the low proportion of audits it closed compared to the large number of audits it resolved during
the scope period. 9 Selected audits from these POs included those with monetary
recommendations totaling $5 million or greater. 10 This resulted in a nonstatistical sample of 31
closed and resolved audits and 232 recommendations for review. 11 Of these 31 audits, 22 were
closed between October 1, 2008 and September 30, 2013, while 6 were closed during our audit
fieldwork. Three of the selected audits remained in resolved status at the completion of our
fieldwork. The number of selected audits and recommendations for each PO is shown in Table 4
below. A complete listing of the selected audits is included as Attachment 3 to this report.

                        Table 4. Selected Audits and Recommendations by PO

                                 Number of        Number of
                               Selected Closed Selected Resolved                  Number of
            PO Title               Audits            Audits                    Recommendations
          OESE                        14               0                            122
          OCFO                         4               0                             37
          FSA                          1               9                             59
          OSERS                        3               0                             14
          Total                       22               9                            232

Because there is no assurance that the nonstatistical sample used in this audit is representative of
the respective universe, the results should not be projected over the unsampled audits.



9
  This resulted in selected audits that were still in resolved status during our audit fieldwork.
10
   We selected one audit from a grantee designated by the Department as high-risk that had significant monetary
findings albeit less than the threshold noted.
11
   We excluded any internal and non-sustained recommendations included in these audits from further review.
Final Audit Report
ED-OIG/A19O0001                                                                         Page 14 of 14

We relied on computer-processed data obtained from the Department’s AARTS and OIG’s ATS
to identify OIG external audits closed during the scope period. We reconciled the data in these
two systems to ensure that we captured all audits closed during this period. Based on this
assessment, we determined that the computer-processed data were sufficiently reliable for the
purpose of this audit.

We conducted fieldwork at Department offices in Washington, DC, during the period
February 2014 through February 2016. We provided our audit results to Department officials
during an exit conference conducted on February 11, 2016.

We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objective.



                             ADMINISTRATIVE MATTERS


Corrective actions proposed (resolution phase) and implemented (closure phase) by your office will
be monitored and tracked through the Department’s AARTS. Department policy requires that you
develop a final corrective action plan (CAP) for our review in the automated system within 30
calendar days of the issuance of this report. The CAP should set forth the specific action items, and
targeted completion dates, necessary to implement final corrective actions on the finding and
recommendations contained in this final audit report.

In accordance with the Inspector General Act of 1978, as amended, the OIG is required to report to
Congress twice a year on the audits that remain unresolved after 6 months from the date of issuance.

In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the OIG are
available to members of the press and general public to the extent information contained therein is
not subject to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have any questions, please call
Michele Weaver-Dugan at (202) 245-6941.

                                               Sincerely,

                                               Patrick J. Howard /s/
                                               Assistant Inspector General for Audit
                                                                           Attachment 1

             Acronyms/Abbreviations/Short Forms Used in this Report

AARTS            Audit Accountability and Resolution Tracking System
AFUO             Audit Followup Official
AO               Action Official
ATS              Audit Tracking System
CAP              Corrective Action Plan
CFO              Chief Financial Officer
Department       U.S. Department of Education
FMFIA            Federal Managers’ Financial Integrity Act
FSA              Federal Student Aid
FY               Fiscal Year
Handbook         Handbook for the Post Audit Process
OCFO             Office of the Chief Financial Officer
OCTAE            Office of Career, Technical, and Adult Education
ODS              Office of the Deputy Secretary
OESE             Office of Elementary and Secondary Education
OIG              Office of Inspector General
OMB              Office of Management and Budget
OPE              Office of Postsecondary Education
OSERS            Office of Special Education and Rehabilitative Services
PAG              Post Audit Group
PDL              Program Determination Letter
PO               Principal Office
RMS              Risk Management Services
                                                                            Attachment 2

                    PO Reports Issued in Conjunction with This Audit

           Audit
          Control
Number    Number                            Title                        Final Report Date
  1      A19P0001     Audit of the Followup Process for External            6/17/2015
                      Audits in Federal Student Aid
  2      A19P0003     Audit of the Followup Process for External            9/22/2015
                      Audits in the Office of Special Education and
                      Rehabilitative Services
  3      A19P0004     Audit of the Followup Process for External            9/28/2015
                      Audits in the Office of the Chief Financial
                      Officer
  4      A19P0002     Audit of the Followup Process for External           12/17/2015
                      Audits in the Office of Elementary and Secondary
                      Education
                                                                              Attachment 3

