oversight

Followup Process for External Audits in Federal Student Aid

Published by the Department of Education, Office of Inspector General on 2015-06-17.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                 UNITED STATES DEPARTMENT OF EDUCATION
                                               OFFICE OF INSPECTOR GENERAL

                                                                                                                   AUDIT SERVICES




                                                            June 17, 2015
                                                                                                    Control Number
                                                                                                    ED-OIG/A19P0001

James W. Runcie
Chief Operating Officer
Federal Student Aid
U.S. Department of Education
830 First Street, N.E.
Washington, DC 20202

Dear Mr. Runcie:

This Final Audit Report, titled Audit of the Followup Process for External Audits in Federal
Student Aid, presents the results of our audit. This audit was part of a review of the audit
followup process for Office of Inspector General (OIG) external audits being performed in
several principal offices. The objective of the audit was to evaluate the effectiveness of the
Department of Education’s (Department) process to ensure that external auditees implement
corrective actions as a result of OIG audits. A summary report will be provided to the Chief
Financial Officer, the Department’s audit followup official, upon completion of the audits in
individual principal offices.



                                                      BACKGROUND


Office of Management and Budget (OMB) Circular A-50, “Audit Followup,” provides the
requirements for establishing systems to assure prompt and proper resolution and
implementation of audit recommendations. The Circular provides that audit followup is an
integral part of good management, a shared responsibility of agency management officials and
auditors, and management’s corrective action on resolved findings and recommendations is
essential to improving the Government’s effectiveness and efficiency. Agencies are responsible
for establishing systems that provide a complete record of actions taken on findings and
recommendations to assure that audit recommendations are promptly and properly resolved.

The Department established the “Handbook for the Post Audit Process” (OCFO-01), dated
June 22, 2007 (Handbook), to provide policies and procedures for the resolution and followup
of audits of Department programs, activities, and functions. The audit resolution process
begins with the issuance of a final audit report. External audits are of external entities that
receive funding from the Department, such as State educational agencies, local educational
agencies, institutions of higher education, contractors, and nonprofit organizations. External
OIG audit reports generally include recommendations for Department management to require

 The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational
                                                   excellence and ensuring equal access.
Final Audit Report
ED-OIG/A19P0001                                                                        Page 2 of 11

the external entity to take corrective action. These recommendations may be either monetary,
which recommend that the entity return funds to the Department, or nonmonetary, which
recommend that the entity improve operations or internal controls.

An external audit is considered resolved when the Department issues a program determination
letter to the external entity that is agreed to by the OIG. Upon resolution, the Department is
responsible for followup to ensure that corrective actions are actually taken. An audit is
considered closed when the Department ensures that all corrective actions have been
implemented including funds repaid or settlement made.

The Handbook provides that Assistant Secretaries (or equivalent office head 1) with
cooperative audit resolution or related responsibilities must ensure that the overall
cooperative audit resolution process operates efficiently and consistently. An Assistant
Secretary may delegate in writing part or all of the cooperative audit resolution
responsibilities to an Action Official(s) (AO) within the Assistant Secretary's
organization.

The Handbook notes specific responsibilities of the Assistant Secretaries or designated AOs that
include:

       •   Determining the action to be taken and the financial adjustments to be made in resolving
           findings in audit reports concerning respective program areas of responsibility,
       •   Monitoring auditee actions in order to ensure implementation of recommendations
           sustained in program determinations, and
       •   Maintaining formal, documented systems of cooperative audit resolution and followup.

The Handbook specifies that accurate records must be kept of all audit followup activities,
including all correspondence, documentation and analysis of documentation. The Department’s
Audit Accountability and Resolution Tracking System (AARTS) is a web-based application
designed to assist Department management with audit followup and closure.

Within Federal Student Aid (FSA), the Program Compliance group is responsible for the
resolution and followup of external OIG audits. Specifically, Program Compliance’s School
Eligibility Service Group is responsible for audits related to the oversight of schools that
participate in the Title IV student financial assistance programs, and the Financial Institution
Oversight Service Group is responsible for audits related to the oversight of guaranty agencies,
lenders, and servicers participating in Federal student loan programs.




