United States Government Accountability Office GAO Report to Congressional Requesters June 2012 STUDENT AND EXCHANGE VISITOR PROGRAM DHS Needs to Assess Risks and Strengthen Oversight Functions GAO-12-572 June 2012 STUDENT AND EXCHANGE VISITOR PROGRAM DHS Needs to Assess Risks and Strengthen Oversight Functions Highlights of GAO-12-572, a report to congressional requesters Why GAO Did This Study What GAO Found As of January 2012, more than U.S. Immigration and Customs Enforcement (ICE) has not developed a process 850,000 active foreign students were in to identify and analyze program risks since assuming responsibility for the the United States enrolled at over Student and Exchange Visitor Program (SEVP) in 2003, in accordance with 10,000 U.S. schools. ICE, within DHS, internal controls standards and risk management guidance. Within ICE, officials is responsible for managing SEVP and from SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), certifying schools to accept foreign which tracks, coordinates, and oversees school fraud investigations, have students. GAO was asked to review expressed concerns about the fraud risks posed by schools that do not comply ICE’s fraud prevention and detection with requirements. Investigators said that identifying and assessing risk factors, procedures for SEVP. This report such as the type of school, are critical to addressing potential vulnerabilities examines the extent to which ICE has posed across the more than 10,000 SEVP-certified schools. However, SEVP (1) identified and assessed risks in SEVP and (2) developed and does not have processes to (1) evaluate prior and suspected cases of school implemented policies and procedures noncompliance and fraud and (2) obtain and assess information from CTCEU to prevent and detect fraud during the and ICE field offices on school investigations and outreach events. For example, initial school certification process and ICE reported that it has withdrawn at least 88 schools since 2003 for non- once schools begin accepting foreign compliance; however, ICE has not evaluated schools’ withdrawals to determine students. GAO analyzed documents, potential trends from their noncompliant actions because case information is not such as ICE’s SEVP procedures, and well-organized, according to SEVP officials. Without a process to analyze risks, it tested recordkeeping controls by will be difficult for ICE to provide reasonable assurance that it is addressing high- selecting a random sample of 50 risk vulnerabilities and minimizing noncompliance. SEVP-certified schools and reviewing case files. GAO interviewed officials ICE has not consistently implemented existing controls, in accordance with from SEVP, CTCEU, and 8 of 26 ICE internal control standards and fraud prevention practices, to verify schools’ field offices, selected based on a mix legitimacy and eligibility during initial SEVP certification and once schools begin of factors, including school fraud accepting foreign students. Specifically, ICE officials do not consistently verify investigations and referrals from certain evidence initially submitted by schools in lieu of accreditation. In addition, CTCEU. While the results of the case ICE does not maintain records to document SEVP-certified schools’ ongoing file reviews and interviews cannot be compliance. GAO found that 30 of a randomly-selected sample of 48 SEVP- generalized, they provided insights certified school case files lacked at least one piece of required evidence, such as about SEVP. proof of school officials’ citizenship or permanent residency. ICE was unable to produce 2 of the 50 case files. ICE officials noted that some files were missing What GAO Recommends because they were lost or destroyed when the Department of Homeland Security GAO recommends that ICE, among (DHS) took over the program from the former Immigration and Naturalization other things, identify and assess Service; moreover, ICE officials cannot quantify how many files are missing. program risks; consistently implement Without verification of evidence and complete case files, ICE cannot provide procedures for ensuring schools’ reasonable assurance that schools were initially and continue to be eligible for eligibility; address missing school case certification. Further, ICE policies require that SEVP-certified flight schools files; and establish target time frames offering flight training have specific Federal Aviation Administration (FAA) for notifying flight schools that lack certifications; however, GAO found that approximately 167 of 434 (or 38 percent) required FAA certification that they SEVP-certified flight schools do not have the required certifications as of must re-obtain FAA certification. DHS December 2011. The Border Security Act required recertification for all SEVP- concurred with the recommendations. certified schools