                         Audit Reports Reviewed in This Audit


           Audit
          Control                                          Report              Number of
Number    Number               Report Title              Issue Date   PO    Recommendations
  1      A07F0017   Special Allowance Payments to        9/29/2006    FSA         2
                    Nelnet for Loans Funded by Tax-
                    Exempt Obligations
  2      A02H0008   Touro College’s Title IV, Higher     10/30/2008   FSA         4
                    Education Act Programs,
                    Institutional and Program
                    Eligibility
  3      A05I0011   Special Allowance Payments to        5/28/2009    FSA         4
                    the Kentucky Higher Education
                    Student Loan Corporation for
                    Loans Made or Acquired with the
                    Proceeds of Tax-Exempt
                    Obligations
  4      A05E0017   Special Allowance Payments to        5/24/2005    FSA         5
                    New Mexico Educational
                    Assistance Foundation for Loans
                    Funded by Tax-Exempt
                    Obligations
  5      A04B0019   Advanced Career Training             9/25/2003    FSA         10
                    Institute’s Administration of the
                    Title IV Higher Education Act
                    Programs
  6      A03G0014   Special Allowance Payments to        11/19/2007   FSA         11
                    the Pennsylvania Higher
                    Education Assistance Agency for
                    Loans Funded by Tax-Exempt
                    Obligations
  7      A09H0017   Fifth Third Bank’s Eligible Lender    1/5/2009    FSA         5
                    Trustee Agreements Compliance
                    with Lender Provisions of the
                    Higher Education Act and
                    Monitoring of Entities With
                    Which It Has Agreements
  8      A05C0014   Educational Credit Management        3/18/2003    FSA         10
                    Corporation's Administration of
                    the Federal Family Education
                    Loan Program Federal and
                    Operating Funds
  9      A03H0009   Star Technical Institute's Upper     8/15/2008    FSA         3
                    Darby School's Compliance with
                    the 90 Percent Rule
           Audit
          Control                                          Report                Number of
Number    Number               Report Title              Issue Date    PO     Recommendations
  10     A06H0010   Eagle Gate College’s                 9/28/2007     FSA          5
                    Administration of Title IV Student
                    Financial Assistance Programs
  11     A02B0014   Puerto Rico Vocational               6/26/2002    OSERS         5
                    Rehabilitation Administration
  12     A02E0009   Puerto Rico Department of            12/14/2004   OSERS         3
                    Education’s Special Education
                    Program Services
  13     A06F0019   The Department of Interior’s         3/28/2007    OSERS         6
                    Bureau of Indian Affairs
                    Administration of the Individuals
                    with Disabilities Education Act
                    (IDEA) Part B Funds
  14     A02H0003   Teach for America, Inc., Review       6/5/2008    OCFO          5
                    of the U.S. Department of
                    Education Discretionary Grant
                    Awards
  15     A09H0019   Los Angeles Unified School           12/2/2008    OCFO          13
                    District’s Procedures for
                    Calculating and Remitting Interest
                    Earned on Federal Cash Advances
  16     A02E0008   U.S. Department of Education         6/14/2005    OCFO          8
                    Funds Disbursed for New York
                    City Department of Education
                    Telecommunication Services
  17     A06H0002   Review of Project GRAD USA’s         7/21/2008    OCFO          11
                    Administration of Fund for the
                    Improvement of Education Grants
  18     A02G0002   Audit of New York State              11/3/2006    OESE          8
                    Education Department’s Reading
                    First Program
  19     A06E0008   Audit of the Title I Funds           2/16/2005    OESE          7
                    Administered by the Orleans
                    Parish School Board
  20     A09J0004   Colorado Department of               2/26/2010    OESE          5
                    Education’s Use of Federal Funds
                    for State Employee Personnel
                    Costs
  21     A09D0018   Charter Schools’ Access to Title I   3/29/2004    OESE          12
                    and IDEA, Part B Funds in the
                    State of California
  22     A09G0020   Arizona Department of                3/26/2007    OESE          11
                    Education’s Oversight of the
                    ESEA, Title I, Part A
                    Comparability of Services
                    Requirement
           Audit
          Control                                           Report               Number of
Number    Number               Report Title               Issue Date   PO     Recommendations
  23     A02D0014   Puerto Rico Department of             3/30/2004    OESE         9
                    Education’s Title I Expenditures
                    for the Period, July 1, 2002 to
                    December 31, 2002
  24     A02E0031   Wyandanch Union Free School           9/14/2005    OESE         8
                    District’s Elementary and
                    Secondary Education Act Title I,
                    Part A and Title II Non-Salary
                    Expenditures
  25     A05G0033   Illinois State Board of Education’s    6/7/2007    OESE         8
                    Compliance with the Title I, Part
                    A, Comparability of Services
                    Requirement
  26     A06G0009   Audit of the Hurricane Education      9/18/2007    OESE         4
                    Recovery Act, Temporary
                    Emergency Impact Aid for
                    Displaced Students Requirements
                    at the Texas Education Agency
                    and Applicable Local Education
                    Agencies
  27     A02B0012   Puerto Rico Department of             9/28/2001    OESE         10
                    Education Did Not Administer
                    Properly Title I Contracts with
                    National School Services of Puerto
                    Rico for the 1999/2000 and
                    2000/2001 School Years
  28     A01A0004   Puerto Rico Department of             3/28/2001    OESE         9
                    Education Did Not Administer
                    Properly a $9,700,000 Contract
                    with National School Services of
                    Puerto Rico
  29     A06G0010   Louisiana Department of               9/21/2007    OESE         4
                    Education’s Compliance with
                    Hurricane Education Recovery
                    Act, Temporary Emergency
                    Impact Aid for Displaced Students
                    Requirements
  30     A04G0015   Audit of Georgia Department of        10/30/2007   OESE         9
                    Education’s Emergency Impact
                    Aid Program Controls and
                    Compliance
  31     A02C0012   The Virgin Islands Department of      9/30/2003    OESE         18
                    Education Did Not Effectively
                    Manage Its Federal Education
                    Funds
                                    OCFO Response to the Draft Report                                  Attachment 4