1
    In FSA, the equivalent office head is the Chief Operating Officer.
Final Audit Report
ED-OIG/A19P0001                                                                                  Page 3 of 11



                                           AUDIT RESULTS


We found that FSA’s audit followup process was not always effective. Specifically, we found
that FSA did not close audits timely and did not adequately maintain documentation of audit
followup activities. Between October 1, 2008 and September 30, 2013, we noted that while FSA
had resolved a total of 36 external OIG audit reports during this time period, only 1 audit had
been closed. As of March 2014, the start of our audit fieldwork, we noted that 25 of these
36 audits (69 percent) had been in resolved status for more than 2 years; 9 of the 25 audits
(36 percent) had been in resolved status for over 4 years. The total of the monetary
recommendations associated with the 36 resolved audits was $1,307,921,789.

Further, we found that FSA did not adequately maintain and was not always able to provide
documentation that showed requested corrective actions were completed or were being
monitored for completion. We reviewed audit followup activities for a judgmental sample of 10
out of the 36 external OIG audits of FSA programs in our review. Of the 10 audits in our
sample, 1 had been closed prior to our audit; 6 were closed subsequent to the start of our audit
fieldwork. For these 7 audits, FSA determined that 26 recommendations required corrective
actions, to include $20.1 million in monetary corrective actions. FSA was initially unable to
provide documentation to support the completion of corrective actions for 21 out of the 26
recommendations (81 percent) for which corrective actions were required. FSA subsequently
provided documentation that supported completion of corrective actions for 12 of these
recommendations. FSA was ultimately unable to provide support that corrective action was
taken for the remaining 9 recommendations (43 percent), to include $503,927 in monetary
corrective actions. Additionally, for two of the three audits that were not yet closed, we were not
provided with documentation to support that any followup activities were taking place since the
audits were resolved. Resolution dates for these audits were August 2010 and March 2011.

Based upon the above, we determined that FSA did not sufficiently implement the corrective
actions it reported taking in response to the recommendations made in our prior audit of FSA’s
external audit followup process. 2

Not ensuring that corrective actions are taken as quickly as possible allows identified
deficiencies to continue to exist. By not obtaining or maintaining appropriate documentation to
show requested corrective actions were completed, FSA did not have assurance that identified
deficiencies were corrected. As such, the risk remains that related programs are not effectively
managed and funds are not being used as intended.

FSA stated that it disagreed in part with the finding but agreed with the recommendations and
noted significant actions that it has taken or plans to undertake to address them. FSA disagreed
that it did not have an effective audit followup process, noting that it was able to close a
significant number of audits within the last few months because staff had conducted the
necessary followup and obtained documentation of completion of corrective actions and
repayment of liabilities.

2
    “Audit Followup Process for External Audits in Federal Student Aid,” ED-OIG/A19E0002, September 16, 2004.
Final Audit Report
ED-OIG/A19P0001                                                                                   Page 4 of 11

FSA’s comments and our response to those comments are summarized at the end of the finding.
FSA also provided one technical comment that we considered and addressed, as appropriate, in
the body of the report. The full text of FSA’s response is included as Attachment 3 to this report.

FINDING NO. 1 – Federal Student Aid’s Audit Followup Process Was Not Always
                Effective

We found that improvements are needed in FSA’s audit followup process. Specifically, we
found that FSA did not close audits timely and did not adequately maintain documentation of
audit followup activities.

Timeliness of Audit Closure

We reviewed the Department’s AARTS data to determine the number of external OIG audits that
were closed between October 1, 2008 and September 30, 2013. We noted that while FSA had
resolved a total of 36 external OIG audit reports during this time period, only 1 audit had been
closed. As of March 2014, the start of our fieldwork, we noted that 25 of these 36 audits
(69 percent) had been in resolved status for more than 2 years; 9 of the 25 audits (36 percent) had
been in resolved status for over 4 years. The total of the monetary recommendations associated
with the 36 resolved audits was $1,307,921,789 as depicted in Table 1.