by May 2004 and every 2 years thereafter to monitor schools’ continued program eligibility. SEVP officials stated that they rely on recertification to verify schools’ eligibility; however, SEVP began the first recertification cycle in May 2010 and, as of March 2012, has recertified 1,870 (or 19 percent) of certified schools. Implementing procedures to monitor state licensing and accreditation View GAO-12-572. For more information, contact Rebecca Gambler at (202) 512-6912 status for all types of schools and addressing flight schools that lack required or firstname.lastname@example.org. FAA certification could better position ICE to reduce the risk of fraud and noncompliance. United States Government Accountability Office Contents Letter 1 Background 5 Identifying and Assessing Risks to SEVP Could Strengthen ICE’s Management of the Program 10 Weaknesses in ICE’s Monitoring and Oversight of SEVP-Certified Schools Contribute to Security and Fraud Vulnerabilities 21 Conclusions 37 Recommendations for Executive Action 38 Agency Comments and Our Evaluation 38 Appendix I Scope and Methodology 41 Appendix II Comments from the Department of Homeland Security 46 Appendix III GAO Contact and Staff Acknowledgments 49 Table Table 1: ICE’s Budget Authority, Obligations, and Fee Collections for SEVP, Fiscal Years 2006 through 2012 19 Figures Figure 1: Total Academic (F) and Vocational (M) Visas Issued by the Department of State, Fiscal Years 2005 through 2011 6 Figure 2: Key Steps in SEVP’s Initial and Recertification Processes 9 Figure 3: ICE’s Recertification Milestones 26 Page i GAO-12-572 Student and Exchange Visitor Program Abbreviations CTCEU Counterterrorism and Criminal Exploitation Unit DHS Department of Homeland Security FAA Federal Aviation Administration ICE U.S. Immigration and Customs Enforcement INS Immigration and Naturalization Service SEVIS Student and Exchange Visitor Information System SEVP Student and Exchange Visitor Program TECS Treasury Enforcement Communication System USCIS U.S. Citizenship and Immigration Services This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-12-572 Student and Exchange Visitor Program United States Government Accountability Office Washington, DC 20548 June 18, 2012 Congressional Requesters As of January 2012, more than 850,000 active foreign students in the United States were enrolled at over 10,000 schools. 1 We have previously reported that terrorist attacks in the United States have pointed to the need for close monitoring and oversight of foreign students. 2 For example, one of the September 11, 2001, terrorists entered the country on a student visa, and subsequently attended flight schools. Two of the September 11, 2001, terrorists received visas for temporary visits to the United States for business or pleasure, and, after entering the country, illegally attended flight schools. 3 In addition, as we reported in April 2011, schools have sometimes attempted to exploit the immigration system by knowingly reporting that foreign students were fulfilling their visa requirements, such as maintaining a full course load, when they were not attending school or attending intermittently. 4 U.S. Immigration and Customs Enforcement (ICE), within the Department of Homeland Security (DHS), is responsible for managing the Student and Exchange Visitor Program (SEVP), which was created in conjunction with DHS’s formation on March 1, 2003. 5 Under this program, ICE is responsible for ensuring that foreign students studying in the United 1 The Department of Homeland Security reports that the five countries with the highest number of active foreign students are China, South Korea, India, Saudi Arabia, and Canada. These countries account for more than 50 percent of the total number of active foreign students in the country. Of active foreign students, 70 percent are enrolled in bachelor’s, master’s, or doctoral post-secondary programs. 2 GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs, GAO-11-411 (Washington, D.C.: Apr. 15, 2011). 3 Temporary visitors to the United States generally are referred to as “nonimmigrants.” The United States also issues visas to people who intend to immigrate to the United States. In this report, we use the term “visa” to refer to nonimmigrant visas only. For a listing and descriptions of nonimmigrant categories, see 8 U.S.C. § 1101(a)(15); see also 8 C.F.R. § 214.1(a)(1)-(2). 4 GAO-11-411. 5 The former Immigration and Naturalization Service was previously responsible for monitoring foreign students in the United States and the schools that accept them. Page 1 GAO-12-572 Student and Exchange Visitor Program States comply with the terms of their admission into the country. Specifically, ICE certifies schools as authorized to accept foreign students in academic and vocational programs. In addition, ICE manages the Student and Exchange Visitor Information System (SEVIS), which assists the agency in tracking and monitoring certified schools, as well as students—while they are approved to participate in U.S. educational institutions—and their dependents. 