oversight

Federal Student Aid's Oversight and Monitoring of Guaranty Agencies, Lenders, and Servicers Needs Improvement

Published by the Department of Education, Office of Inspector General on 2009-04-29.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

Federal Student Aid’s Oversight and Monitoring of 

   Guaranty Agencies, Lenders, and Servicers

              Needs Improvement 





            FINAL AUDIT REPORT





         LANI EKO & COMPANY, CPAS, PLLC

                 ED-OIG/A20I0001

                    April 2009

        Statements that managerial practices need improvements, as well as other conclusions and
recommendations in this report, represent the opinions of the Office of Inspector General. Determinations
    of corrective action to be taken will be made by the appropriate Department of Education officials.

  In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the Office of
  Inspector General are available to members of the press and general public to the extent information
                       contained therein is not subject to exemptions in the Act.
                                       UNITED STATES DEPARTMENT OF EDUCATION
                                              OFFICE OF INSPECTOR GENERAL

                                                                                                                         Audit Services
                                                            April 29, 2009

MEMORANDUM

TO:	                 Matthew Yale
                     Deputy Chief of Staff

FROM:	               Keith West /s/
                     Assistant Inspector General for Audit

SUBJECT:	            Final Audit Report
                     Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                     Servicers Needs Improvement
                     Control Number ED-OIG/A20I0001

Attached is the subject final audit report that covers the results of the review of the appropriateness and
effectiveness of Federal Student Aid’s (FSA) internal control to ensure that guaranty agencies, lenders,
and servicers are performing in accordance with relevant laws, regulation and guidance for the period
from October 1, 2006, through March 31, 2008. We received FSA’s response and its draft corrective
action plan for each of the recommendations contained in the draft audit report.

Corrective actions proposed (resolution phase) and implemented (closure phase) by your office(s) will be
monitored and tracked through the Department’s Audit Accountability and Resolution Tracking System
(AARTS). ED policy requires that you develop a final corrective action plan (CAP) for our review in the
automated system within 30 days of the issuance of this report. The CAP should set forth the specific
action items, and targeted completion dates, necessary to implement final corrective actions on the
findings and recommendations contained in this final audit report.

In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector General is
required to report to Congress twice a year on the audits that remain unresolved after six months from the
date of issuance.

In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the Office of
Inspector General are available to members of the press and general public to the extent information
contained therein is not subject to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have any questions, please call me at
(202) 245-7041.


Enclosure

cc: James Manning, Acting Chief Operating Officer, FSA
    Marge White, Audit Liaison Officer, Internal Audits, FSA



 The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational
                                                   excellence and ensuring equal access.
                                              TABLE OF CONTENTS



                                                                                                                                 Page

EXECUTIVE SUMMARY ...........................................................................................................1


BACKGROUND ............................................................................................................................4


AUDIT RESULTS .........................................................................................................................6


FINDING NO. 1 –	                         Improvement Is Needed in the Control

                                         Environment for Oversight and Monitoring of the

                                         Guaranty Agencies, Lenders and Servicers.................................6


FINDING NO. 2 –	                         Improvement Is Needed in the FPE&O Risk

                                         Assessment Process ......................................................................15


FINDING NO. 3 –	                         Control Activities over Guaranty Agencies, 

                                         Lenders and Servicers Need Improvement ...............................19


FINDING NO. 4 –	                         FSA Lacked Written Procedures on Sharing

                                         Information Related to Policy Guidance and

                                         Program Reviews ........................................................................32


FINDING NO. 5 –	                         FSA’s Implementation of Corrective Actions ..........................35


OBJECTIVE, SCOPE, AND METHODOLOGY ....................................................................38



APPENDIX A 	                             Assessment of FSA's Corrective Actions Taken to Address
                                         OIG Recommendations in the Report Entitled, Review of
                                         Financial Partners' Monitoring and Oversight of Guaranty
                                         Agencies, Lenders, and Servicers, issued September 29, 2006

ATTACHMENT	                              Department Response to Draft Audit Report
Final Audit Report	                                                                 Page 1 of 39



                               EXECUTIVE SUMMARY



The objective of our audit was to evaluate the appropriateness and effectiveness of Federal
Student Aid (FSA) internal control to ensure that guaranty agencies, lenders and servicers are
performing in accordance with relevant laws, regulations and guidance. Our audit covered the
period from October 1, 2006, through March 31, 2008. During our audit, we identified internal
control weaknesses relating to all five of the Internal Control Standards – control environment,
risk assessment, control activities, information and communication, and monitoring as included
in the Government Accountability Office’s (GAO) Standards for Internal Control in the Federal
Government (Internal Control Standards).

Improvement Is Needed in the Control Environment for Oversight and Monitoring of the
Guaranty Agencies, Lenders and Servicers

The control environment is the organizational structure and culture created by management and
employees to sustain organizational support for effective internal control. Based on our audit,
we found:

   Improvement was needed in oversight of Federal Family Education Loan (FFEL) Program
    participants.
   Delegation of authority was not properly aligned with oversight and monitoring of guaranty
    agencies, lenders and servicers.
   Potential conflicts of interest existed with the former general manager of Financial Partners
    Services (FPS).

Improvement Is Needed in the Financial Partners Eligibility & Oversight (FPE&O) Risk
Assessment Process

The financial and compliance impacts of identified risks were not properly assessed, quantified
and documented; there was limited to no documentation to support selection of FFEL Program
participants for program reviews; and no evidence that consideration was given to available
staffing resources.

Control Activities Over Guaranty Agencies, Lenders and Servicers Need Improvement

Control activities include the policies, procedures, and mechanisms in place to help ensure that
an agency meets its objectives. Based on our audit, the following conditions existed:

   Process for monitoring lenders’ compliance with 34 Code of Federal Regulations (CFR)
    682.305 (c)(1), which requires that certain lenders submit independent annual compliance
    audit reports, was not effective.
Final Audit Report	                                                                Page 2 of 39


    1.	  Partner Services Group (PSG) control activity was not effective with respect to
        monitoring lenders’ compliance with the requirements of Section 428(b)(1)(U)(iii)(I) of
        the Higher Education Act of 1965, as amended (HEA) and 34 CFR 682.305(c)(1).
    2.	 PSG procedures for ensuring that lenders are addressing issues in the compliance audit
        reports were not timely.
    3.	 PSG had no written procedures for escalating auditor’s opinion that is other than an
        unqualified opinion, material weaknesses, or significant noncompliance with laws and
        regulations.

   Published minimum reserve ratios for guaranty agencies were not calculated in accordance
    with Section 428(c)(9) of HEA, which requires certain guaranty agencies to maintain
    minimum Federal fund reserve ratio of 0.25 percent.

    1.	 The financial conditions of the guaranty agencies were overstated.
    2.	 Guaranty agencies were not adequately monitored by PSG.
    3.	 The Federal fund reserve ratios published on the Financial Partners website were
        overstated.

   Reviews conducted under the Common Review Initiative (CRI) may not have satisfied
    guaranty agencies’ obligations to conduct reviews of lenders.

    1.	 The use of the Common Manual, Unified Student Loan Policy (Common Manual) in the
        CRI reviews to ascertain lenders compliance with FFEL Program requirements may not
        have satisfied guaranty agencies’ obligations to conduct reviews of lenders.
    2.	 The sampling method used was not consistent and not susceptible to projection.
    3.	 The tolerable error rate of 10 percent was too high.
    4.	 The sample selected in CRI reviews did not provide coverage of all lenders listed in the
        CRI report.
    5.	 Lender billing reviews were not conducted in all CRIs.
    6.	 CRI workpapers were not reviewed in a timely manner.

   Incompatible duties were not separated and no written procedures were in place for providing
    technical assistance to guaranty agencies, lenders and servicers.

FSA Lacked Written Procedures on Sharing Information Related to Policy Guidance and
Program Reviews

 There were no written procedures in place to share program review reports that contain
  sensitive issues, political issues, and/or areas where the Office of Postsecondary Education
  (OPE) or the Office of General Counsel (OGC) has expressed an interest to ensure that
  program review findings are consistent with laws and regulations.
 FPE&O management lacked a tracking system for policy related matters.
 There were no written procedures for providing technical assistance.
Final Audit Report                                                                   Page 3 of 39


FSA’s Implementation of Corrective Actions

FSA did not take timely corrective action to address findings and recommendations noted in a
prior Office of Inspector General (OIG) audit report. The OIG report entitled Review of
Financial Partners’ Monitoring and Oversight of Guaranty Agencies, Lenders, and Servicers,
dated September 29, 2006, identified 17 recommendations. FSA’s Internal Report: Corrective
Action Plan, dated March 5, 2008, indicated there were 14 open recommendations. Between
March 5, 2008 and August 27, 2008, FSA reported the remaining recommendations completed.
Of the 17 total corrective actions, we noted that only 2 corrective actions were completed by the
proposed completion dates. For the remainder, proposed completion dates were extended once
for 8 corrective actions, twice for 7 corrective actions. We also found that 5 corrective actions
had not been fully implemented, and 3 corrective actions were not completed when reported.

For each of the identified weaknesses in the internal control standards, we provided
recommendations, as defined in the Audit Results section, that if implemented will improve the
effectiveness of oversight and monitoring of the guaranty agencies, lenders and servicers.

On May 1, 2008, subsequent to the scope of our audit, FSA issued Financial Partner Eligibility
and Oversight (FPE&O) Program Review Procedures (Standards). The title page of the
Standards state, “This manual was created to provide standardized procedures for conducting
Program Reviews.” The Standards, if implemented as intended, should result in improvements
to some of the issues noted in this audit report. Where applicable in the individual findings, we
have noted the issues reported that the Standards address.

FSA provided its response to our draft audit report on March 24, 2009. In its response, FSA
stated that actions it has taken, and plans to take in the near future, address many of the issues
raised in the draft report. In addition, FSA provided a draft corrective action plan that included
proposed actions to address each of the recommendations in the report. FSA’s response is
provided in full as an attachment to this report.
Final Audit Report                                                                    Page 4 of 39



                                      BACKGROUND



FSA, an office of the U.S. Department of Education, was created as a Performance Based
Organization under the 1998 amendments to the HEA. FSA’s primary objectives are to: a)
improve service to students and other participants in the Federal student financial assistance
programs authorized under title IV, including making those programs more understandable to
students and their parents; (b) reduce the costs of administering those programs; (c) increase the
accountability of the officials responsible for administering the operational aspects of these
programs; (d) provide greater flexibility in the management of the operational functions of the
Federal student financial assistance programs; (e) integrate the information systems supporting
the Federal student financial assistance programs; (f) implement an open, common, integrated
system for the delivery of Federal student financial assistance under title IV; and (g) develop and
maintain a Federal student financial assistance system that contains complete, accurate, and
timely data to ensure program integrity.

FSA works with over 3,200 lenders, 35 guaranty agencies and 46 servicers that participate in the
FFEL program. Under the HEA, in the FFEL Program, state and private non-profit guaranty
agencies use Federal funds to provide loan guarantees and interest subsidies on loans made by
private lenders to eligible students and parents.

As of September 30, 2007, FSA oversaw approximately $363 billion in guaranteed loans, held
by lenders, with estimated maximum government exposure on outstanding guaranteed loans of
approximately $359 billion. The government reinsures, through the guaranty agencies, 95 to 100
percent of the outstanding guaranteed loans. The remaining balance not reinsured by the
government is paid by the guaranty agencies to lenders from the Federal funds administered by
the guaranty agencies but owned by the federal government. In FY 2007, FSA managed, directly
or through guaranty agencies, approximately $24 billion of defaulted guaranteed loans and
supported delivery of $51 billion in net guaranteed federal loans to 6.2 million FFEL Program
recipients.

Program Compliance is the primary organizational unit in FSA providing oversight and guidance
to schools, guaranty agencies, lenders and servicers under the FFEL Program. The Business
Operations unit is responsible for improving consistency, efficiency/effectiveness and
coordination/communication of FSA operations. FPE&O and the PSG, components within
Program Compliance and Business Operations, respectively, have direct responsibilities for
monitoring the guaranty agencies, lenders and servicers to assess program compliance with HEA
and the Department’s regulations.

According to the functional statement on FSA’s website, FPE&O is responsible for
implementing program and financial reviews of guaranty agencies and FFEL Program lenders
and related agencies or organizations; providing technical assistance to these groups on the
proper administration and management of the FFEL Program; identifying and analyzing major
issues affecting lender and guarantor compliance with program requirements; and developing
national priorities, goals, and guidelines for monitoring the programmatic stability of the Federal
student loan guarantors. In addition, FPE&O provides oversight over the guaranty agencies’
Final Audit Report                                                                                Page 5 of 39


review of their top ten lenders under the CRI. FPE&O has four regional offices in New York,
Dallas, San Francisco, and Chicago, and duty stations in Atlanta and Boston.

PSG is responsible for identifying and analyzing major issues affecting lenders, and guaranty
agencies’ financial stability. PSG is responsible for reviewing compliance audit reports to
identify audit findings, issue Program Determination Letters (PDLs), and monitor the
implementation of corrective actions to ensure that audit findings are properly addressed by the
FFEL Program participants. 1

In September 2006, the OIG issued a report, Review of Financial Partners’ Monitoring and
Oversight of Guaranty Agencies, Lenders and Servicers. The report concluded that FSA had not
implemented an acceptable level of internal control over its monitoring and oversight. The
report identified internal control weaknesses relating to the following internal control standards –
control environment; risk assessment; control activities; and information and communication.




1
 According to the Director of PSG, FPE&O assumed responsibilities for the review of the compliance audit reports
effective October 1, 2007.
Final Audit Report	                                                                  Page 6 of 39



                                       AUDIT RESULTS



Controls implemented by FPE&O and PSG to ensure that guaranty agencies, lenders and
servicers are performing in accordance with relevant laws, regulations and guidance needed
improvement. Specifically, weaknesses existed in the (1) control environment for oversight and
monitoring of the guaranty agencies, lenders and servicers; (2) FPE&O risk assessment process
(3) control activities over guaranty agencies, lenders and servicers; (4) information and
communication process for sharing policy guidance and program reviews; and (5) timeliness of
corrective action plan implementation.