    Table 1. Count and Percentage of FSA Resolved Audits by Number of Elapsed Years as of
                                       March 19, 2014

     Elapsed Years        Number of          Percentage of       Total of Monetary          Percentage of
                           Audits               Audits           Recommendations              Monetary
                                                                                          Recommendations

More than 4 years                 9               25%              $11,753,526                     1%
3 to 4 years                      8               22%              $13,200,247                     1%
2 to 3 years                      8               22%              $38,359,599                     3%
1 to 2 years                      4               11%              $26,067,548                     2%
Less than 1 year                  7               19%             $1,218,540,869                  93% 3
       Total                     36                               $1,307,921,789

As of January 7, 2015, 9 of the 36 audits noted above are now listed as closed in AARTS,
including 6 of the 9 resolved audits (67 percent) that we selected for further review as part of this
audit. FSA stated that 2 additional audits have been submitted to the Office of the Chief
Financial Officer (OCFO) for closure review and approval.




3
 The audit Special Allowance Payments to Nelnet for Loans Funded by Tax-Exempt Obligations
(ED-OIG/A07F0017) represents $1,160,000,000 (95 percent) of the $1,218,540,869 total for audits that had an
elapsed time of under a year.
Final Audit Report
ED-OIG/A19P0001                                                                      Page 5 of 11

Documentation of Audit Followup Activities

FSA did not adequately maintain and was not always able to provide documentation that showed
requested corrective actions were completed or were being monitored for completion. We
reviewed audit followup activities for 10 external OIG audits of FSA programs. Of the 10 audits
in our sample, 1 had been closed prior to our audit; 6 were closed subsequent to the start of our
audit fieldwork. For these 7 audits, FSA determined that 26 recommendations required
corrective actions, to include $20.1 million in monetary corrective actions. FSA was initially
unable to provide documentation to support the completion of corrective actions for 21 out of 26
recommendations (81 percent) for which corrective actions were required. FSA subsequently
provided documentation that supported completion of corrective actions for 5 of these
recommendations. FSA also noted that one of the audits was closed based on the terms of a
settlement agreement with the auditee. We found that the agreement addressed only the required
actions for the monetary recommendations contained in the Final Audit Determination Letter
(FAD); it did not address the seven nonmonetary recommendations in the OIG audit report for
which corrective action was required. The agreement noted that it constituted a complete and
final resolution of all findings and matters covered in the FAD and audit report. There was no
exception in the agreement for followup on nonmonetary corrective actions once the settlement
agreement was signed. The settlement agreement officially closed the FAD and the audit report.

FSA was ultimately unable to provide support that corrective actions were taken for the
remaining 9 recommendations, to include $503,927 in monetary corrective actions.
Additionally, for two of the three audits that were not yet closed, FSA was not able to provide
documentation to support that any followup activities were taking place since the audits were
resolved. Resolution dates for these audits were August 2010 and March 2011.

OMB Circular A-50, “Audit Followup,” states that each agency shall establish systems to assure
the prompt and proper resolution and implementation of audit recommendations. These systems
shall provide for a complete record of action taken on both monetary and nonmonetary findings
and recommendations. It further states that corrective action is essential to improving the
effectiveness and efficiency of Government operations and should proceed as rapidly as possible.

The Department’s “Audit Resolution and Followup” (OCFO 1-106), dated January 29, 2013,
states that principal offices are subject to OMB A-50 and are responsible for conducting audit
followup responsibilities for external audits, including monitoring, ensuring implementation of
corrective actions, and requesting audit closure.

The Department’s Handbook, Section III, Chapter 5, Part B, places primary responsibility for
following up on nonmonetary determinations with AOs, who must have systems in place to
ensure that recommended corrective actions are implemented by auditees. Primary responsibility
for following up on monetary determinations rests with OCFO but with assistance from AOs.
The AO is responsible for maintaining an effective system that is documented with written
procedures for following up on all corrective actions. The system must include procedures for
ensuring that auditees respond to requests for documentation used to determine whether
appropriate corrective action has been taken, analyzing documentation received from auditees to
determine whether corrective action has been taken, and following up with auditees until all
appropriate corrective action has been taken.
Final Audit Report
ED-OIG/A19P0001                                                                              Page 6 of 11

Further, the Handbook requires that an official file folder be established for each audit report that
contains accurate records of all audit followup activities including all correspondence,
documentation from the auditee substantiating the corrective action taken, results of monitoring
visits, and relevant information from the next year’s audit that reports whether appropriate
corrective action was taken on a prior year finding.