6 Designated school officials are responsible for monitoring students and entering and maintaining students’ information in SEVIS, such as information on their courses of study. 7 SEVP-certified schools span all education levels from kindergarten to secondary education, as well as post-secondary academic, vocational, English language, and flight schools. 8 SEVP’s fiscal year 2012 enacted budget authority is $120 million, and, as of December 2011, the program includes authorized staff of 151 full-time government employees and approximately 600 full- and part-time contractors. You asked us to review ICE’s fraud prevention and detection procedures, including whether it uses risk factors to inform its efforts to monitor SEVP- certified schools. This report examines the extent to which ICE has (1) identified and assessed risks in SEVP, and (2) developed and implemented policies and procedures to prevent and detect fraud during the initial school certification process and once schools begin accepting foreign students. 6 The Illegal Immigration Reform and Immigrant Responsibility Act of 1996, as amended, requires a program to collect information for tracking and monitoring foreign students from approved institutions of higher education, other approved educational institutions, and designated exchange visitor programs in the United States. See 8 U.S.C. § 1372. The statute, as amended by the Enhanced Border Security and Visa Entry Reform Act of 2002 (Border Security Act), requires that an electronic means be established to monitor and verify the acceptance of foreign students by schools and that schools inform DHS of foreign students who fail to enroll within 30 days after the end of a school’s enrollment period. See Pub. L. No. 107-173, § 501(a)(1), 116 Stat. 543, 560-61 (codified at 8 U.S.C. § 1372(a)(3)-(4)). 7 A designated school official is a regularly-employed member of the school administration whose office is located at the school and whose compensation does not come from commissions for recruitment of foreign students. The designated school official is required to be familiar with the regulations governing nonimmigrant students and school certification (8 C.F.R. § 214.3(l)). 8 Vocational schools are community colleges, junior or 2-year institutions, high schools, and other types of schools that provide vocational or technical training, usually leading to a job rather than a bachelor’s degree. Page 2 GAO-12-572 Student and Exchange Visitor Program To evaluate the extent to which ICE has identified and assessed risks in SEVP, we analyzed documentation on ICE’s efforts to evaluate SEVP risk, including a current contract to develop a risk management approach. We also analyzed ICE news bulletins to help determine the magnitude of previous cases of fraud and evaluated information provided by the Counterterrorism and Criminal Exploitation Unit (CTCEU)—ICE’s investigative component responsible for investigating school fraud cases, among other things—on criminal investigations related to school certification fraud. We reviewed publicly available information on 12 cases of school fraud dating from 2006 to 2011, which allowed us to better understand SEVP program risks. Because we selected a nongeneralizable sample of 12 cases to review, the information obtained from them is not necessarily representative of all school fraud cases nationwide. We also compared ICE’s risk management practices for SEVP against Standards for Internal Control in the Federal Government 9 and DHS’s Policy for Integrated Risk Management. 10 To determine the extent to which ICE has developed and implemented policies and procedures to prevent and detect school fraud, we reviewed standard operating procedures and tested internal controls designed to ensure school oversight. To test SEVP’s internal controls, we selected a nongeneralizable, stratified random sample of 50 SEVP-certified schools and reviewed their case files to verify that evidence required for certification existed, such as designated school officials’ proof of citizenship or lawful permanent residency. The results of our case file review provided us with insights into SEVP’s internal controls and case management practices. Further, we reviewed SEVP’s compliance case log, as of December 2011, which identifies specific SEVP-certified schools that are under additional review for suspected non-compliant activity, to identify common school attributes such as type of school. To address both objectives, we interviewed officials from each of SEVP’s seven branches 11 and criminal investigators from CTCEU, as well as 9 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov. 1, 1999). 