FSA provided its response to our draft audit report on March 24, 2009. In its response, FSA
stated that actions it has taken, and plans to take in the near future, address many of the issues
raised in the draft report. In addition, FSA provided a draft corrective action plan that included
proposed actions to address each of the recommendations in the report. FSA’s response is
provided in full as an attachment to this report.


FINDING NO. 1 – Improvement Is Needed in the Control Environment for
                Oversight and Monitoring of the Guaranty Agencies, Lenders
                and Servicers

GAO’s Internal Control Standards state that “a positive control environment is the foundation for
all other standards. It provides discipline and structure as well as the climate which influences
the quality of internal control.”

GAO’s Internal Control Standards identify the following seven key factors that affect the Control
Environment:

   1. 	 The integrity and ethical values maintained and demonstrated by management and staff;
   2. 	 Management’s commitment to competence;
   3. 	 Management’s philosophy and operating style, which include the degree of risk that it is
        willing to take and its philosophy towards performance-based management;
   4. 	 An agency’s organizational structure;
   5. 	 The manner in which an agency delegates authority and responsibility throughout the
        organization;
   6. 	 Good human capital policies and practices; and
   7. 	 An agency’s relationship with Congress and central oversight agencies.

Weaknesses that existed in the control environment at FSA with respect to the FFEL Program
were as follows:

      Improvement was needed in oversight of FFEL Program participants,
Final Audit Report	                                                               Page 7 of 39


       Delegation of authority was not properly aligned with the oversight and monitoring of
        guaranty agencies, lenders and servicers, and
       Potential conflicts of interest existed with the former general manager of Financial
        Partner Services.

Improvement Was Needed in Oversight of FFEL Program Participants

In our discussions with the regional directors and review specialists, and our review of the
program review reports and workpapers, we noted the following matters:

    •	 FSA had not dedicated sufficient resources to effectively monitor FFEL Program
       participants’ (i.e., guaranty agencies, lenders and servicers) compliance with FFEL
       Program law and regulations.
    •	 Improvement was needed in FSA management’s role in the oversight of the program
       review process.
    •	 Program reviews were not properly supervised.
    •	 Program reviews were not performed consistently.
    •	 No mandatory training requirements existed for review specialists.
    •	 FSA had not developed a timeline for issuing program review reports.
    •	 FPE&O policy may have resulted in improper waiving of liability due to the government.

   FSA had not dedicated sufficient resources to effectively monitor FFEL Program
    participants’ compliance with FFEL Program law and regulations.

FPE&O regional offices have the primary responsibility for the performance of the program
reviews related to the monitoring and oversight of the FFEL Program participants. The following
program reviews were scheduled for FY 2007 & FY 2008:

                                           Program Reviews      Program Reviews    Program Reviews
                                          Initially Scheduled      As Revised         Scheduled
Program Reviews                                (FY 2007)           (FY 2007)          (FY 2008)
Consolidation Phase II                                                                    8
Fund Reviews                                                                             28
Conflict of Interest Phase 1                                                             35
Conflict of Interest Phase 2                                                             14
School with Eligible Lender Trust (ELT)           19                                     19
Eligible Lender Trust                                                                     7
Inducement Reviews                                                    11                 26
Consolidation Fee                                                                        38
Pilot of the Draft Standards                                                              2
Focused Review - Mandatory                        1                                       1
Lenders/Servicers Review
Guaranty Agency Review                            7
Lenders/Secondary Markets Review                  1
Guaranty Agency Servicers Review                  5
Tax Exempt Entities                               19
Final Audit Report                                                                                 Page 8 of 39

                                                  Program Reviews          Program Reviews         Program Reviews
                                                 Initially Scheduled          As Revised              Scheduled
Program Reviews                                       (FY 2007)               (FY 2007)               (FY 2008)
Guaranty Agency IPIA 2                                                            27                      -
Lender IPIA                                                                       17                      -
Common Review Initiative Review                                                   2                       -
Full Scope Review                                                                 1                       -
        Total                                             52                      58                     178

In addition to the 178 program reviews planned for FY 2008, 11 3 program reviews for FY 2007
were not completed 4 as of September 30, 2007.

The program reviews are performed by the review specialists in the regional offices. At the time
of our review, there were 28 staff in the regional offices (3 regional directors, 2 Information
Technology specialists, 22 review specialists and 1 administrative staff), located in the 4 regions
and the 2 duty stations nation-wide. Based on discussion with a review specialist, while the
FFEL Program requirements have expanded significantly in the last five years, the staff
resources needed to perform oversight over FFEL Program participants have declined
significantly. Even if these positions are backfilled, there will be a loss of experience and
institutional knowledge. In addition, a review specialist told us that FPE&O reduced its
management staff from four to three regional directors. According to a regional director, the
Western region has experienced significant staff turnover; in the last few years, the regional
director, two senior review specialists and the administrative assistant have retired. The two
senior review specialists and the administrative assistant positions have not been filled, and the
Northern regional director also serves as the director for the Western region. The shortage of
qualified review specialists hampers FSA’s ability to effectively perform its legislatively
mandated monitoring and oversight responsibilities over FFEL Program participants. As shown
in the table above, FSA planned a significant increase in the number of program reviews to be
performed by FPE&O personnel in FY 2008; as a result, a significant increase in resources is
critical if FSA is to complete the scheduled reviews and effectively monitor FFEL Program
participants’ compliance with law and regulations.

Of 58 program reviews in the revised schedule for FY 2007, 29 review reports 5 were issued by
FPE&O between October 1, 2006 and March 31, 2008. Program reviews of FFEL Program
participants consist of reviews of 28 elements in the Guaranty Agency Review Guide or 14
elements in the Lender/Servicer Review Guide. According to the review specialists, depending
on the nature of the review (comprehensive/full scope review, focus/targeted review, or guaranty
agency/lender review), testing of review procedures is completed in three to six days, with a
team of three to five reviewers, and a scope period covering two to five fiscal years. A senior

2
  Note: In FY 2007, most program review staff was used to perform Improper Payments Information Act (IPIA)

reviews of the FFEL Program.

3
  Out of 58 program reviews in the revised schedule for FY 2007, 9 inducements reviews, 1 CRI review, and 1 full

scope review were not completed as of the end of FY 2007.

4
  We determined that program reviews were completed in cases where the review reports were not issued.

5
  The 29 program review reports were made up of 26 IPIA reviews that did not follow the guaranty agency or lender

review guide, 1 inducement review, 1 CRI review, and 1 full scope lender review.

Final Audit Report	                                                                   Page 9 of 39


review specialist told us that two weeks (including four days of traveling time) was not sufficient
to complete all assigned elements in the review guide, and if time did not permit, the review
specialists judgmentally selected for testing elements they believe to be more important. In
addition, review specialists and a regional director told us that FFEL Program participants were
relied upon to complete procedures in the review guides and determine the liability due FSA.
Two senior review specialists stated that there was no formal procedure to verify the results of
work performed by the FFEL Program participants.

Because of the lack of adequate resources, program reviews performed by FPE&O cannot be
relied upon to assess FFEL Program participants’ compliance with the HEA, and rules and
regulations prescribed by the Secretary of Education (Secretary).

   Improvement was needed in FSA management’s role in the oversight of the program review
    process.

During our audit, program review specialists voiced concerns with decisions made by FSA
management with respect to the program reviews. Six of the 13 review specialists we talked to
expressed such concerns. A few examples follow:

    •	 One review specialist stated that a servicer was found to be taking adverse actions against
       borrowers without issuing a final determination letter and/or allowing the borrowers to
       respond to the determination letter or cure defects in the loans as required by legislation.
       The servicer indicated that the failure to issue the determination letters was due to errors
       in a computer program and agreed with FSA to fix the problem. The review specialist
       was assigned to determine if the problems had been corrected. The servicer’s officials
       refused to cooperate with the review specialist, and the review specialist was asked to
       contact FSA officials at the Washington Headquarters. The review specialist was advised
       by an FSA management official that the servicer had outsourced the function of issuing
       the letters of determination to another firm. However, based on the limited review
       performed at the servicer and knowledge of the servicer’s programs, the review specialist
       issued a draft review report with observations and findings. The specialist stated that
       while on vacation, the final review report was issued under the specialist’s name;
       however, all of the findings and observations in the draft review report had been
       removed. While the review specialist expressed concerns to FSA management, no
       modification was made to the final review report to address those concerns.

    •	 In another instance, the draft report of a Conflict of Interest review of a guaranty agency
       that was submitted to the FSA management was neither finalized nor posted to
       Postsecondary Education Participants Systems (PEPS). Instead, the guaranty agency was
       rescheduled for the same review in the 2008 Annual Work Plan. The review specialist
       expressed frustration, stating that, I do not have control over what happens to my findings
       when they get up there (Washington Headquarters). According to the review specialist
       who performed the review, the Conflict of Interest review was requested by the Director
       of FPE&O. We made inquiry of the Director of FPE&O who stated that to the best of
       their knowledge they were not aware of any instances where a program review report had
Final Audit Report	                                                                                Page 10 of 39


        not been issued. The Director of FPE&O further stated that if they had instructed a
        review specialist to perform a program review and no report was issued, they would at
        least have the review specialist document the reason why the report was not issued.

    •	 On an inducement review, two review specialists stated that FSA’s management denied
        the review team’s request that the lender provide additional documents, primarily
        marketing materials, that the review team had concluded was necessary to complete the
        inducement review. Contrary to the FSA management claim, the review team stated that
        the proposed second request for additional documents did not duplicate the first request
        for documents. The initial request for documentation had been submitted to the lender
        directly by FSA management. We made inquiry of the Director of FPE&O, who stated
        that the review team leaders were instructed not to request additional information from
        the lender until the information received from the initial letter was reviewed.

    •	 A senior review specialist indicated to us that in the past data files of the transaction
       populations were requested and the specialist performed analytical procedures utilizing
       the data from the file. In instances when such analysis resulted in findings, the senior
       review specialist had been criticized by FSA management for doing additional work
       beyond testing of the first 30 transactions in the sample. According to the senior review
       specialist, FSA management stated that – It is the lender’s duty to review the population.
       You are not doing audit; this is a review.

Perceptions regarding FPE&O management’s attitude towards financial and programmatic
reviews and failure to finalize and issue a program review report that has findings may raise
concerns about FPE&O’s commitment to compliance and the program review process.

   Program reviews were not properly supervised.

The senior review specialists who serve as the team leaders on reviews are GS-13 staff and have
no supervisory responsibility over the review specialists. 6 According to three team leaders,
while the team leaders reviewed the workpapers of the review specialists, the team leaders do not
take responsibility for the work of the review specialists. There are 3 regional directors who
have the responsibility for reviewing all the workpapers and reports resulting from the program
reviews included in the FY 2008 Annual Work Plan as well as the FY 2007 inducements reviews
that will be completed in FY 2008. We noted that the workpapers for two program reviews, a
CRI review and a Consolidated Rebate Fee review performed by the regional staff in FY 2007
and FY 2008, respectively, had no evidence of a regional director’s review.




6
  This finding was consistent with the audit finding noted in the prior OIG Audit Report, Review of Financial
Partners’ Monitoring and Oversight of Guaranty Agencies, Lenders, and Servicers, dated September 2006,
(hereafter referred to as the prior OIG audit report) in which the auditors found that Financial Partners procedures
lacked any requirement for supervisory review.
Final Audit Report                                                                                    Page 11 of 39


   Program reviews were not performed consistently.

Through our discussions with the review specialists, we determined that there was a lack of
consistency in the way review guide procedures were performed. 7 Some review specialists were
of the opinion that the specific review guide elements completed and the procedures performed
are at the discretion of the review specialists. Another review specialist believed that unless it is
justified by extenuating circumstances all the review guide elements and procedures must be
completed. In some instances, some of the review specialists use statistical sampling while
others use judgmental sampling. In addition, some review specialists requested that FFEL
program participants project errors to the population while other review specialists do not project
errors to the population. Based on inquiries of the review specialists, we determined that
samples selected were not always representative of the populations because samples were
selected from inappropriate populations. As an example, if the review element was
“Deferments,” the sample should only be selected from the Deferment population rather than the
entire population. In other instances, samples were selected from incomplete quarters. We
reviewed the report and workpapers of Lender Reporting System (LaRS) billings and National
Student Loan Data System (NSLDS) reporting review performed by FPE&O under the CRI, and
noted that the statements on work performed and the review results were not fully supported by
the review evidence.

   No mandatory training requirements existed for review specialists.

We reviewed the documentation of training taken by 14 FPE&O staff, which consisted of 2
regional directors and 12 review specialists, during the period from October 2006 through
January 2008. We noted that a significant number of the review specialists had not completed
adequate training to retain or improve their skill sets. Out of the 14 FPE&O staff, 5 completed
IPIA training and 12 completed inducement training. In addition, for 6 of the 12 staff that
completed the inducement training, this course was the only training course taken that was
relevant to their positions. According to a regional director and a review specialist who
participated in the FPE&O training courses, the duration of the IPIA and inducement training
courses was two to three hours each.

Based on discussions with the regional directors and the review specialists, we noted that 10 of
the 14 FPE&O staff lacked accounting and financial backgrounds that are important in the
oversight and monitoring of FFEL program participants. Because of the inherent risks of FFEL
Program and the magnitude of the financial transactions, background or training in finance and
accounting is important in analyzing Form 2000 data, LaRS billings and Federal funds. Without
mandatory training requirements, FPE&O staff may not be adequately trained and may lack the
appropriate skill sets to perform their job responsibilities.



7
  This finding was consistent with the audit finding noted in the prior OIG audit report, in which the auditors found
that although Financial Partners has policies and procedures for conducting and documenting program reviews, the
procedures were not consistently followed.
Final Audit Report                                                                                 Page 12 of 39


   FSA had not developed a timeline for issuing program review reports.