Reasons for Ineffective Audit Followup Process

Audit Closure

In a meeting in May 2014, the start of our fieldwork in FSA, FSA officials stated that over half
of the 36 audits we identified above in March 2014 had since been closed. FSA’s audit liaison
officer (ALO) for external audits noted that many of the audits were initially reported as closed
on the date of issuance of the FAD, stating that AARTS did not initially have a way to
distinguish between the resolution and closure stages. She stated that as a result of an
enhancement to AARTS that allowed for a clearer distinction between these stages, audits that
had previously been recorded as closed were automatically reset to resolved status. She noted
that the audit log in AARTS would show the date the audit was originally closed and added that
she re-closed these audits in AARTS more than a month ago. We subsequently reviewed the
audit log in AARTS for each of the 36 audits and noted that only one had been previously
recorded as closed in AARTS and reset to resolved status.

Additionally, in a prior OIG audit performed of the Department’s external audit followup
process, 4 we noted that when AARTS was implemented in July 2003 it had the ability to
distinguish between resolved and closed stages of an audit, unlike the prior audit tracking
system, and that the AARTS user guide clearly defined what was meant by “closed” status. We
did recommend that the OCFO develop clearer guidance on the status of audits that were under
appeal, in collection, or awaiting reevaluation to ensure they were properly reflected as resolved
and not closed. OCFO subsequently met with the ALOs from the Department’s principal offices
and identified 13 audits meeting these criteria that were in “closed” status that needed to be
switched back to “resolved” status. The status of these audits was changed by the AARTS
contractor on July 31, 2007. We noted that none of the 36 FSA audit reports noted above appear
to have been subject to the July 2007 change.

During the exit conference, FSA Program Compliance officials stated the issue of timeliness was
likely more related to administrative weaknesses in the closure process, rather than a lack of
timeliness in the auditee taking corrective action and FSA verifying that corrective action was
taken. Specifically, FSA stated that many of the selected audits were closed in terms of FSA
verifying that all corrective actions have been taken by the entity. However, FSA acknowledged
there were weaknesses in its process in terms of documenting and officially closing these audits
in AARTS.




4
 “Audit of the Department of Education’s Followup Process for External Audits,” ED-OIG/A19D0007,
March 31, 2005.
Final Audit Report
ED-OIG/A19P0001                                                                        Page 7 of 11

Maintenance of Documentation

During initial meetings with FSA Program Compliance officials, we were told that FSA used its
Electronic Records Management System (ERM) to maintain audit followup and closure
documentation. The ALO for external audits stated that once a FAD has been issued, the audit
report, FAD, and Audit Clearance Document are scanned into ERM. All related followup and
closure documentation is also scanned into ERM. Our review of ERM for documentation
maintained for the 10 audits included in our sample revealed that this was not the case. We
noted that the audit report and FAD were only maintained in ERM for three of the audits. We
found no other related documentation for any of the 10 audits, to include the audits that were
closed prior to the start of or during our audit. For the audit closed prior to our audit, the ALO
stated that the audit closure documentation was at her desk and was not yet in ERM, even though
the audit had been closed in AARTS in October 2010, almost 4 years before our May 2014
meeting with FSA. For the more recently closed audits, the Director of FSA’s Financial
Institution Oversight Service Group told us that she maintains applicable documentation on a
local shared drive and not in ERM. We learned that additional documentation related to the
auditees overseen by FSA’s School Eligibility Service Group is maintained by the assigned
regional case team in FSA’s Postsecondary Education Participants System.

We further noted that ERM did not allow for documentation related to specific audits to be easily
identified. While we were able to find documentation related to specific entities, there was no
way to identify documents related to a specific audit of that entity. The number of documents
associated with the 10 auditees included in our review ranged from 1 to 178, with an average of
65 documents. We noted that a field in ERM that would allow for the input of an associated
audit control number for a document was largely left blank or not used by FSA. When asked
how we could locate applicable audit followup documents, the ALO for external audits indicated
she was able to locate documents related to audit followup and closure of external OIG audits in
the ERM because she is familiar with the electronic files. However, during the ALO’s
walkthrough of the ERM with the audit team, we noted that she had considerable difficulty
finding applicable documents.