10 Department of Homeland Security, DHS Policy for Integrated Risk Management (Washington, D.C.: May 27, 2010). 11 SEVP has seven branches: School Certification, Response, Policy, Analysis and Operations Center, Field Representative Program, Mission Support, and Information Technology. Page 3 GAO-12-572 Student and Exchange Visitor Program eight ICE field offices, which allowed us to obtain their perspective on the magnitude and risks associated with school fraud. 12 We selected these locations based on their experience in investigating previous and/or ongoing cases of school fraud. Although the results from these interviews cannot be generalized to officials at all 26 ICE field offices, they provided us with useful insights into lessons learned from fraud cases. Additionally, we compared ICE’s risk management and fraud prevention and detection practices to the Standards for Internal Control in the Federal Government 13 and the United Kingdom National Audit Office’s Good Practice in Tackling External Fraud. 14 Our review encompassed ICE’s management of SEVP since 2003, when the agency assumed responsibility for managing the program. Our scope did not include the Exchange Visitor Program, a separate program administered by the Department of State. 15 Appendix I presents more details about our objectives, scope, and methodology. We conducted this performance audit from September 2011 through June 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe 12 We interviewed officials from ICE field offices in Atlanta, Ga; Dallas, Tex; Miami, Fla; New York, N.Y.; Washington, D.C.; and Los Angeles, San Diego, and San Francisco, Calif. 13 GAO/AIMD-00-21.3.1. 14 U.K. National Audit Office, Good Practice in Tackling External Fraud (London, England: 2008). This guidance on fraud control practices was prepared by the U.K.’s National Audit Office, which is among the internationally recognized, leading organizations in fraud control. This guidance includes a discussion of sound management practices for controlling fraud that complements the internal control standards. See GAO, Immigration Benefits: Additional Controls and a Sanctions Strategy Could Enhance DHS’s Ability to Control Benefit Fraud, GAO-06-259 (Washington, D.C.: Mar. 10, 2006). 15 The Exchange Visitor Program allows nonimmigrants to travel to the United States on a J visa to teach, study, conduct research, and receive on-the-job training. Such nonimmigrants are monitored by program sponsors, including employers, cultural exchange organizations, professional associations, and government agencies. We did not evaluate this program because it is a separate process administered by the Department of State, and our focus was on DHS’s oversight of schools that enroll foreign students. For more information on the Exchange Visitor Program, see GAO, State Department: Stronger Action Needed to Improve Oversight and Assess Risks of the Summer Work Travel and Trainee Categories of the Exchange Visitor Program, GAO-06-106 (Washington, D.C.: Oct.14, 2005). Page 4 GAO-12-572 Student and Exchange Visitor Program that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Foreign students interested in studying in the United States must first be Background admitted to a school or university before applying for a visa at a U.S. embassy or consulate overseas. 16 The process for determining who will be issued or refused a visa, including F and M visas, contains several steps, including documentation reviews, in-person interviews, collection of applicants’ fingerprints, and cross-references against State’s name-check database. 17 F visas are for academic study at 2- and 4-year colleges and universities and other academic institutions. 18 M visas are for nonacademic study at institutions, such as vocational and technical schools. 19 An increasing number of foreign students have applied for visas to attend school in the United States since fiscal year 2005. Specifically, the Department of State issued approximately 244,000 F and M visas in fiscal year 2005 and approximately 457,000 in fiscal year 2011 (see figure 1). 16 According to the Department of State’s regulations, a student visa applicant must meet the following requirements to qualify: (1) acceptance at an approved school; (2) possession of sufficient funds; (3) sufficient knowledge of the English language to undertake the chosen course of study or training (unless coming to participate exclusively in an English language training program); and, (4) present intent to leave the United States at conclusion of studies. See 22. C.F.R. § 41.61(b)(1). According to the Department of State guidance for consular officers, if an applicant fails to meet one or more of the above criteria, he or she must be refused a visa under section 214(b) of the Immigration and Nationality Act (8 U.S.C. § 1184(b)). If consular officers have reason to believe that a visa applicant engaged in fraud or misrepresentation to garner acceptance into a school, then consular officers are instructed to consider this as an important factor in determining if the applicant has a bona fide intent to engage in study in the United States. If consular officers have reason to question the authenticity of a school, they are instructed to contact SEVP and the fraud prevention office in the Bureau of Consular Affairs. 