According to a program review specialist, program review reports are typically issued 30 to 45
days from the date of fieldwork completion. For example, according to the Revised FY 2007
Annual Work Plan, the fieldwork for eight inducement reviews was scheduled to be completed
by July 2007. However, only one report was issued as of March 31, 2008. In addition, a
program review was completed in April of 2007; however, the program review report was not
issued until January 23, 2008. Because of delay in issuing program review reports, program
review findings that pose financial and compliance risks to FFEL Program may not be addressed
timely. 8

   FPE&O policy may have resulted in improper waiving of liability due to the government.

Review specialists told us that they did not calculate liability because they believe that the
samples were not statistically valid. The review team often relies on the FFEL Program
participants to complete testing of the samples if the errors in the sampled population exceeded
the tolerable error rate. In addition, calculation of liability is at the discretion of the reviewers
for non-systemic errors. FPE&O established a condition in which liability is recorded depending
on if the errors are systemic or non-systemic. A systemic error is defined as an error that is equal
or greater than 10 percent of the sampled population (e.g. three errors out of a sampled
population of 29 or 30). Examples would include errors resulting from misinterpretation of
statutes, regulations or policies, or errors attributed to information systems programming errors.
A non-systemic error is defined as an error that is less than 10 percent of the sampled population
and is unusual or caused by human errors. According to the FPE&O guidance, systemic errors
are extrapolated to the population to calculate potential liability. Because of the lack of clear and
consistent FPE&O guidance when non-systemic errors are identified in program reviews, review
specialists may inappropriately waive liabilities due to the Department. 9

On May 1, 2008, subsequent to our audit scope, FSA issued standards for performing program
reviews. The Standards, if implemented as written, should address issues noted above related to
supervision of program reviews, consistency of program reviews, establishing a timeline for
program review report preparation, and issuance and calculation/waiver of liabilities. 10 On June
30, 2008, FSA reported implementing a quality assurance process for program reviews as part of
the Standards. The document summarizing the quality assurance process was subsequently
removed from the standards as it is not a process that program reviewers would follow. As of
March 9, 2009, the quality assurance document is on a shared drive in FSA, but has not been


8
  This finding was consistent with the prior OIG audit report in which the auditors found that three program reviews
were not issued or closed in reasonable timeframes. Of the three program reviews, two program reviews were open
for 248 and 199 calendar days, respectively, and the third program review had not been issued for 252 calendar days
from the date the fieldwork was completed.
9
  This finding is consistent with the prior OIG audit report, where the auditors found that program review reports
rarely included monetary liabilities and that program reviewers did not consistently quantify liabilities.
10
   We reviewed the current version of the Standards obtained from FSA as of March 6, 2009, to update information
in the draft audit report.
Final Audit Report                                                                  Page 13 of 39


formally issued as a policy to ensure its implementation. One quality assurance review was
issued September 29, 2008.

Delegation of Authority Was Not Properly Aligned with the Oversight and Monitoring of
Guaranty Agencies, Lenders and Servicers

OMB Circular A-123, Management’s Responsibility for Internal Control, states that within the
organizational structure, management must clearly define and appropriately delegate authority
and responsibility throughout the agency. Also, in accordance with the Departmental Directive:
OM:1-102 “Delegations of Authority,” dated July 26, 2005, a delegation of authority is required
for taking actions, and making decisions, which have legal significance.

The Delegation of Authority (Control No. EN/ENE/39) in effect at the time of our review related
to the oversight and monitoring of the guaranty agencies, lenders and servicers, is from the Chief
Operating Officer (COO) of FSA to the general manager of Financial Partners Channel. The
delegation of authority was certified on December 9, 1999. However, FSA underwent a
reorganization in March of 2006 to combine the functional responsibility for oversight and/or
monitoring of the schools, lenders, guaranty agencies and other state or financial organizations
that participate in the student financial assistance programs to a new organization called Program
Compliance. FPE&O is a component within Program Compliance with oversight and/or
monitoring responsibility over guaranty agencies, lenders and servicers. One of the key stated
objectives of the reorganization was to increase the focus on program integrity (i.e., oversight,
monitoring and compliance functions).

Under the delegation of authority described above, the general manager of Financial Partners
Channel was delegated the authority for certain functions and decisions including: returning of
federal funds and assets; disqualifying, limiting, suspending or terminating a lender’s or third
party servicer’s eligibility to participate in FFEL Program; permitting transfer of guarantees to
guaranty agencies; waiving the Secretary’s right to require payment of a liability; and calculating
and publishing FFEL Program cohort default rates.

We determined that the authority for these functions that had been delegated to the general
manager of the Financial Partners Channel was not transferred to the Manager of Program
Compliance as part of the March 2006 reorganization. The authority for the Manager of
Program Compliance is not clearly aligned with the responsibilities of the office. Because the
responsibility for decision making at Program Compliance is not properly linked to the
assignment of authority, individuals may not be aware of the extent or limit of their
responsibilities and may not be held accountable accordingly. Also, Program Compliance and
FPE&O management could potentially make unauthorized decisions related to guaranty
agencies, lenders and servicers.

The Director of FPE&O was appointed in June of 2006. We noted an instance when the Director
for FPE&O did not exercise the authority of the office. The CRI is a concept designed to create
efficiencies and consistency in lender program reviews conducted by guarantors. The CRI was
implemented on a pilot basis on January 1, 2004. FPE&O has the responsibility to monitor
Final Audit Report                                                                    Page 14 of 39


guaranty agencies’ compliance requirements for lender reviews. However, we noted that the
extension of the pilot phase of the CRI for an additional year was authorized by the former
general manager of FPS on January 3, 2007, or nine months after the responsibility to monitor
guaranty agencies’ compliance requirements for lenders was transferred to FPE&O from PSG.

The functional responsibilities for the review of the compliance audit reports submitted by the
guaranty agencies, lenders and servicers were transferred to FPE&O as part of FSA’s
reorganization that occurred in March of 2006. While the Director of FPE&O was appointed in
June 2006, according to PSG staff, the Director of FPE&O did not assume responsibilities for the
review of the compliance audit reports until October 1, 2007, which was approximately 18
months after the reorganization. According to the Director of PSG, there were two PSG staff
dedicated to the review of the compliance audit reports. As of September 30, 2007, there were
397 compliance audit reports submitted by the guaranty agencies, lenders and servicers for
review. When the function was transferred to FPE&O only one employee in Headquarters was
assigned to compliance audit reviews.

Because the responsibility for decision-making regarding certain FPE&O functions was not
linked to the assignment of authority, managers may not be held accountable for actions or
performance in functional areas that are not clearly delegated to their office.

On May 22, 2008, subsequent to our fieldwork, FSA management stated it was working with the
Department’s Office of the Secretary and the OGC to make appropriate modifications to the
current Delegation of Authority. The revised Delegation of Authority from the Department’s
Secretary to FSA COO and the Redelegation of Authority from the FSA COO to the Manager of
Program Compliance were executed and certified on May 29, 2008, and July 1, 2008,
respectively. The execution of these delegations, if followed, corrects the delegation issues
noted during the scope of our audit.

Potential Conflicts of Interest Existed with the Former General Manager of Financial
Partner Services

According to the GAO’s Internal Control Standards, one of the factors affecting positive control
environment is the integrity and ethical values maintained and demonstrated by management and
staff. Agency management plays a key role in setting and maintaining the organization’s ethical
tone. Department officials at a certain position level are required to submit annual financial
disclosure reports. The former general manager of FPS was on paid administrative leave since
April 6, 2007, related to alleged conflicts of interest. The alleged conflicts of interest arose when
it was determined that the general manager held and sold stocks of a FFEL Program participating
lender, while maintaining the responsibilities for the oversight and monitoring of the guaranty
agencies, lenders and servicers. The former general manager of FPS resigned from FSA
effective September 2, 2008.

Transparency in management actions in the execution of their job functions creates a culture in
which ethical behavior is encouraged and promotes employee perception that doing the right
thing is expected and supported by management.
Final Audit Report	                                                              Page 15 of 39


RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

1.1 	    Dedicate sufficient FPE&O resources to perform oversight of the FFEL Program.

1.2	     Ensure that FPE&O implements its new program review Standards to ensure that
         supervisory reviews of program review working papers are timely and are documented.

1.3	     Formalize the quality assurance process into a policy to ensure program reviews are
         monitored for consistency and compliance with the Standards.

1.4	     Develop core competencies for the regional directors and review specialists, and
         implement mandatory training requirements to ensure that staff obtains appropriate
         training in the core competencies to effectively perform their job functions.

1.5	     Ensure that liability due to the Department resulting from systemic and non-systemic
         errors is reported by the review specialists, with authority to waive such liability
         exercised only by the Program Compliance Manager in accordance with the restrictions
         contained in Delegation EN/ENA/60 (July 1, 2008).

1.6	     Ensure that any liability resulting from program review of FFEL Program participants
         which has not been waived by the Program Compliance Manager is recovered by the
         Department.

1.7	     Ensure that management functional responsibilities and the decision making process are
         properly aligned with the updated delegations of authority.

1.8	     Evaluate decisions made by the former general manager of FPS to determine if any
         decisions were inappropriate, take corrective actions as necessary, and assess the
         impact on the FFEL Program.


FINDING NO. 2 – Improvement Is Needed in the FPE&O Risk Assessment Process

FPE&O’s risk assessment process needed improvement. Based on our discussions with FPE&O
management and staff, and review of risk identification documents, annual work plans and risk
assessment tools, the financial and compliance impacts of identified risks were not properly
assessed, quantified and documented. Within a given risk area, there was limited to no
documentation to support the selection of FFEL Program participants for program reviews. Also,
in the FY 2008 Annual Workplan, there was no evidence that consideration was given to
available staffing resources, and no documentation on how the values assigned to the risks
ratings were derived. As discussed in Finding No. 1, while the number of planned program
reviews increased from 58 in FY 2007 to 178 in FY 2008, there was no commensurate increase
in FPE&O resources. According to GAO’s Internal Control Standards, “internal control should
Final Audit Report                                                                       Page 16 of 39


provide for an assessment of the risks the agency faces from both internal and external sources.
Once risks have been identified, they should be analyzed for their possible effect. Management
then has to formulate an approach for risk management and decide upon the internal control
activities required to mitigate those risks and achieve the internal control objectives of efficient
and effective operations, reliable financial reporting, and compliance with laws and regulations.”

As part of the risk assessment process to develop the annual work plan in FY 2008, FPE&O
conducted two risk assessment sessions, with each session lasting about two hours. Participants
at the sessions included the FPE&O Director and the three regional directors, officials of the
Enterprise Risk Management Group (ERMG), Business Operations, the FSA Acting COO, the
COO Chief of Staff, and staff from OGC and OPE. According to the Director of FPE&O, at the
first meeting, the team covered the type of risks, mitigation strategies, and the availability of data
for review. After the first meeting, participants submitted their comments for review, and where
appropriate, the comments were incorporated into the agenda for the second meeting. At the
second meeting, results from the comments from the first meeting were vetted and refined, and
consensus reached on the final result of the risk assessments. While the Director of FPE&O
emphasized the participatory nature of the risk assessments process, the Directors of Policy
Liaison and Implementation (PLI) and ERMG who participated in the two sessions stated that
their offices played limited roles in the FPE&O risk assessment process. The Director of ERMG
stated that their participation was advisory in nature and limited to the discussions on risk
identification.

In the risk assessment process, first the types of risks (i.e., inducements, conflict of interest, etc.)
were identified. Then the risk significance (assessment of the magnitude or potential impact or
effect of a specific risk) and the risk likelihood (assessment of the probability of the occurrence
of a specific risk) were assigned a number from 1 (low or very remote) to 5 (very high or very
likely) for each type of risk. The aggregate risk score, which is the total cumulative amount of
exposure associated with a specific risk, was derived mathematically from the risk significance
and risk likelihood factors. Therefore, the magnitude of a risk or the aggregate score was
dependent on the number, 1 through 5, which is assigned to the risk significance and risk
likelihood factors respectively, based on the judgment of the session participants.

FPE&O did not provide documentation to support how numbers assigned to the risk significance
and risk likelihood factors were determined. However, other documentation provided showed
that issues such as inducements and conflicts of interest were determined to have the highest
aggregate scores. For example, inducement, conflict of interest, and guaranty agency financial
stability risks were calculated to have aggregate risk scores of 11, 10 and 6.5, respectively.
Stated differently, the risk of bad publicity attributed to inducements and conflict of interest were
deemed to be of more risk to the organization than financial losses that may impair guaranty
agency financial stability. The impact of the financial risks and stability of the guaranty agencies
can be measured by the fact that at September 30, 2007, the Department had an estimated
guaranteed loans loss exposure in excess of $359 billion in the FFEL Program. Also, in FY
2007, the Department paid approximately $6 billion and $11 billion for defaulted loans and
interest subsidies, respectively.
Final Audit Report                                                                         Page 17 of 39


FPE&O did not provide documentation to support the basis for the selection of the FFEL
Program participants for the reviews. According to the Director of FPE&O, FPE&O relied on
the judgment of the participants in the risk assessments sessions, data analysis, and referrals from
the OIG and student loan industry. We inquired why certain lenders and guaranty agencies were
selected for program reviews in FY 2008 instead of larger lenders and guaranty agencies with
multiple deficiencies (or risk scorecard triggers) as reflected on the risk scorecards. The Director
of FPE&O was not able to provide this information because the discussions in the risk
assessment sessions were not documented. In addition, we inquired why FFEL Program
participants with multiple risk scorecards triggers were not selected for reviews; we were told
that risk scorecards were not used to select FFEL Program participants for review but rather used
as additional information if there was data related to the risk area being reviewed. Based on the
FY 2007 and the FY 2008 Annual Work Plans, a significant portion of FPE&O resources were
focused on small lenders that pose limited risks to the FFEL Program.