Policies and Procedures

We also noted that FSA did not follow the Department’s related audit followup policies and
procedures, its own internal policies and procedures were inadequate, and there appeared to be a
general lack of understanding of requirements. FSA Program Compliance officials claimed that
related Department policies did not apply to their office, stating the belief that the policies only
applied to General Education Provisions Act (GEPA) audits. They also stated that since FSA
uses an electronic records management system for maintaining documentation, the file
documentation requirements noted in the Department’s policy do not work. We would note that
the Department’s policies state that while the enforcement provisions of GEPA do not apply to
audits of FSA programs, these audits are still fully subject to OMB A-50 and the Department’s
process for complying with audit tracking and resolution in accordance with OMB A-50, which
is implemented by the Department’s Handbook and AARTS. During the exit conference, FSA
acknowledged that they are required to follow the Department’s policies and procedures for audit
followup and closure.
Final Audit Report
ED-OIG/A19P0001                                                                                      Page 8 of 11

Our review of FSA’s internal policies and procedures, dated August 8, 2008 and revised on
November 7, 2013, noted that the procedures only addressed audit resolution and not audit
followup activities, to include maintenance of audit followup documentation. When asked
whether followup activities were conducted, an FSA official asked what we meant by followup
activities. FSA subsequently stated that they were working on updating their procedures. We
requested a draft copy of the procedures and were told they were undergoing review and were
not able to be provided to us. During the exit conference, FSA stated that they put a hold on
developing the draft procedures until they had a better understanding of the weaknesses in the
audit followup and closure process as identified by this audit.

Prior Audit Corrective Actions

Based on the above, we have determined that FSA did not sufficiently implement the corrective
actions it reported taking in response to the recommendations made in our prior audit of FSA’s
audit followup process. 5 In response to the prior audit, FSA specifically stated that in July 2004
it had implemented procedures for OIG audits that required FSA audit resolution staff to obtain
and maintain adequate documentation to support the completion of corrective actions in
accordance with the Department’s external audit documentation and file requirements. It also
stated it had implemented procedures as of September 2004 for establishing audit resolution
files, in compliance with guidance established by OMB and the Department. As part of our
current audit, we requested support for the corrective actions taken in response to the prior audit
report. FSA provided the policies and procedures noted above in response to the inquiry,
however we noted they did not address the specific weaknesses noted in the audit followup
activities, to include maintenance of audit followup documentation.

Additionally, our prior audit report noted that FSA was relying on single audit reports 6 that did
not adequately address and provide assurance that corrective actions were completed. In its
response to the prior audit, FSA stated that as of April 9, 2004, it was no longer using single
audits for this purpose. FSA stated it had developed and implemented new procedures that
required audit resolution staff to request documentation directly from the auditee to support that
corrective actions have been completed. However, in recent discussions with the ALO for
external audits, we were informed that FSA is still relying on single audits to determine whether
corrective actions were implemented. For the one audit we reviewed that was closed prior to the
start of our audit, the single audit was provided as supporting documentation for implementation
of the corrective actions. While the single audit did specifically mention the OIG audit report, it
did not specifically address whether required funds were returned to the lender and therefore did
not provide appropriate support of completion of corrective actions.

As stated in the Department’s Handbook, “The effectiveness of the post audit process depends
upon taking appropriate, timely action to resolve audit findings and their underlying causes, as
well as providing an effective system for audit close-out, record maintenance, and followup on
corrective actions.” Not ensuring that corrective actions are taken as quickly as possible allows
identified deficiencies to continue to exist. By not obtaining or maintaining appropriate
5
 See footnote 2 on page 3.
6
 Single audits require comprehensive testing of compliance and internal controls over federal programs for entities
expending annual federal assistance equal to or in excess of $500,000 ($750,000 for fiscal years beginning on or
after December 26, 2014). These audits may be performed by an independent public accountant selected by the
entity.
Final Audit Report
ED-OIG/A19P0001                                                                          Page 9 of 11

documentation to show requested corrective actions were completed, FSA did not have
assurance that identified deficiencies were corrected. As such, the risk remains that related
programs are not effectively managed and funds are not being used as intended.

Recommendations

We recommend that the Chief Operating Officer for FSA:

1.1    Ensure that staff obtain and maintain adequate documentation to support completion of
       corrective actions and audit followup activities, in accordance with the Department’s
       external audit documentation and file requirements.

1.2    Ensure that staff establish an official file for each audit report that contains accurate
       records of all related followup activities, in compliance with guidance established by
       OMB and the Department.

1.3    Ensure that staff are following up with auditees until all appropriate corrective actions
       have been taken and that audits are being closed timely.