                           UNITED STATES DEPARTMENT OF EDUCATION
                                      OFFICE O F THE CHIEF FINANCIAL OFFICER




May 25,2016



Patrick J. Howard
Assistant Inspector General for Audit
Office of the Inspector General
550 12'h Street, SW
Washington, D.C. 20202

Dear Mr. Howard:

We appreciate the opportunity to respond to your draft report titled Audit of the Department 's
Follow-up Process for External Audits. We take the responsibility of audit follow-up, as directed
by OMB Circular A-50, very seriously and, as a result, the Post Audit Group (PAG) within the
Office of the Chief Financial Officer (OCFO) has helped focus the Department' s attention and
resources on following up on both Single Audits and ED-OIG external audit reports. Audit
follow-up has been incorporated into the Department's Strategic Plan and Organizational
Performance Review processes. Over the last few years priority has been given to the timely
resolution of external audits. For example, between FY 2012-2015, the Department reduced the
percentage of overdue external audits from 57% to 20%, far exceeding our target of 43%.
However, we realize that further improvements are needed, especially with respect to ensuring
that Action Officials have appropriate audit follow-up systems in place and that they are closing
audits more timely.

The Department has begun work strengthening other aspects of audit follow-up including
recordkeeping and identifying the root causes of repeat findings. We concur with
recommendations 1.1 - 1.6. We intend to more vigorously review and assist offices to ensure
timely closure and maintenance of effective documentation of both Single Audit findings and
findings identified in ED-OIG external audits agencywide.

We agree with the need to strengthen the audit closure process, but we non-concur with
recommendation 1.7, which states: ' Modify AARTS so that PAG staff are the only individuals
authorized to close audits in the system after the issuance of a closure memorandum.' We believe
implementing this recommendation would disassociate accountability and responsibility that
Action Officials currently have to ensure that the grantee takes appropriate corrective action and
also to close out actions when they are deemed completed. Additionally, we are not aware of
                                      550 12th St. S.W., WASHINGTON, DC 20202
                                                      www.ed.gov
   The Department of Education's mission is to prom ote student achievement and preparation for g lobal competitiveness
                             by fostering educational excellence and ens uring equal access.
Page 2 - Pat Howard


any instances where a POC actually closed an audit prior to submitting a request for closure to
and receiving approval from PAG. We believe that additional oversight, training, and support
provided by OCFO will be sufficient to strengthen internal controls over audit closure.

We appreciate the information contained in this report, and look forward to making
improvements to our systems for ensuring effective and compliant audit follow-up at the
Department of Education.


                                     Sincerely,


                                     s~~
                                     Tim Soltis
                                     Deputy ChiefFinancial Officer, Delegated to Perform the
                                       Duties and Functions of the Chief Financial Officer