The focus of the program reviews in FY 2007 and FY 2008 and the risk assessment process were
items such as inducements and conflict of interest, rather than the items that represent significant
financial and compliance risks to the FFEL Program such as the financial stability of guaranty
agencies and interest subsidy payments to lenders. The 178 program reviews planned for FY
2008 include 49 Conflict of Interest reviews and 26 Inducement reviews. Twenty seven of the
28 Federal Fund reviews in FY 2008 were in response to the OIG recommendation from another
report that FSA perform onsite program reviews to examine supporting records for the
establishment of the Federal and Operating Funds at the guaranty agencies not previously
reviewed by the OIG to ensure that the funds were established in accordance with the HEA. 11 In
addition, 38 Consolidation Rebate Fees desk reviews are planned. No full scope program
reviews of guaranty agencies, lenders or servicers are planned for FY 2008.

FPE&O has many risk assessment tools at its disposal that it did not incorporate into the risk
assessment process to improve accuracy and objectivity of the risk rating and for selecting
guaranty agencies, lenders and servicers for program reviews. These tools include the risk
scorecards, compliance audit reports, monthly and annual Form 2000 – Guaranty Agency
Financial Report, LaRS reports, and the CRI reports. Between 4 and 16 guaranty agencies,
depending on the calculation method used, had Federal fund reserve ratios below the
legislatively mandated minimum of 0.25 percent in 2006, as such, these guaranty agencies
represent more risk than others with Federal fund reserve ratios above the 0.25 percent. In FY
2007, the top ten lenders account for over 72 percent of the outstanding guaranteed FFEL
Program loan portfolio. In addition, many guaranty agencies, lenders and servicers have risk
scorecard results that raise financial and compliance concerns. These guaranty agencies, lenders
and servicers merit more focus in the risk assessment process given their overall financial impact
on the FFEL Program.

Four out of 13 review specialists we interviewed raised concerns about how FFEL Program
participants were selected for review. A review specialist stated that FSA’s problems are

11
  OIG Inspection Report, Review of Federal Student Aid’s Monitoring of Guaranty Agency Compliance with the
Establishment of the Federal Fund and the Operating Fund, dated September 7, 2007.
Final Audit Report                                                                  Page 18 of 39


political not programmatic which is why small schools and lenders have been selected by FSA
managers for review. The review specialist questioned why there are not more frequent program
reviews of a particular large lender. According to the review specialist, They (FSA managers) do
not want us to do the work, all our bosses are from [the lender] and that is why we do not go to
[the lender] very often. Another review specialist stated that in the last two to three years, the
review specialists have been restricted in their reviews by FPE&O management. In addition,
four review specialists expressed their concerns that the program reviews are driven by
newspaper headlines and external pressure including OIG and Congress; and raised questions
why larger lenders do not receive more attention as they would appear to be the source of the
more significant risks. We were informed that in the past the review specialists participated in
the risk assessment process by suggesting FFEL Program participants for program reviews.
However, in the last few years, the review specialists have not participated in the risk assessment
process.

In accordance with the FSA 2006-2010 Five-Year Plan, the enterprise risk management function
was established to develop risk assessments and provide a more strategic downstream risk
potential to better equip FSA senior management to anticipate, analyze, and manage risks
inherent in the Federal student financial assistance programs. In addition, the plan states that
ERMG will provide risk management oversight and guidance, perform internal reviews and risk
assessments, and drive strategies and formulate plans for assessing, monitoring and addressing
risks for all business units. At the time of our review, ERMG had not evaluated FFEL Program
risks. According to the Director of ERMG, since ERMG’s inception in 2003, it has conducted
risk reviews in five FSA business units including Facilities, Communications, Services, Human
Resources, and Conferences and Administration. At each business unit, ERMG identified risks,
categorized risks, rated risks, and assessed whether business units were properly managing risks
and adopting better practices in identifying and managing risks. These business units are not as
critical to the strategic objectives of FSA as FPE&O. The Director of ERMG stated that their
participation in the risk assessment sessions was advisory in nature and limited to the discussions
on risk identification. ERMG did not assist FPE&O in rating and categorizing risks, using risk
assessments to select FFEL Program participants for review, or in developing best practices for
identifying, assessing or managing risks.

FPE&O’s failure to use risk based criteria for selecting FFEL Program participants for reviews,
and to properly assess risks could a) raise issues regarding transparency and whether FPE&O is
effectively using its program review resources to address FFEL Program financial and
compliance risks, b) have adverse financial consequences for the FFEL Program, c) result in a
loss of public confidence, and d) result in possible noncompliance with the laws and regulations
by the FFEL Program participants.

On May 1, 2008, subsequent to our audit scope, FSA issued standardized procedures for
performing program reviews. Chapter 3 of the Standards, updated February 24, 2009, addresses
developing the annual program review schedule. If implemented as written, the new Standards
should address issues noted above related to evaluation and documentation of risk impacts,
documentation to support entities selected for program reviews, and consideration of available
staff resources. The Standards also provide for participation of lead reviewers in the process.
Final Audit Report	                                                               Page 19 of 39


RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

2.1 	    Ensure effective implementation of the Standards related to developing the annual
         program review schedule to provide a rigorous, objective risk assessment methodology
         that is fully documented to support decisions.

2.2	     Include FPE&O and PSG as high priority areas for ERMG evaluations.


FINDING NO. 3 – Control Activities Over Guaranty Agencies, Lenders and
                Servicers Need Improvement

GAO’s Internal Control Standards state that “control activities are the policies, procedures,
techniques, and mechanisms that enforce management’s directives, such as the process of
adhering to requirements for budget development and execution. They help ensure that actions
are taken to address risks. Control activities are an integral part of an entity’s planning,
implementing, reviewing, and accountability for stewardship of government resources and
achieving effective results.” Improvement is needed in FPE&O and PSG’s procedures,
techniques and mechanisms for ensuring that FFEL Program participants adhere to certain
provisions of the HEA, and rules and regulations prescribed by the Secretary. Specifically, we
noted the following:

   Process for monitoring lender’s compliance with 34 CFR 682.305(c)(1), which requires that
    certain lenders submit independent annual compliance audit reports, was not effective.
   Published minimum reserve ratios for guaranty agencies were not calculated in accordance
    with Section 428(c)(9) of the HEA.
   Reviews conducted under the CRI may have not satisfied guaranty agencies’ obligations to
    conduct reviews of lenders.
   Incompatible duties were not separated and no written procedures were in place for providing
    technical assistance to guaranty agencies, lenders and servicers.

Process for Monitoring Lenders’ Compliance With 34 CFR 682.305(c)(1), which Requires
that Certain Lenders Submit Independent Annual Compliance Audit Reports, Was Not
Effective

We determined that PSG’s reviews of compliance audit reports were not an effective tool for
monitoring that:

    •	 The Lender’s Interest and Special Allowance Request and Reports (ED Form 799s) are
       materially correct and in conformity with FFEL Program law and regulations, and
    •	 The lender or servicer has complied with – and, as of assertion date, the servicer has
       effective control over compliance with – the identified statutory and regulatory
       provisions applicable to its participation in or administration of the FFEL Program.
Final Audit Report	                                                                              Page 20 of 39


During our audit scope, PSG was responsible for monitoring lenders’ compliance with 34 CFR
682.305(c)(1), which requires lenders originating or holding more than $5 million in FFEL loans
during its fiscal year to submit an independent compliance audit report to FSA on an annual
basis. 12 PSG tracks lenders’ submission of the compliance audit reports using PEPS. PSG’s
personnel review compliance audit reports for acceptability by completing a PEPS checklist to
ensure that the compliance audit reports included Independent Public Accountant (IPA) reports;
the IPA reports address management assertions and prior years’ audit findings, and the
Corrective Action Plan, if applicable, adequately addresses the audit findings. If the IPA’s
opinion is other than an unqualified opinion, or if audit findings are noted in the report of internal
control or report on compliance with laws and regulations, PSG issues a PDL to the lender to
ensure that corrective actions are implemented to address audit findings. The PDL requires that
the lender’s IPA verify and comment on the corrective actions taken by the lender in the “Prior
Years’ Audit/Examination Resolution Matters” section of the next regularly scheduled
compliance audit report.

PSG issues warning letters to lenders who failed to submit compliance audit reports within six
months of the end of the audit period or within nine months after the end of the audit period for
OMB A-133 audits, the legislatively mandated timeframe. After the second warning letter,
lenders who do not respond may be placed on “administrative hold” and interest and special
allowance payments withheld until the compliance audit reports are submitted.

We noted the following matters with respect to the effectiveness of PSG’s audit review as a
monitoring tool for FFEL Program compliance:

    PSG control activity was not effective with respect to monitoring lenders’ compliance with
     the requirements of Section 428(b)(1)(u)(iii)(I) of the HEA, and 34 CFR 682.305(c)(1),
     which require that certain lenders submit independent annual compliance audit reports.

We reviewed work performed by the PSG personnel to determine acceptability of the
compliance audit reports. We judgmentally selected for review 28 FFEL Program participants
(20, 5 and 3 from the lenders, servicers and guaranty agencies, respectively) from 397
compliance audit reports submitted to PSG as of September 30, 2008. We noted the following
conditions:

     •	 PSG had no documented procedures for reviewing the acceptability of compliance audit
        reports submitted by the guaranty agencies; or tracking guaranty agencies’ audit opinions
        that are other than unqualified opinions, audit findings or implementation of corrective
        action plans.
     •	 None of the acceptability checklists completed by PSG staff for the 25 compliance audit
        reports submitted by the lenders and servicers, had evidence of supervisory review.
     •	 In two instances, the acceptability review was not performed timely.
12
  According to the Director of PSG, FPE&O assumed responsibilities for the review of the compliance audit reports
effective October 1, 2007. The results presented were for operations under PSG during FY 2007, the scope of our
review.
Final Audit Report	                                                                Page 21 of 39


    •	 Compliance audit reports were not provided for our review for three out of five servicers.
    •	 The PDL was not issued timely for one lender. The lender’s compliance audit report for
       the year ended December 31, 2005 was received by PSG on June 30, 2006. The PDL
       was issued on November 20, 2006.

Because of weaknesses in the review of the compliance audit reports, FSA may not have
assurance that FFEL Program participants are appropriately managing the FFEL Program.

   PSG procedures did not provide for a means to ensure that lenders are addressing issues in
    the compliance audit reports timely.

In instances where FFEL Program participants received adverse or disclaimer of opinions,
significant deficiencies noted in the internal control structure, and/or material non-compliance
with laws and regulations, PSG’s monitoring of significant issues identified in the compliance
audit reports was not timely. Based on our inquiries with PSG financial analysts, PSG did not
determine the status of current year findings until the following fiscal year’s audit report was
received. In accordance with the HEA, a lender is required to submit the compliance audit report
within six months of the end of the audit period; therefore, PSG would not determine whether
significant audit findings have been resolved until the next reporting period. For example, a
lender with a fiscal year ended June 30, 2007, is required to submit its compliance audit report
by December 2007 at the earliest. Therefore, PSG will not know the status of the findings
identified as of June 30, 2007, until December 2008 or later, when the next compliance report is
due, or at least 18 months after the end of the fiscal year in which the issue was noted. As a
result, FSA runs the risk that findings disclosed in the compliance audit reports that possess
significant financial and compliance risks to the FFEL Program are not addressed effectively and
timely. There was no process to request status reports through the PDL to assess corrective
actions being taken for significant issues prior to the next report.

   PSG had no written procedures for escalating auditor’s opinion that is other than an
    unqualified opinion, material weaknesses, or significant noncompliance with laws and
    regulations.

PSG had no written procedures for escalating an auditor’s opinion that is other than an
unqualified audit opinion, material weaknesses, or significant noncompliance with laws and
regulations disclosed in the compliance audit reports to appropriate FSA officials, or business
units (i.e., FPE&O, PLI, etc.), or to OPE or OGC, to ensure that issues that might impair
compliance with the FFEL Program requirements or could have adverse financial consequences
on the FFEL Program are addressed timely and effectively. Because PSG had no effective
procedures for escalating material matters in auditors’ reports to appropriate officials and
business units, FSA runs the risk that findings disclosed in the compliance audit reports that
possess significant financial and compliance risks to the FFEL Program are not addressed
effectively and timely.

Subsequent to our fieldwork, FPE&O management provided a process flowchart to show various
scenarios for escalating compliance audit issues to FPE&O management. The scenarios included
Final Audit Report	                                                                 Page 22 of 39


failure to submit audit reports, substandard or untimely audits, qualified opinion and other
serious compliance issues. FPE&O informed us that all compliance audit reports are now being
reviewed and the checklists are signed off by the supervisor. Further, FSA stated that FPE&O
began the process of developing written policies and procedures in this area that will support the
process flows provided and expects a final product by May 30, 2009.

RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

3.1 	      Ensure the development and implementation of written procedures for reviewing the
           acceptability of compliance audit reports, and for tracking audit opinions other than
           unqualified opinions, audit findings, and implementation of corrective action plans.

3.2	       Ensure the procedures include requirements that acceptability checklist reviews are
           completed timely, supervisory reviews of completed acceptability checklists are
           documented, and PDLs are issued timely.

3.3	       Ensure the procedures include evidence of proper staff supervision in the review of
           compliance audit reports.

3.4	       Develop and implement a requirement for close monitoring in instances where FFEL
           Program participants received adverse or disclaimer of opinions, significant
           deficiencies noted in the internal control structure, and/or material non-compliance
           with laws and regulations. Incorporate in program determination letters requirements
           for submission of quarterly or semi-annual status reports to allow FSA to monitor the
           entities' implementation of corrective actions.

3.5	       Implement procedures to escalate significant financial and compliance related
           findings identified in audit compliance reports to FSA business units, and officials in
           OPE and OGC, as appropriate.


Published Minimum Reserve Ratios for Guaranty Agencies Were Not Calculated In
Accordance with Section 428(c)(9) of the HEA

Pursuant to the HEA, Section 428(c)(9) – Guaranty Agency Reserve Level, the guaranty
agencies under agreements with the Secretary are required to maintain in their Federal Student
Loan Reserve Fund a current minimum reserve ratio level of at least 0.25 percent of the total
attributable amount of all outstanding loans guaranteed by the agency. If any guaranty agency
falls below the required minimum reserve level in any two consecutive years, the guaranty
agency’s Federal reimbursement payments are reduced to 85 percent, or if the Secretary
determines that the administrative or financial condition of the guaranty agency jeopardizes the
guaranty agency’s continued ability to perform its responsibilities under its guaranty agency
agreement, then the Secretary of Education shall require the guaranty agency to submit and
Final Audit Report                                                                 Page 23 of 39


implement a management plan acceptable to the Secretary within 45 working days of any such
event. The management plan should include the means by which the guaranty agency will
improve its financial and administrative conditions to the legislatively mandated level within 18
months. The four guaranty agencies that have entered into Voluntary Flexible Agreements with
the Secretary are not subject to this requirement.