1.4    Update internal procedures to specifically identify required audit followup and closure
       activities, to include procedures for followup with auditees on corrective action status,
       maintenance of appropriate supporting documentation of corrective action
       implementation, ensuring that OIG audit areas and related corrective actions are reviewed
       and commented on in subsequent single or compliance audit reports if these reports are
       used by FSA staff to gain assurance that corrective actions were completed, and ensuring
       that settlement agreements adequately address all actions that need to be taken by an
       auditee to address noted deficiencies.

1.5    Provide training for all FSA staff involved in audit followup activities. Ensure training
       includes a review of OMB and Department requirements, individual responsibilities, and
       differences between audit resolution and followup.

FSA Comments

FSA stated that it disagreed in part with the finding but agreed with the recommendations and
noted significant actions that it has taken or plans to undertake to address these
recommendations. FSA disagreed that it did not have an effective audit followup process, noting
that it was able to close a significant number of audits in the last few months because staff had
conducted the necessary followup and obtained documentation of completion of corrective
actions and repayment of liabilities. FSA stated that as a result of our audit it has restructured its
followup process for external audits and that the restructuring will ensure that staff obtain,
maintain, and submit documentation to support completion of corrective actions and audit
followup activities. FSA also plans to provide training for all staff involved in audit followup
activities that will include a review of applicable OMB and Department requirements, individual
responsibilities, and use of FSA’s document management system. Lastly, FSA stated that it will
update its internal procedures to specifically identify required audit followup and closure
activities as identified in the related recommendation.
Final Audit Report
ED-OIG/A19P0001                                                                     Page 10 of 11

OIG Response

We acknowledge the efforts FSA has taken since the start of our audit to close outstanding
audits. However we do not agree that the action of closing an audit alone provides evidence of
an effective audit followup process. As noted in the finding, we found that FSA was unable to
provide support that corrective actions were taken for 9 of the 26 recommendations (35 percent)
requiring corrective action even though the audits containing these recommendations had been
closed subsequent to the start of our audit fieldwork.

After considering FSA’s comments, we have not made any changes to the finding or related
recommendations.



                  OBJECTIVE, SCOPE, AND METHODOLOGY


The objective of our audit was to evaluate the effectiveness of the Department’s process to
ensure that external auditees implement corrective actions as a result of OIG audits. To
accomplish our objective, we gained an understanding of the Department’s and FSA’s followup
and closure processes for external OIG audits. We reviewed applicable laws and regulations and
Department and FSA policies and procedures including OMB Circular A-50, the Department’s
Handbook for the Post Audit Process, and FSA’s Compliance Audit Procedures. We also
reviewed prior OIG audit reports relevant to our audit objective. We conducted interviews with
FSA staff responsible for following up and closing corrective actions for the audits selected. We
reviewed documentation provided by FSA staff to support the corrective actions taken for the
recommendations included in our review as identified in the FAD.

The scope of our audit included OIG audits of FSA programs at external entities with monetary
or nonmonetary findings that were reported by the Department’s AARTS and the OIG’s Audit
Tracking System (ATS) as closed during the period October 1, 2008 to September 30, 2013.
Because there was only one audit identified as closed during this period, we expanded our scope
to also include audits resolved during the period October 1, 2008 to September 30, 2013 but not
closed.

Overall, we identified a total of 1 closed FSA audit and 36 resolved FSA audits in the universe.
In addition to the one closed audit, we judgmentally selected a sample of nine resolved audits for
our review. The nine audits consisted of all audits with monetary findings of $5 million or more.
We excluded any internal and non-sustained recommendations included in these audits from our
review. Overall, the 10 audits in our review included a total of 68 recommendations. A
complete listing of the selected audits is included as Attachment 2 to this report. Because there
is no assurance that the judgmental sample used in this audit is representative of the respective
universe, the results should not be projected over the unsampled audits.

We relied on computer-processed data obtained from the Department’s AARTS and OIG’s ATS
to identify OIG external audits resolved and closed during the scope period. We reconciled the
data in these two systems to ensure that we captured all audits resolved and closed during this
Final Audit Report
ED-OIG/A19P0001                                                                     Page 11 of 11

period. Based on this assessment, we determined that the computer-processed data were
sufficiently reliable for the purpose of this audit.