Based on our discussions with FSA management, review of prior year and current year reserve
ratio calculations, and the guaranty agencies’ management plans, we determined that the
financial conditions of the guaranty agencies were overstated, guaranty agencies were not
adequately monitored by PSG, and that the Federal fund reserve ratios published on the Financial
Partners website were overstated.

   The financial conditions of the guaranty agencies were overstated.

FSA determines the Federal fund reserve ratios using information provided by the respective
guaranty agencies reported on the Annual Form 2000, Guaranty Agency Financial Report. This
calculation utilizes the data from Line AR-26, entitled Ending Fund Balance, of Annual Form
2000 which represents the amount of the Federal Fund Balance. This balance is divided by the
total attributed amount of all outstanding loans (Original Principal Outstanding). This
calculation is referred to as the historical calculation. The Director of PSG stated that the
guaranty agency community expressed concerns that the historical method used for the
calculation of the Federal fund reserve ratios understates the financial strength of the guaranty
agencies. As a result, FSA management made revisions to the historical calculation method.
The new method for the calculation of the Federal fund reserve ratios includes an amount from
the Annual Form 2000, Line AR-56, entitled Allowances and Other Non-Cash Charges. This
amount is added to the Federal Fund Balance described above to arrive at a revised Federal Fund
balance.

The new method for calculating the Federal fund reserve ratios improperly overstates the
financial conditions of the guaranty agencies. There are several transactions in Line AR-56,
including allowance for loan loss and deferred Federal default fees. The concept of allowance
for loan loss was introduced to the Federal fund balance by FSA as part of the 1998
Reauthorization amendments which required guaranty agencies to return to the Department $250
million in reserve funds from fiscal years 2002, 2006, and 2007, with each agency's share being
based on a formula prescribed in the 1998 Reauthorization Amendments. Including the
allowance for loan loss in the calculation of the reserve ratios understates the Federal fund
balance exposure to future losses and overstates the solvency of the Federal fund balance. The
concept of allowance for loss is similar to the way FSA reports exposure to future losses in its
financial statements.

Deferred Federal default fees, which are part of Line AR 56, are not available for paying claims
until earned. Adding deferred fees to Federal fund balance overstates the Federal funds
resources available to pay claims and overstates the financial strength of the guaranty agencies.
Final Audit Report                                                                      Page 24 of 39


According to the Director of PSG, PSG is responsible for the monitoring of guaranty agencies
compliance with the Section 428(c)(9) of the HEA, which requires that the guaranty agencies
maintain a minimum Federal reserve ratio of 0.25 percent. In FY 2006, only 4 guaranty agencies
had Federal fund reserve ratios below 0.25 percent under the new method, compared with 16
guaranty agencies under the historical method. As a result of implementing the new method,
FSA runs the risk that there are 12 guaranty agencies that did not receive closer monitoring
mandated under the HEA. Under the historical method used for calculating Federal funds
reserve ratios, these 12 guaranty agencies would have had to file management plans and have 18
months to improve the Federal fund reserve ratios, or would have been subject to administrative
holds of their reimbursements. Also, the new method adopted for calculation of Federal fund
reserve ratio may not comply with the HEA. See Figure 1 for an illustration of the impact of the
new and historical calculation methods in assessing whether the guaranty agencies meet the
legislatively mandated minimum Federal fund reserve ratio of 0.25 percent.


FIGURE 1: FY 2006 FEDERAL FUND RESERVE RATIO COMPARISON OF NEW AND HISTORICAL
CALCULATION METHODS FOR SIX GUARANTY AGENCIES




                              0.400%

                              0.350%

                              0.300%
 Federal Fund Reserve Ratio




                              0.250%

                              0.200%
                                                                                           New
                              0.150%
                                                                                           Hi stori cal
                              0.100%

                              0.050%

                              0.000%
                                       GA 1   GA 2      GA 3       GA 4   GA 5   GA 6



                                                     Guaranty Agency




The Director of PSG was unable to provide an explanation for why the new method for
calculating the Federal fund reserve ratios better presented the financial solvency of the guaranty
agencies. The Director of PSG indicated that the decision to adopt the new method for 2006 was
made by the former COO, former Chief Financial Officer of FSA, and the former general
Final Audit Report                                                                  Page 25 of 39


manager of the FPS – all of whom are no longer employed by FSA. The Director of FSA’s PLI,
and officials of the Department’s OGC and OPE participated in the preliminary discussions
relating to the revision to the method used to calculate the Federal fund reserve ratios. However,
none of those officials formally concurred with the new method.

   Improvements were needed in PSG’s monitoring of guaranty agencies.

Improvements were needed in PSG’s monitoring of guaranty agencies to ensure that
management plans were submitted when required, or to exercise other administrative actions
(i.e., withhold a portion of reimbursements payments due guaranty agencies) when the required
management plans are not submitted to PSG after adequate notices had been provided to the
guaranty agencies. Based on the new method used to calculate the Federal fund reserve ratios,
PSG identified two guaranty agencies with two consecutive years (FY 2005 and FY 2006) of
Federal fund reserve ratios below 0.25 percent. According to the Director of PSG, management
plans were not requested for the two guaranty agencies because PSG was monitoring the
guaranty agencies under the management plans submitted for FY 2004 and FY 2005. We noted
that the management plans, referred to by the Director of PSG, were no longer effective for the
current period; therefore, PSG should have requested new management plans. PSG was unable
to provide evidence that other actions were taken to monitor the financial conditions of the
guaranty agencies. As a result, the guaranty agencies may not have received monitoring as
mandated under HEA.

   The Federal fund reserve ratios published on the Financial Partners website were overstated.

Based on information provided by the Director of PSG, due to growing concerns from the
guaranty agency community in FY 2003 regarding the Federal fund reserve ratios posted on the
Financial Partners website, FSA decided to review alternative methods used to calculate the
Federal fund reserve ratios. According to PSG’s briefing points on the minimum Federal fund
reserve ratios, FSA noted that the posted Federal fund reserve ratios were consistently low and
the guaranty agencies did not like the fact that the public could review these Federal fund reserve
ratios. To address the guaranty agencies’ concerns, published Federal fund reserve ratios for FY
2003, FY 2004 and FY 2005 were recalculated based on a new methodology. This new
methodology was not consistent with FSA internal Federal fund reserve ratios used to monitor
the guaranty agencies. The Director of PSG stated that the guaranty agencies are aware of the
differences between the published and internal Federal fund reserve ratios, and that members of
the general public who want the official Federal funds reserve ratios, calculated using the
historical calculation, can file Freedom of Information Act requests. Because the Federal fund
reserve ratios posted on the FSA website are not sanctioned by FSA management to assess the
financial conditions of the guaranty agencies, the Congress, general public and oversight
agencies (i.e., GAO, OMB, etc.) may rely on guaranty agency financial information that is
misleading.

PSG informed us that it will seek formal concurrence from OGC, OPE and PLI that the new
method adopted in FY 2006 for the calculation of Federal fund reserve ratios is in compliance
with the HEA.
Final Audit Report	                                                                 Page 26 of 39


RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

3.6	   Suspend the new method adopted for the calculation of the Federal fund reserve ratios
       until FSA obtains formal concurrence from PLI, OPE, and OGC that the new method is
       in compliance with the HEA.

3.7	   Ensure that PSG establishes and implements controls to appropriately monitor guaranty
       agencies with Federal fund reserve ratios below 0.25 percent in two consecutive years by
       providing notification to guaranty agencies of the requirement to submit management
       plans, ensuring the plans are submitted, and monitoring the implementation of the
       management plans to ensure that the guaranty agencies reach the mandated Federal
       reserve ratio within 18 months.

3.8	   Recalculate the Federal fund reserve ratios available on FSA's website under the
       historical method until approval is received for the new method.

3.9	   Ensure that the new method for calculating the Federal fund reserve ratios presented on
       FSA's website is consistent with Federal fund reserve ratios used by FSA to monitor the
       guaranty agencies financial condition.


Reviews Conducted Under the Common Review Initiative May Not Have Satisfied
Guaranty Agencies’ Obligations to Conduct Reviews of Lenders

Each guaranty agency is required by enabling FFEL Program law and regulations (34 CFR
682.410(c)) to perform comprehensive biennial on-site program reviews of lenders whose dollar
volume of FFEL loans made or held by the lender and guaranteed by the guaranty agency in the
preceding year is equal to or greater than two percent of the total of all loans guaranteed in that
year by the agency; or was one of the ten largest lenders whose loans were guaranteed in that
year by the guaranty agency; or equal to or greater than $10 million in the most recent fiscal
year. At the request of the National Council of Higher Education Loan Programs, Inc.
(NCHELP), which represents guaranty agencies, lenders and servicers, FSA approved the CRI
process to comply with these requirements.

The CRI is a concept designed to create efficiencies and consistency in lender program reviews
conducted by guarantors. Participating CRI guarantors cooperate to conduct lender reviews using
common review procedures. CRI was intended to eliminate redundant guarantor reviews. The
CRI was in a pilot phase from January 1, 2004 to December 31, 2007. FSA approved the CRI
process on an ongoing basis beginning January 1, 2008. The approval will remain in effect
unless and until the Department notifies the guaranty agencies that the CRI process cannot be
used. In addition, a review of the entity’s compliance with LaRS requirements, consolidation
rebate fees and inducements was added to the scope of the CRI reviews to be performed by
guaranty agencies.
Final Audit Report	                                                                     Page 27 of 39


CRI reviews focus on conducting comprehensive reviews at a servicer level rather than at a
lender level. CRI reviews test lenders’ compliance with regulatory requirements and Common
Manual policies. CRI reviews cover the 14 elements outlined in the Lender/Servicer Review
Guide including deferments, forbearance, disbursements, credit bureau reporting, and
reconciliations of billings. According to NCHELP’s website, in 2004 and 2005, 11 CRI reviews
were conducted which covered 248 reviews required by the regulations, resulting in the
elimination of 237 individual lender reviews. In 2006 and 2007, 13 CRI reviews were completed
through report issuance.

Based on our inquiries of FSA management and review of CRI reports, we noted matters relating
to CRI reviews that identify issues with respect to guaranty agencies’ compliance with the
requirements of 34 CFR 682.410(c).

   The use of the Common Manual in the CRI reviews to ascertain lenders’ compliance with
    FFEL Program requirements may not satisfy the guaranty agencies’ obligations to conduct
    reviews of lenders.

The Common Manual was developed by the NCHELP and approved by its governing board.
According to NCHELP, the Common Manual provides a single, standardized set of current
student loan rules and FFEL Program policy guidance for schools and lenders. Both OPE and
PLI indicated that the Common Manual is not sanctioned by the Department; hence, it is not an
authoritative guide for ascertaining lenders’ compliance with FFEL Program law and regulations.
According to the CRI Lender Servicer Program Review Guide, the Department’s participation in
the CRI review process does not constitute an endorsement of the Common Manual. While the
Director of FPE&O referred to the Common Manual as a reference tool, there were instances in
the CRI reports in which the Common Manual was the sole document cited to support certain
lenders non-compliance with FFEL Program law and regulations. The Common Manual may
not reflect the most current regulations or may be incorrect; as a result, the CRI reviews may not
be conducted properly.

   The sampling method used was not consistent and not susceptible to projection.

In accordance with the 34 CFR 682.410(c), the guaranty agency is required to conduct
comprehensive biennial on-site program reviews of lenders, using statistically valid techniques to
calculate liabilities to the Secretary that each review indicates may exist. Utilizing the guidance
provided in the CRI Lender/Servicer Program Review Guide, an initial sample of 29 items is
selected based on a 95 percent confidence level and tolerable error rate of 10 percent. In
accordance with the American Institute of Certified Public Accountants (AICPA) Audit
Sampling Guide referenced in the CRI Lender/Servicer Program Review Guide, if no instances
of noncompliance are noted in the 29 samples, the testing is considered complete. If 1 critical
error is noted in the sample of 29, the sample size is increased to 46; if 2 critical errors are noted,
the sample size is increased to 61 from 46; and the process continues until the maximum sample
size of 179 is reached and maximum of 11 critical errors are discovered in the sample. We noted
instances in the CRI review reports in which the sample size was not increased even though
critical errors were discovered during the reviews. In 1 case, for Servicer A, 4 errors were noted
Final Audit Report	                                                                Page 28 of 39


in a sample of 29 borrowers. However, the sample size was neither increased nor the error
projected to the entire population even though the 4 errors exceeded the sampling tolerable error
rate of 10 percent. Out of the 13 CRI review reports examined, there were errors in the
application of the AICPA Audit Sampling Guide in 11 reviews.

Of the 13 CRI reviews completed in 2006 and 2007, only 1 included calculation of funds due to
the Department – a liability of $326.05. During FY 2006 and FY 2007, FSA disbursed
approximately $20 billion in interest subsidy payments to all lenders participating in the FFEL
Program. As a result, errors may not be identified and fully developed, and improper payments
made to lenders may not be returned to the Department.

   The tolerable error rate of 10 percent was too high.

The FPE&O has established a tolerable error rate of 10 percent in the sampling plan for all
program reviews, including the CRI reviews. The tolerable error rate is the maximum errors in
the population that the examiner would be willing to accept and still conclude that the results
from the sample have achieved the review objectives. Based on discussions with a regional
director who represents FSA in the CRI Council, the original sampling methodology for the CRI
review was reviewed by one of the Department’s statisticians.

The use of a tolerable error rate of 10 percent possibly exposes the government to significant
losses. In FY 2007, FSA reported in its financial statements interest subsidy payments of
approximately $11 billion, claim payments of $6 billion, and fee collections of $4 billion.
Applying an error rate of 10 percent, projected errors of $1.1 billion in interest subsidy
payments, $600 million in claim payments and $400 million in loan origination fees would not
be deemed material.

As stated above, we noted that the CRI review teams increased sample size when errors in the
sample population exceeded the allowable errors in some instances. In other instances, when the
errors exceeded the tolerable error rate of 10 percent, the review team neither calculated the
liability nor increased the sample size.

   The samples selected in CRI reviews did not provide coverage of all lenders listed in the CRI
    report.

Under CRI, lenders’ compliance with the requirements of the FFEL Program are evaluated at
lender identification number level. Most of the large and national lenders participating in the
FFEL Program have multiple lender identification numbers. For CRI reviews performed in the
2006 - 2007 cycle, we found instances in which CRI reviews covered over 60 lender IDs. In the
review of the 14 elements in the Lender/Servicer Review Guide, a statistical sample of 29 loans
was selected for each review element. We noted that in the CRI reviews, the majority of the
lenders IDs were not represented in the samples for any of the elements in the review guide. For
example, for five of the servicers reviewed in the 2006 and 2007 CRI review cycle, we noted the
following results:
Final Audit Report	                                                                 Page 29 of 39


    •	 Servicer A: 63 Lender IDs included in the CRI – 36 Lender IDs with           no borrowers
                   sampled, 15 Lender IDs with 3 or fewer borrowers sampled.
    •	 Servicer B: 17 Lender IDs included in the CRI – 6 Lender IDs with            no borrowers
                   sampled, 4 Lender IDs with 3 or fewer borrowers sampled.
    •	 Servicer C: 52 Lender IDs included in the CRI – 24 Lender IDs with           no borrowers
                   sampled, 14 Lender IDs with 3 or fewer borrowers sampled.
    •	 Servicer D: 77 Lender IDs included in the CRI – 37 Lender IDs with           no borrowers
                   sampled, 23 Lender IDs with 3 or fewer borrowers sampled.
    •	 Servicer E: 6 Lender IDs included in the CRI – 3 Lender IDs with             no borrowers
                   sampled, 1 Lender ID with 3 or fewer borrowers sampled.

The guaranty agencies have not fulfilled their responsibility to review those lenders for which no
transactions were sampled. It is questionable whether the lenders for whom a very small number
of borrowers were reviewed should also be considered adequately reviewed. The sample size is
not sufficient, considering the inherent risks of the FFEL Program and the large volume of the
transactions processed for the guaranty agencies, to support a reliable conclusion on the lenders’
compliance with federal law, regulations and guarantors’ policies.

 As indicated in the CRI Lender/Servicer Program Review Guide dated July 1, 2007, “If there are
multiple servicers for a specific lender number, and a CRI program review is not scheduled to be
performed at each of the servicers, the affected guarantor will need to determine whether it needs
to conduct a separate program review of that servicer. The affected guarantor will need to
contact its ED regional office in these instances. These reviews will not be covered under the
CRI process.” As a result, in instances where a lender ID is serviced by multiple loan servicers,
the CRI reviews do not cover all transactions of the specific lender IDs unless the CRI reviews
are scheduled for all the servicers. There were no written procedures in place to ensure that the
guaranty agencies perform program reviews for each of the servicers where a lender number has
multiple servicers.

   Lender billing reviews were not conducted on all CRIs.

Review procedures related to the LaRS billings were neither performed by FPE&O nor
guarantors for 13 of the 15 CRI reviews performed by the guaranty agencies in 2006 and 2007.
LaRS billings are used by the lenders to invoice FSA for interest subsidies and report loan
origination fees collected by the lenders on behalf of FSA. According to FSA audited financial
statements, for both FY 2006 and FY 2007, interest subsidy payments and fee collections totaled
approximately $20 billion and $7.8 billion, respectively.

In our discussion with a regional director who represents FSA on the CRI Council, the proposal
for the continuance of the CRI pilot program included a request for clarification on who was
responsible for performing the review procedures related to the entity’s compliance with the
LaRS. FPE&O performed reviews of LaRS billings for all of the CRI reviews conducted in 2004
and 2005. According to the regional director, it was the understanding of the guaranty agencies
that FPE&O was responsible for performing reviews of the LaRS billings. However, because the
clarification on the party responsible for reviews of LaRS billings was not issued until December
Final Audit Report                                                                Page 30 of 39


21, 2007, LaRS billings reviews were not performed in most CRIs for the 2006-2007 cycle.
FPE&O performed LaRS reviews on 2 of 15 CRI reviews conducted in 2006 and 2007. Because
LaRS billings have not been reviewed for 13 of 15 CRI reviews conducted during FY 2006 and
FY 2007, loan origination fees collected by the lenders on behalf of FSA may have been
inaccurate, and interest subsidy payments to lenders may be improper.

On December 21, 2007, FSA approved the CRI process, which will remain in effect unless and
until the Department notifies the guaranty agencies that the CRI process cannot be used. As part
of the condition for approval, FSA, NCHELP and the CRI Council agreed that the CRI scope
would include review of entities’ compliance with LaRS requirements. This agreement would
have no impact on the 13 CRI reviews completed in the 2006 and 2007 CRI review cycle for
which LaRS billings were not reviewed.

   CRI workpapers were not reviewed in a timely manner.

According to a regional director who represents FPE&O on the CRI Council, FPE&O does not
review CRI reports and workpapers until the end of the CRI review cycle. As a result, as of
March 2008, the workpapers for the 13 CRI reviews completed in 2006 and 2007 by the
guaranty agencies have not been reviewed by FPE&O. Timely review of the CRI workpapers
should ensure that deficiencies in the execution of the CRI review procedures (e.g., errors in
defining appropriate population for CRI review) are detected timely and properly communicated
to the CRI review teams for correction in subsequent CRI reviews. Also, patterns of
misapplication of the HEA and regulations noted during the CRI reviews should be identified
and communicated to the guaranty agencies and servicers in a timely manner.

RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

3.10       Require the CRI review teams to discontinue use of the Common Manual and rely
           only on the HEA, regulations, Departmental guidance and instructions as review
           criteria.

3.11       Suspend the CRI reviews until FPE&O obtains formal concurrence from PLI, OPE,
           and OGC that the CRI reviews meet the requirements for guaranty agencies’ biennial
           program reviews of certain lenders as prescribed by 34 CFR 682.410 (c).

3.12       Develop a sound statistical sampling plan that is consistent with practices in the
           Federal government and industry, and establish tolerable error rates and confidence
           levels that appropriately reflect the level of risks in the FFEL Program.

3.13       Exclude Lender IDs serviced by multiple servicers from the scope of CRI reviews
           unless the CRI reviews cover all the multiple servicers.
Final Audit Report	                                                                 Page 31 of 39


3.14       Ensure that the Director of FPE&O enforces the requirements for the guaranty
           agencies to perform the LaRS billings procedures during the CRI reviews.

3.15	      Ensure that the Director of FPE&O requires guaranty agencies to complete, or has
           FPE&O staff complete, the review of the LaRS billings for the remaining 13 CRI
           reviews performed during the 2006–2007 cycle.

3.16	      Require FPE&O to enhance its oversight of the CRI reviews to include timely review
           of CRI workpapers.


Incompatible Duties Were Not Separated and No Written Procedures Were in Place for
Providing Technical Assistance to Guaranty Agencies, Lenders and Servicers

According to GAO’s Internal Control Standards, key duties and responsibilities need to be
divided or segregated among different people to reduce the risk of error or fraud. Also, a good
internal control environment requires that the agency’s organizational structure clearly define
key areas of authority and responsibilities and establish appropriate lines of reporting.

Based on discussions with FPE&O management and personnel, and the review of FSA
documents, we determined that incompatible duties are not separated.

FPE&O did not have written policies and procedures and an organizational structure that help to
ensure that incompatible duties of oversight and monitoring of FFEL Program participants are
segregated from technical assistance. We noted that the review specialists were providing
technical assistance on issues which they may be expected to perform a program review of the
entity at a later date; or which they may not have the technical expertise to address. Based on
the FSA Functional Statement for Program Compliance, one of the functions of FPE&O is to
provide technical assistance to guaranty agencies, FFEL Program lenders and related agencies or
organizations on the proper administration and management of the FFEL Program. It further
states that each regional component (office) is responsible for, among other things, providing
technical assistance to lenders, guaranty agencies, the general public, and congressional offices,
through site visits, follow-up reports, correspondence (e.g. email) and telephone
communications. In addition, the Director of FPE&O stated that technical assistance is
communicated to the FFEL Program participants during FSA conferences.

We also found in our discussions with the review specialists and review of the FSA’s website
that the states within the regions are allocated among review specialists to address technical
assistance and policy related inquiries and questions. In one instance, a regional director
indicated that the specialists were not supposed to provide technical assistance because it was
considered a conflict of interest. However, the same regional director provided us with a form
Final Audit Report	                                                                                   Page 32 of 39


 utilized by the review specialists to address questions received from the FFEL Program
 participants that may require input from offices outside of FPE&O (e.g. OPE or PLI). 13

RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

3.17	        Develop and implement procedures to ensure that FPE&O oversight and monitoring
             duties are segregated from technical assistance to the FFEL Program participants.


FINDING NO. 4 – FSA Lacked Written Procedures on Sharing Information Related
                to Policy Guidance and Program Reviews

According to GAO’s Internal Control Standards, “Pertinent information should be identified,
captured, and distributed in a form and time frame that permits people to perform their duties
efficiently.”

We found that FPE&O has not established a formalized process for obtaining and tracking policy
decisions related to the proper application of the HEA and FFEL Program regulations, or to
resolve issues consistent with Department policy or prior determinations. Nor were there
appropriate processes in place to share and disseminate policy decisions.

According to our discussions with FPE&O regional directors and staff, and the Director of PLI,
under the current FSA process, policy and legal related issues can be directed to FPE&O, PLI,
OPE, and/or OGC. PLI is responsible for identifying and analyzing policy issues, serving as
liaison with OPE and OGC, and disseminating policy determinations to appropriate FSA staff.
OPE is responsible for formulating federal postsecondary education policy including policy
relating to the federal student financial assistance programs, and collecting and disseminating
student financial assistance program data. Lastly, OGC is responsible for providing legal advice
to Departmental offices.

We noted the following matters during our review of the internal controls related to policy and
legal interpretations:

    There were no written procedures in place to share program review reports that contain
     sensitive issues, political issues, and/or areas where OPE or OGC has expressed an interest to
     ensure that program review findings are consistent with laws and regulations.

Based on a discussion with an OPE official, the School Eligibility Channel (SEC), which is
responsible for providing integrated oversight and management improvement services to
institutions receiving Federal student financial assistance program funds, shares draft PDLs with

13
  In the prior OIG audit report, the auditors found that there was a lack of technical assistance procedures and no

process for monitoring the quality of technical assistance.

Final Audit Report                                                                                            Page 33 of 39


OPE at least 48 hours prior to the issuance of the program review reports. The PDLs are shared
for program reviews with findings or issues that are considered sensitive, political, or of interest
to OPE. We found that neither program review reports nor PDLs issued by FPE&O are currently
shared with OPE. As a result, FPE&O runs the risk that program review findings and/or
proposed corrective actions may not be consistent with the HEA and the Department’s policies.

As presented in Finding 3, FSA management did not have written procedures in place to escalate
significant audit findings identified by the lender’s independent auditors to the appropriate
officials. 14

    FPE&O management lacked a tracking system for policy related matters.

FPE&O has not implemented a tracking system for policy related issues and determinations,
whether issues remain settled or unsettled. We noted that when FPE&O personnel identify
policy related issues related to the proper application or resolutions of FFEL Program
requirements that are unusual, unsettled, controversial, or that require extensive research and
review, they request guidance from the PLI, OPE, and/or OGC. The responses to policy
questions are not timely. Based on a discussion with the Director of PLI, many of these issues
are discussed during conference call meetings and there is no process for tracking policy issues.

We requested documentation of policy issues addressed by PLI and FPE&O between October 1,
2006 and February 28, 2008. The Director of PLI could only provide a schedule of policy topics
addressed during the meetings. The schedule, which was prepared based solely on our request,
was a summary of the Director’s of PLI calendar. The Director of PLI was only able to provide
the discussion topics for the most recent 8 months, not the 17 months requested. The schedule
was not sufficient to obtain an understanding of how policy issues are addressed, resolved, or
timeliness of responses.

Also, bimonthly meetings are held between FSA, OPE, and OGC to discuss policy issues related
to all aspects of the Title IV programs. According to an OPE official, there are no meeting
minutes kept for the bimonthly meetings; the agenda serves as the only documentation that the
meeting occurred. The OPE official indicated that FPE&O and FPS management should take
notes on policy discussions relating to FSA and implement the consensus reached by the
participants.

A formal tracking system and minutes of bimonthly meetings of FFEL Program policy issues
and determinations can serve as a knowledge base for decision making and for responding timely
to issues related to FFEL Program.




14
   This finding was consistent with the finding noted in the prior OIG audit report in which the auditors found that there was no
documented process to regularly obtain OGC review and advice on program reviews and other significant program
determinations.
Final Audit Report                                                                               Page 34 of 39


    There were no written procedures for providing technical assistance.

Consistent with the OIG’s prior audit finding, 15 we found that FSA management has not
established formalized policies and procedures for providing technical assistance to the guaranty
agencies, lenders and servicers. The regional directors are not always informed by the program
review specialists of technical assistance questions and inquiries received from the FFEL
Program participants. In many cases, if the review specialist feels the question can be answered,
they perform their own research and provide a response. One review specialist stated that there
are no formal procedures for monitoring or escalating technical assistance to the regional
director. Review specialists also stated that they are not aware of any formalized procedures for
tracking technical assistance; they use their judgment to address technical assistance matters. In
one discussion with an FPE&O management official, the official stated that FPE&O personnel
do not provide technical assistance as a distinct activity; but rather, FFEL Program participants
are informed if they are not in compliance with laws and regulations, and are provided
information as to how to become compliant which in itself is technical assistance.