We conducted fieldwork at Department offices in Washington, DC, during the period
February 2014 through November 2014. We provided our audit results to Department officials
during an exit conference conducted on November 20, 2014.

We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objective.



                           ADMINISTRATIVE MATTERS


Corrective actions proposed (resolution phase) and implemented (closure phase) by your office
will be monitored and tracked through the Department’s Audit Accountability and Resolution
Tracking System. Department policy requires that you develop a final corrective action plan
(CAP) for our review in the automated system within 30 days of the issuance of this report. The
CAP should set forth the specific action items, and targeted completion dates, necessary to
implement final corrective actions on the finding and recommendations contained in this final
audit report.

In accordance with the Inspector General Act of 1978, as amended, the OIG is required to report
to Congress twice a year on the audits that remain unresolved after 6 months from the date of
issuance.

In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the OIG
are available to members of the press and general public to the extent information contained
therein is not subject to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have any questions, please
call Michele Weaver-Dugan at (202) 245-6941.

                                            Sincerely,

                                            Patrick J. Howard /s/
                                            Assistant Inspector General for Audit
                                                                       Attachment 1

             Acronyms/Abbreviations/Short Forms Used in this Report

AARTS            Audit Accountability and Resolution Tracking System

ALO              Audit Liaison Officer

AO               Action Official

ATS              Audit Tracking System

CAP              Corrective Action Plan

Department       U.S. Department of Education

ERM              Electronic Records Management System

FAD              Final Audit Determination Letter

FSA              Federal Student Aid

GEPA             General Education Provisions Act

Handbook         Handbook for the Post Audit Process

OCFO             Office of the Chief Financial Officer

OMB              Office of Management and Budget

OIG              Office of Inspector General
                                                                            Attachment 2

                        FSA Audits Included in This Review

  Audit
 Control
Number                               Audit Report Title
A07F0017   Special Allowance Payments to Nelnet for Loans Funded by Tax-Exempt
           Obligations
A02H0008   Touro College’s Title IV, Higher Education Act Programs, Institutional and
           Program Eligibility
A05I0011   Special Allowance Payments to the Kentucky Higher Education Student Loan
           Corporation for Loans Made or Acquired with the Proceeds of Tax-Exempt
           Obligations
A05E0017   Special Allowance Payments to New Mexico Educational Assistance Foundation
           for Loans Funded by Tax-Exempt Obligations
A04B0019   Advanced Career Training Institute’s Administration of the Title IV Higher
           Education Act Programs
A03G0014   Special Allowance Payments to the Pennsylvania Higher Education Assistance
           Agency for Loans Funded by Tax-Exempt Obligations
A09H0017   Fifth Third Bank’s Eligible Lender Trustee Agreements Compliance with Lender
           Provisions of the Higher Education Act and Monitoring of Entities With Which
           It Has Agreements
A05C0014   Educational Credit Management Corporation's Administration of the Federal
           Family Education Loan Program Federal and Operating Funds
A03H0009   Star Technical Institute's Upper Darby School's Compliance with the 90 Percent
           Rule
A06H0010   Eagle Gate College’s Administration of Title IV Student Financial Assistance
           Programs
                                                                                           Attachment 3



Federa I Student A· d
An OFFICE of the U.S. OEPARTMENT ol EDUCATION
                                                PROUD SPONSOR of
                                                the AMERICAN MIND"




        MEMORANDUM


        DATE:          MAY    2 0 2015


        TO:               Ms. Michele Weaver-Dugan
                          Director, Operations lnternal Audit Team


        FROM:
                          Office of Inspector General

                          James W. Runcie
                          Chief Operating Officer
                                                    ().,,
                                                     "j' ''
                                                           ,~     c_,v~
                                                            v \ . . / ._./   ·




        SUB.TE CT:        Response to Draft Audit Report:
                          Audit of the r:ollowup Process fo r Externa l Audits in Federal Student Aid
                          Control No. ED-OIG/A l 9POOOI


        Thank you for the opportun ity to comment on the Office oflnspector General ' s (OIG)
        draft audit report, Audit ofthe Followup Process.for External Audits in Federal Student
        Aid, dated April I 3, 20 15. The objective of the audit was to evaluate the effectiveness of
        the Department of Education 's (ED) process to ensure that external auditees implement
        corrective actions as a result of OIG audits .