Also, FPE&O management was not always informed of policy and legal interpretations.
According to our discussions with Departmental staff and managers, when review specialists
have questions about the proper application or resolution of FFEL Program requirements, they
can submit questions and inquiries via email or telephone directly to FPE&O, PLI, OPE, or
OGC. In most cases, when questions involve settled issues under the HEA, regulations, or prior
policy determinations, responses are usually sent directly to the review specialists who submitted
the questions.

Overall, review specialists have different approaches to providing technical assistance. We
noted that when technical assistance is provided via telephone, review specialists did not
document the technical assistance questions or responses provided to the FFEL Program
participants. In cases when technical assistance was documented, the review specialist typically
documented responses in the review specialist’s personal files or in the FFEL Program
participants’ files.

A written process for providing technical assistance promotes common and uniform
understanding of the FFEL Program law and regulations among stakeholders, ensures
consistency in the answers provided to FFEL Program participants, and standardizes procedures
for informing FPE&O management of technical assistance matters.

Subsequent to our fieldwork, on May 16, 2008, OPE issued an operating procedure entitled,
“Request for Policy Guidance from Federal Student Aid Components.” If implemented as
written, the operating procedure should address issues noted above related to a tracking system
for policy-related matters, including the timeliness of responses. The new Standards issued by
FSA on May 1, 2008, also provide guidelines for requesting guidance on program review



15
  The prior OIG audit report presented findings related to the lack of technical assistance procedures. The report
specifically noted that Financial Partners had no written procedures for documenting technical assistance.
Final Audit Report	                                                                  Page 35 of 39


findings. These policies do not address issues noted related to the lack of written policy and
procedures on providing technical assistance.

RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA take action to:

4.1 	   Ensure effective implementation of the operating procedure on providing policy guidance
        and procedures, including monitoring for compliance with timeframes established.

4.2	    Develop and implement written policies and procedures for sharing program review
        reports and PDLs with significant policy issues with PLI, OPE, and/or OGC before they
        are issued.

4.3	    Develop and implement written policies and procedures on providing technical
        assistance, including the staff that should and should not provide technical assistance, and
        how such assistance is to be documented.


FINDING NO. 5 – FSA’s Implementation of Corrective Actions

 Audit follow-up is an integral part of good management, and is a shared responsibility of
management officials and auditors. Corrective actions taken by management to resolve findings
and implement recommendations in timely manner are essential to improving the effectiveness
and efficiency of its operations. We found that FSA had not timely implemented corrective
actions for the prior OIG report, and that the status of some corrective actions were not
accurately reported in AARTS.

According to OMB Circular A-50, Audit Followup, an agency’s audit follow-up system should
require prompt resolution and corrective actions on audit recommendations. Resolution shall be
made within a maximum of six months after issuance of a final report. Corrective action should
proceed as rapidly as possible. GAO’s Internal Control Standards state that, “monitoring of
internal control should include policies and procedures for ensuring that the findings of audits
and other reviews are promptly resolved. Also, managers are to (1) promptly evaluate findings
from audits and other reviews, including those showing deficiencies and recommendations
reported by auditors and others who evaluate agencies’ operations, (2) determine proper actions
in response to findings and recommendations from audits and reviews, and (3) complete, within
established time frames, all actions that correct or otherwise resolve the matters brought to
management’s attention.

The Inspector General Act of 1978, as amended, Title 5 U.S.C., Appendix, states, “The head of a
Federal agency shall make management decisions on all findings and recommendations set forth
in an audit report of the inspector general of the agency within a maximum of six months after
the issuance of the report…The head of a Federal agency shall complete final action on each
management decision…within 12 months after the date of the inspector general’s report.” FSA
Final Audit Report	                                                                Page 36 of 39


management officials are responsible for receiving and analyzing audit reports, providing timely
responses to the audit organization, and taking corrective action where appropriate. A corrective
action is considered resolved when the FSA management and the audit organization agree on the
action to be taken on reported findings and recommendations. When FSA management has
concluded that all necessary actions with respect to the findings and recommendations in the
audit report have been executed, the corrective actions are then considered complete.

FSA had not timely implemented corrective actions to address all of the 17 recommendations in
the prior OIG audit report, dated September 29, 2006. The audit recommendations were
resolved on September 4, 2007 – nearly a year after the final report was issued. During our
review, FSA and OIG staff periodically provided us with Corrective Action Plans (CAPs) from
the Department’s Audit Accountability and Resolution Tracking System (AARTS). The
following chronology is provided:

    •	 As of August 28, 2007, prior to the start of the current audit, the CAP showed that 3 of
       the 17 corrective actions had been completed, and 14 remained open. This CAP showed
       that of the 14 open actions, the proposed completion date for 11 had been extended – 9
       for an additional 3 to 6 months, and 2 indefinitely (no revised completion date was
       recorded).
    •	 As of November 7, 2007, the CAP showed the same 14 corrective actions still awaiting
       completion.
    •	 As of March 5, 2008, the same 14 corrective actions awaited completion.
    •	 Between March 5, 2008, and July 1, 2008, FSA reported an additional 13
       recommendations as complete.
    •	 On August 27, 2008, FSA provided the final CAP, which reported completion of the last
       open recommendation.

Of the 17 total corrective actions, between August 2007 and March 2008, we noted that only two
corrective actions were completed by the proposed completion dates. For the remainder,
proposed completion dates were extended once for 8 corrective actions and twice for 7 corrective
actions.

To obtain an understanding of the delay in completing corrective action plans, we made inquiry
of the Director of FPE&O who was designated as the responsible manager on 14 of the 17
recommendations. The Director attributed the delay in completing the recommendations in the
OIG report to issues related to the transition phase resulting from the FSA reorganization that
was implemented in March of 2006. The Director also indicated that there were other priorities
that FSA had to address with the resources available. The Manager of Program Compliance,
who has direct authority over FPE&O, attributed the delay in implementation of the corrective
actions to the development of the program review standards.

We also noted instances where FSA’s corrective actions did not adequately address the OIG
recommendations. Our assessment of the corrective actions taken by FSA related to the prior
OIG recommendations is presented in Appendix A. In summary, we found that the status of
Final Audit Report	                                                                               Page 37 of 39


corrective actions for 8 of the 17 recommendations (47 percent), was not accurately recorded in
AARTS:

       •	 Corrective actions to address 5 recommendations in the prior report were not fully
          implemented (Recommendations 1.2, 2.3, 2.5, 2.6, and 4.2), and

       •	 Corrective actions to address another 3 recommendations had not been accomplished by
          the date the actions were reported as completed (Recommendations 1.4, 1.5, and 2.2).
          These corrective actions were noted as completed with the issuance of the FPE&O
          standards on May 1, 2008. However, when a corrective action was to implement a new
          process, additional steps are needed to ensure effective implementation beyond merely
          issuing a policy. Actions must be taken to ensure staff are following the policy. Some
          of the recommendations in this category may still require corrective action to be
          considered completed.

This finding is consistent with a prior audit of FSA’s audit followup system that noted FSA’s
audit followup process did not support the completion of all corrective action items, or that the
process did not always support completion of corrective action items on the date reported in
AARTS. 16

Please see Appendix A for details on the evaluation of corrective actions planned and taken for
each recommendation in the prior OIG report.

RECOMMENDATIONS:

We recommend that the Under Secretary ensure that the COO for FSA takes action to:

5.1	      Reconsider Recommendations 1.2, 2.3, 2.5, 2.6, and 4.2 from the prior OIG audit marked
          as “complete” to assess if the implemented actions adequately addressed the OIG
          recommendations, and update AARTS accordingly.

5.2	      Evaluate the accuracy of the completion dates recorded for Recommendations 1.4, 1.5,
          and 2.2 from the prior OIG report, and update AARTS accordingly.




16
   Audit Followup Process for Office of Inspector General Internal Audits in Federal Student Aid, dated September
8, 2005.
Final Audit Report                                                                  Page 38 of 39




                  OBJECTIVE, SCOPE, AND METHODOLOGY



Our audit objective was to evaluate the appropriateness and effectiveness of FSA internal control
to ensure that guaranty agencies, lenders and servicers are performing in accordance with
relevant laws, regulations and guidance. The audit period is October 1, 2006 to March 31, 2008.
Our audit was performed in accordance with the GAO’s Standards for Internal Control in the
Federal Government and Internal Control Management and Evaluation Tool, and the OMB’s
Circular A-123, Management’s Responsibility for Internal Control, and government auditing
standards generally accepted in the United States. We did not perform an internal control review
over FSA’s entire organizational structure. Specifically, we evaluated those controls that solely
pertained to FPE&O and PSG’s monitoring activities, in which we identified weaknesses
detailed in the audit findings.

We gained an initial understanding of the operations at FPE&O and PSG by reviewing the HEA,
GAO reports, and U.S. Department of Education OIG reports, FY 2007 Performance and
Accountability Report, FY 2007 OMB Circular A-123 reports, and other available documents
and reports as deemed appropriate.

We reviewed 13 CRI review reports issued by the guaranty agencies, and workpapers for two
program reviews completed by the northern region. At PSG we obtained an understanding of the
criteria used to identify lenders who are required to provide compliance audit reports and the
procedures employed to monitor lenders with material weaknesses. In addition, we gained an
understanding of the procedures for computing the guaranty agencies Federal fund reserve ratios
under the historical and new methods. We recalculated the Federal fund reserve ratios for FY
2006 under the historical method and compared our results with PSG Federal fund reserve ratios
under the new method.

We conducted interviews with the regional directors and all the review specialists at the northern
(Chicago, Illinois) and southern (Dallas, Texas) regions, and the Atlanta duty station. We chose
these two regions because we determined that the regional director at the northern region has a
dual responsibility of being the regional director for the western region (San Francisco) which
gives us an insight into the oversight activity at the western region. Dallas was selected because
it conducted one of the largest number of program reviews during FY 2007. The Atlanta duty
station was selected because it is under the southern region, and its two senior review specialists
have significant institutional knowledge of the oversight of the FFEL Program.

At FSA Headquarters in Washington, D.C., we interviewed management and officials of various
business units including FPE&O, Program Compliance, Business Operations, FPS, Partner
Systems Group, PSG, ERMG, and PLI. In addition, we made inquiries of staff of the OGC,
OPE, and OIG – Investigations.
Final Audit Report                                                            Page 39 of 39


Our entrance conference was held on November 6, 2007. We discussed the results of our audit
with FSA management in an exit conference held on May 22, 2008. Our audit was conducted in
accordance with Government Auditing Standards appropriate to the scope of the review
described above.
                                                                       Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and

                          Servicers Needs Improvement


Assessment of FSA’s Corrective Actions Taken to Address OIG recommendations
in the report entitled “Review of Financial Partners’ Monitoring and Oversight of
     Guaranty Agencies, Lenders, and Servicers,” issued September 29, 2006


Recommendation 1.1      Include compliance monitoring of guaranty agencies, lenders,
                        and servicers in the tactical goals of FSA's strategic plan.
Original Proposed
Completion Date         06/29/2006
Status Reported         Completed, 06/29/2006
FSA Planned             Incorporate specific tactical Action Steps from the Annual
Corrective Action       Performance Plan in Appendix A of the FY 2006-2010 Five-
                        Year Plan
Auditor Assessment      We reviewed the FY 2006-2010 Five Year Plan, and confirmed
of Action               that FSA included compliance monitoring of guaranty agencies,
                        lenders, and servicers in the tactical goals of FSA's strategic
                        plan. This corrective action was completed.


Recommendation 1.2     Amend the Financial Partners' mission statement to better
                       emphasize compliance and clarify the role of Financial Partners.
                       Amend the functional statements for Financial Partners and
                       Program Compliance to establish clear lines of responsibility
                       and authority for oversight, monitoring, and compliance
                       enforcement.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 07/18/2008
FSA Planned            Consolidate all program compliance functions under a single
Corrective Action      unit reporting directly to the Chief Operating Officer and made
                       changes to the function statements to reflect the consolidation.
Auditor Assessment     We confirmed that all program compliance functions were
of Action              consolidated under a single unit reporting directly to the Chief
                       Operating Officer. However, our query of FSA website on
                       August 28, 2008, did not show changes to the functional
                       statement to reflect consolidation of program compliance
                       functions. This corrective action was not fully completed.

                       In addition, during our review, we noted that FPE&O did not
                       have the policies and procedures, and organizational structure
                       that help to ensure that incompatible duties of oversight and
                       monitoring of FFEL Program participants are segregated from



                                                                                          i
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

                       technical assistance. (See Findings 3 and 4 for more details.)


Recommendation 1.3     Eliminate the organizational conflict of interest by removing the
                       State Agency Liaison from any involvement in oversight and
                       monitoring.
Original Proposed
Completion Date        06/24/2007
Status Reported        Completed, 07/08/2007
FSA Planned            Reassigned the State Agency Liaison to other duties, and the
Corrective Action      position will not be filled.
Auditor Assessment     Based on our inquiry of the Acting Director of FPS and review
of Action              of the FSA Organizational Structure, we determined that State
                       Agency Liaison had been removed from the oversight and
                       monitoring of guaranty agencies, lenders and servicers.
                       However, changes have not been made to the FSA functional
                       statements to reflect the elimination of the functions of the State
                       Agency Liaison. The planned corrective action was completed.
                       However, FSA should also update the functional statement to
                       reflect the changes made.


Recommendation 1.4     Require Financial Partners to stop recording as lender program
                       reviews, program reviews that are actually only servicer
                       reviews.
Original Proposed
Completion Date        03/31/2008
Status Reported        Completed, 04/28/2008
FSA Planned            Federal Student Aid will enhance PEPS so that servicer reviews
Corrective Action      reflect the lenders that are covered as part of the review. These
                       lenders will not be given a PRCN and therefore will not be
                       counted in the lender review counts.
Auditor Assessment     We reviewed the copy of FSA’s announcement to all PEPS
of Action              users and supervisors titled “PEPS April 2008 Software Release
                       (RL 0804B),” dated April 28, 2008, the date this action was
                       recorded as completed. We noted that the announcement
                       referred to planned updates to PEPS. Because the updates to
                       PEPS had not yet been made, this corrective action was not
                       completed as of the date recorded.




                                                                                             ii
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement


Recommendation 1.5     Develop a consistent policy for identifying, quantifying, and
                       reporting all liabilities identified in program reviews regardless
                       of whether they are resolved.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 05/01/2008
FSA Planned            Federal Student Aid will evaluate the processes and implement
Corrective Action      procedures for identifying, quantifying, and reporting liabilities
                       for schools and tailor those processes for program reviews at the
                       guaranty agencies, lenders, and servicers.
Auditor Assessment     Subsequent to the scope of our audit, on May 1, 2008, FSA
of Action              issued new Standards related to program reviews. We reviewed
                       the Standards and noted the Standards included policy for
                       identifying, quantifying and reporting liabilities identified
                       during program reviews. If the Standards are implemented as
                       written, they should satisfy the corrective action stated.
                       However, the corrective action to implement procedures was
                       recorded as completed on the day the Standards were issued.
                       The completion date for successful implementation should not
                       be recorded until FSA has assurance that the new Standards
                       have indeed been implemented by FSA staff and are achieving
                       their designed purpose. This corrective action was not
                       completed as of the date recorded.


Recommendation 1.6     Request an amendment to the Chief Operating Officer's
                       delegation of authority for waiving liabilities to include
                       additional controls for monetary limitations and consultation
                       with other Department officials. Eliminate the redelegation to
                       the Financial Partners' General Manager, and include
                       appropriate controls in a replacement redelegation to the
                       appropriate Program Compliance Officer. Ensure that managers
                       and staff know and understand the delegation of authority for
                       waiving liabilities.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 07/01/2008
FSA Planned            Federal Student Aid will request an amendment to the Chief
Corrective Action      Operating Officer’s delegation of authority for waiving program
                       review and audit liabilities to include additional controls for
                       monetary limitations and consultation with other Department



                                                                                        iii
                                                                        Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

                       officials. The delegation will be redelegated to the appropriate
                       Program Compliance official. Staff will be informed via memo
                       of the changes so that they know and understand the delegation
                       of authority for waiving liabilities.
Auditor Assessment     We reviewed the delegation of authority from the Secretary to
of Action              the FSA COO, noting that the delegation of authority was
                       properly executed on May 29, 2008. We also confirmed that
                       the redelegation of authority from the FSA COO to the Program
                       Compliance Officer was executed on July 01, 2008. The
                       delegations also addressed additional controls for monetary
                       limitations and consultation with other Department officials.
                       This corrective action was completed.


Recommendation 1.7     Require the tracking and documentation of the reasons for
                       waiving a liability when exercising the waiver authority.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 06/27/2008
FSA Planned            Federal Student Aid will develop a mechanism to record
Corrective Action      waivers that are granted including documenting the reason for
                       waiving a liability.
Auditor Assessment     FPE&O Standards, Chapter 21, issued June 26, 2008, addresses
of Action              the conditions for granting, recording and documenting reasons
                       for waiving liabilities resulting from program reviews. Also,
                       we confirmed that FPE&O conducted training for the review
                       specialists on the standards. This corrective action to develop a
                       mechanism was completed.


Recommendation 2.1     Ensure that Financial Partners follows its procedures and
                       guidance for its program review process.
Original Proposed
Completion Date        03/31/2008
Status Reported        Completed, 02/28/2008
FSA Planned            Financial Partner Eligibility & Oversight will provide staff with
Corrective Action      training on the revised program review guidance.
Auditor Assessment     We confirmed that training on the FPE&O Standards was
of Action              conducted on February 26-28, 2008 for FPE&O staff. This
                       corrective action was completed.




                                                                                           iv
                                                                       Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement


Recommendation 2.2     Require Financial Partners to enhance and implement its
                       guidance to include procedures that addresses the program
                       review weaknesses we identified.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 05/01/2008
FSA Planned            Financial Partner Eligibility & Oversight will enhance its
Corrective Action      program review guidance, including procedures that address the
                       weaknesses identified.
Auditor Assessment     Subsequent to the scope of our audit, on May 1, 2008, FSA
of Action              issued new Standards which addressed program review
                       weaknesses identified in OIG’s audit report. If the Procedures
                       are implemented as written, they should satisfy the corrective
                       action stated. However, the corrective action to implement
                       guidance was recorded as completed on the day the Standards
                       were issued. The completion date for successful implementation
                       should not be recorded until FSA has assurance that the new
                       Standards have indeed been implemented by FSA staff and are
                       achieving their designed purpose. This corrective action was not
                       completed as of the date recorded.


Recommendation 2.3     Require Financial Partners to enhance and implement its
                       guidance to include procedures that address the technical
                       assistance weaknesses and provide oversight to the regions to
                       ensure that technical assistance is consistently provided and
                       properly documented.
Original Proposed
Completion Date        03/31/2008
Status Reported        Completed, 06/05/2008
FSA Planned            Under the reorganization, program reviewers in the Financial
Corrective Action      Partners Oversight and Eligibility Office (FPE&O) of Program
                       Compliance (formerly Financial Partners Services) do not
                       conduct technical assistance activities. Requests for technical
                       assistance and/or policy guidance are submitted to the Director
                       of the Policy Liaison and Implementation (PLI) Staff in Federal
                       Student Aid, who will either respond to the request directly or
                       forward the request to OPE to ensure all responses, are
                       consistent and appropriate. The procedures detail the process
                       for submitting requests and responding to requests and include
                       response times and recordkeeping requirements.



                                                                                          v
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

Auditor Assessment     Although the reorganization occurred in March 2006, we noted
of Action              during our review that FPE&O staff continued to provide
                       technical assistance (see Finding 3) and that improvements were
                       needed in obtaining and sharing policy guidance (see Finding
                       4). Subsequent to our fieldwork, on May 16, 2008, OPE issued
                       an operating procedure to address requests for policy guidance.
                       This procedure, if implemented as written, should address the
                       corrective action related to policy guidance. However, the issue
                       related to FPE&O staff providing technical assistance remained.
                       FSA did not provide any information or new policy to address
                       that issue. As such, this corrective action was not fully
                       completed.


Recommendation 2.4     Ensure that Financial Partners strengthens its program review
                       process to ensure consistency in the program review process
                       and that program reviews are issued and closed within
                       established timeframes.
Original Proposed
Completion Date        03/31/2008
Status Reported        Completed, 05/01/2008
FSA Planned            Financial Partners Eligibility & Oversight will enhance its
Corrective Action      program review guidance to ensure process consistency and
                       timeliness and provide staff with training on the procedures.
Auditor Assessment     Subsequent to the scope of our audit, on May 1, 2008, FSA
of Action              issued new Standards related to program reviews. We
                       confirmed that FPE&O conducted a 3-day training session on
                       the Procedures for its staff. The Standards establish guidance
                       for consistently performing program reviews and established
                       timelines for report issuance. If the Standards are implemented
                       as written, they should satisfy the corrective action stated. This
                       corrective action was completed.


Recommendation 2.5     Require Financial Partners to establish a quality assurance
                       process that would ensure that program reviews are conducted
                       properly, that work papers support the conclusions reached and
                       findings are adequately documented.
Original Proposed
Completion Date        06/30/2008
Status Reported        Completed, 06/30/2008
FSA Planned            Financial Partners Eligibility & Oversight will leverage the



                                                                                            vi
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

Corrective Action      work done on the quality assurance processes by the School
                       Eligibility Channel and implement a process that supports this
                       recommendation.
Auditor Assessment     Subsequent to the scope of our audit, on May 1, 2008, FSA
of Action              issued new Standards related to program reviews. On June 30,
                       2008, FSA initially included a quality assurance process for
                       program reviews in the Standards. This process document was
                       later removed from the Standards and placed on a shared
                       location on FSA’s computer system. No policy has been issued
                       to establish the quality assurance process on an ongoing
                       process. The first quality assurance review was issued on
                       September 29, 2008. This corrective action was not completed
                       on the date indicated, since the first quality assurance review
                       was not completed until the end of September 2008. This
                       corrective action should also not be considered completed as the
                       quality assurance aspect has been removed from the Standards
                       and not otherwise issued as a policy.


Recommendation 2.6     Require Financial Partners to establish a quality assurance
                       process that would ensure the quality and the adequacy of
                       technical assistance.
Original Proposed
Completion Date        06/30/2008
Status Reported        Completed, 06/05/2008
FSA Planned            Under the reorganization, program reviewers in FPE&O do not
Corrective Action      conduct technical assistance activities. All requests for guidance
                       are forwarded to Federal Student Aid's PLI for a response.
                       Therefore, FPE&O does not need to establish a quality
                       assurance process. The procedures developed and implemented
                       by PLI and OPE will ensure the quality and adequacy of all
                       responses for technical assistance.
Auditor Assessment     Although the reorganization occurred in March 2006, we noted
of Action              during our review that FPE&O staff continued to provide
                       technical assistance (see Finding 3) and that improvements were
                       needed in obtaining and sharing policy guidance (see Finding
                       4). Subsequent to our fieldwork, on May 16, 2008, OPE issued
                       an operating procedure to address requests for policy guidance.
                       This procedure, if implemented as written, should address the
                       corrective action related to policy guidance. However, the issue
                       related to FPE&O staff providing technical assistance remained.
                       FSA did not provide any information or new policy to address



                                                                                        vii
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

                       that issue. As such, this corrective action was not fully
                       completed.


Recommendation 3.1     Develop written policies and procedures for obtaining timely
                       guidance for resolution of program issues and for
                       communicating the results and decisions.
Original Proposed
Completion Date        04/01/2008
Status Reported        Completed, 05/16/2008
FSA Planned            OPE and FSA (with assistance from OGC) will develop a set of
Corrective Action      written procedures that will enable the offices to track policy
                       guidance questions and issues and to respond in a timely
                       manner. The procedures developed will explicitly reference the
                       responsibilities of each of the three offices as they relate to the
                       type of question or issue raised.
Auditor Assessment     Subsequent to our fieldwork, on May 16, 2008, OPE issued an
of Action              operating procedure to address requests for policy guidance.
                       This procedure, if implemented as written, should address the
                       issues noted. This corrective action was completed.


Recommendation 3.2     Develop written policies and procedures for regular review by
                       OGC of program reviews and other significant program
                       determinations.
Original Proposed
Completion Date        12/31/2007
Status Reported        Completed, 05/01/2008
FSA Planned            Financial Partners Eligibility & Oversight will ensure that there
Corrective Action      are policies and procedures that will provide for review by
                       OGC of all program review findings associated with unusual,
                       unique, and controversial issues.
Auditor Assessment     Chapter 18.3.1, “When to Solicit Guidance,” of the Standards,
of Action              was cited by FPE&O as evidence that FSA addressed the OIG
                       recommendation above. We reviewed Chapter 18.3.1, noting
                       that the chapter addressed procedures to be followed to request
                       guidance from the regional directors and the Director of PLI for
                       program review findings without precedent – especially those
                       pertaining to unusual, unique or politically sensitive issues.
                       The current version of the Standards referenced the operating
                       procedure, “Request for Policy Guidance from Federal Student
                       Aid Components.” The operating procedure was issued by



                                                                                        viii
                                                                         Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

                       OPE on May 16, 2008. That procedure included policy
                       guidance to be provided by OPE and/or OGC.

                       The corrective action was to establish policies and procedures,
                       as such, the program review Standards and OPE operating
                       procedure, if implemented as written, should satisfy this
                       corrective action. However, as the OPE operating procedure
                       was not implemented until May 16, 2008, the completion date
                       recorded should be no earlier than that date. This corrective
                       action is considered completed.


Recommendation 4.1     Develop written policies and procedures on the use of the
                       guaranty agency, lender, and servicer scorecards as a risk
                       assessment tool and train users on their use.
Original Proposed
Completion Date        03/31/2008
Status Reported        Completed, 05/01/2008
FSA Planned            Federal Student Aid will document the policies and procedures
Corrective Action      for the use of guaranty agency, lender, and servicer scorecards
                       as a risk assessment tool and train the appropriate users.
Auditor Assessment     We reviewed the Standards, Chapter 14.1.15 – Lender/Servicer
of Action              Scorecard – and determined that FPE&O has developed policies
                       for the use of scorecard as a risk assessment tool during lenders
                       and servicers’ program reviews. We also noted that Chapter 3
                       of the Standards included evaluation of scorecards in the
                       process for developing the annual program review schedule,
                       specifically in the area of selecting entities for review. We also
                       confirmed that FPE&O training covered discussions on the
                       scorecard. These policies, if implemented as written, satisfy the
                       corrective action to document policies and procedures. This
                       corrective action was completed.


Recommendation 4.2      Implement a process to continually assess the effectiveness of
                        the scorecard; and identify and implement improvements.
Original Proposed
Completion Date         07/31/2007
Status Reported         Completed, 07/27/2007
FSA Planned             Federal Student Aid will develop, document, and implement a
Corrective Action       process to continually assess the effectiveness of the guaranty
                        agency, lender, and servicer scorecards and implement



                                                                                            ix
                                                                        Appendix - A

Federal Student Aid’s Oversight and Monitoring of Guaranty Agencies, Lenders, and
                          Servicers Needs Improvement

                        improvements.
Auditor Assessment      FSA provided a copy of “Procedures for Capturing, Evaluating
of Action               and Implementing Changes to the Financial Partners Data Mart
                        (FPDM).” This document was distributed and posted on July
                        27, 2007. If implemented as written, this document should
                        satisfy the corrective action. However, the corrective action to
                        implement procedures was recorded as completed on the date
                        of the document. The document is not part of a policy or the
                        Standards. As such, the procedures do not appear to have been
                        formally established as an ongoing process. FSA also did not
                        yet have assurance that the new procedure would be effective.
                        The completion date for successful implementation should not
                        be recorded until FSA has formally issued the procedure and
                        has assurance of effective implementation. This corrective
                        action was not fully completed.




                                                                                           x