        As a result of the audit, Federal Student Aid ' s (FSA) Program Compliance (PC) office
        has restructured its followup process for external audits effective January 5, 20 I 5. At
        that time, there were 29 resolved audits. Since then, PC has closed 23 of these audits,
        which is 79% of all resolved audits. In addition, FSA has submitted documentation to
        close an additional three aud its. Note that, three other audits cannot be closed at this time
        as one has an 8-year prom issory note that must be paid, one is under appeal to the
        Secretary's office, and one is under settlement discussions.

        FSA 's comments and responses to the one ( I ) finding and five (5) recommendations in
        OJG's draft audit report fo llows.

        FINDING NO. 1 - Federal Student Aid's Audit Followup Process Was Not Always
        Effective

        FSA disagrees in part with this finding. FSA's follow-up process was effecti ve because
        staff had conducted the necessary fo llow-up and obta ined documentation of completion
        of corrective actions and repayment of liabilities, as demonstrated by the closure of a
        significant number of audits in a short period of time as noted above. However, the

                                      830 First St. N.E., Washington. DC 20202
                                                  StudentA1d.gov
audits were not closed timely in the Audit Accountability and Reso lution Tracking
System (AARTS). With the restructured followup process for external audits, FSA will
ensure that the audits are also closed timely in AARTS.

RECOMMENDATI ON 1.1 - Ensure that staff obtain and maintain adequate
documentation to support completion of corrective actions and audit followup activities,
in accordance with the Department's external audit documentation and fil e requirements.

RESPONSE: Al though FSA agrees with this recommendation, FSA was able to close a
signi fi cant number of audits in a short period of time as noted above because staff had
conducted the necessary followup and obtained documentation of completion of
corrective actions and repayment of liabilities. Hovvever, the audits were not c losed
timely in /\ARTS. With the restructured fo llowup process for external audits, FSA will
ensure that staff obtain , maintain, and subm it documentation to support completion of
corrective actions and audit followup activities.

RECOMMENDATION 1.2 - Ensure that staff establish an official file for each audit
report that contains accurate records of alI related followup activities, in compliance with
guidance established by OMB and the Department.

RESPONSE: FSA agrees with this recommendation and wi ll conduct training on PC's
document management system to ensure that staff establish and maintain an official file
for each audit report that contains accurate records of all related followup activities.

RECOMMENDATION 1.3-Ensure that staff are following up with auditees until all
appropriate corrective actions have been taken and that audits are being closed timely.

RESPONSE: FSA agrees wi th this recommendation and we will conduct refresher
training to ensure that staff followup with auditees until a ll appropriate corrective actions
have been taken and that audits are being closed timely.

RECOMMENDATION 1.4 - Update internal procedures to specifically identify
required audit followup and closure activities, to include procedures for followup with
auditees on corrective action status, maintenance of appropriate supporting
documentation of corrective action implementation, ensuring that OIG audit areas and
related corrective actions are reviewed and commented on in subsequent single or
compliance audit reports if these reports arc used by FSA staff to gain assurance that
corrective actions were completed, and ensuring that settlement agreements adequately
address all actions that need to be taken by an auditee to address noted deficiencies.

RESPONSE: FSA agrees with this recommendation and will update internal procedures
to specifica lly identify required audit followup and closure activities, to include
procedures for fo ll owup with auditees on corrective action status, maintenance of
appropriate supporting documentation of corrective action implementation, ensuring that
OIG audit areas and related corrective actions are reviewed and commented on in
subsequent single or compliance audit reports if these reports are used to gain assurance
                                                                                             2
that corrective actions were completed, and ensuring that settlement agreements
adequately address all actions that need to be taken by an auditee to address noted
deficiencies.

RECOMMENDATION 1.5 - Provide training for all FSA staff involved in audit
followup activities. Ensure training includes a review of OMB and Department
requirements, individual responsibilities, and differences between audit reso lution and
fo llowup.

RESPONSE: FSA agrees with this recommendation and we will provide train ing for all
FSA staff involved in audit followup activities. Training wi ll include a review of OMB
and ED requirements, individual responsibilities, and differences between audit
resolution and followup.

Again, thank you for the opportun ity to comment on the draft audit report. If you have
questions about the response, please let us know.




                                                                                           3