17 We have previously reported on visa process issues. For example, see GAO, Border Security: Strengthened Visa Process Would Benefit from Improvements in Staffing and Information Sharing, GAO-05-859 (Washington, D.C.: Sept. 13, 2005). 18 8 U.S.C. § 1101(a)(15)(F); 8 C.F.R. § 214.2(f). 19 8 U.S.C. § 1101(a)(15)(M); 8 C.F.R. § 214.2(m). Page 5 GAO-12-572 Student and Exchange Visitor Program Figure 1: Total Academic (F) and Vocational (M) Visas Issued by the Department of State, Fiscal Years 2005 through 2011 Note: Data include initial issuances and any renewals per fiscal year. A visa allows a foreign citizen to travel to a U.S. port of entry and request permission from an officer with DHS’s Customs and Border Protection to enter the United States; it does not guarantee entry into the country. Among other things, foreign students remain “in status” and therefore eligible to remain in the United States as students as long as they are enrolled in a school certified by SEVP. Individuals traveling on student visas generally are not issued a specific date until which they are authorized to remain in the United States, but instead are admitted for what is referred to as “duration of status.” This means that they may remain in the country as long as they maintain their student status (e.g., Page 6 GAO-12-572 Student and Exchange Visitor Program by being enrolled in an academic or work-study program). 20 Some nonimmigrants enter the country on a non-student visa and subsequently apply to U.S. Citizenship and Immigration Services for a change in status to a student visa. In general, if students fail to maintain their student status or to depart on time, they are considered out of status and begin to accrue unlawful presence either on the day after U.S. Citizenship and Immigration Services or an immigration judge determines that they are out of status or on the day after their authorized period of admission expires. 21 Schools interested in accepting foreign students on F and M visas must petition for SEVP certification by submitting a Form I-17 to ICE and paying an application fee. Once certified, schools are able to accept foreign students by issuing Forms I-20 for students, which enable the students to apply for nonimmigrant student status. As of March 2012, students applying for F or M visas were required to pay a $140 fee to the Department of State for visa processing and a $200 fee to DHS for SEVIS, and schools applying for initial certification were required to pay DHS $1,700, as well as a $655 site visit fee per campus. 22 The Border Security Act requires DHS to confirm, every 2 years, SEVP-certified schools’ continued eligibility and compliance with the program’s requirements. 23 During the initial petition and recertification processes, a school must provide ICE with evidence of its legitimacy and its eligibility. Such evidence includes the following: 20 Students traveling on M visas (students in vocational or other nonacademic institutions) generally are admitted for a fixed time period, although extensions are possible. See 8 C.F.R. § 214.2(m)(5), (10). 21 They are subject to 3- to10-year bars on their readmission to the country, respectively, if they accrue more than 180 days or 1 year of unlawful presence. See 8 U.S.C. § 1182(a)(9)(B). 22 SEVP and the program’s management of SEVIS are funded solely with the fees it collects from foreign students as well as schools applying for certification. When the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA) first required the establishment of SEVIS, it required that schools collect the SEVIS fee. See Pub. L. No. 104-208, div. C, § 641(e), 110 Stat. 3009-546, 3009-706. The Visa Waiver Permanent Program Act amended IIRIRA to require that the government collect the fee. See Pub. L. No. 106-396, § 404(1), 114 Stat. 1637, 1649 (2000). 23 8 U.S.C. § 1762. Page 7 GAO-12-572 Student and Exchange Visitor Program • designated school officials’ attestation statements that both the school and officials intend to comply with program rules and regulations, such as ensuring that students attend classes, and that the school is eligible for certification. The attestations provide that willful misstatements constitute perjury; • designated school officials’ proof of U.S. citizenship or lawful permanent residency; and • proof of licensing by an appropriate state-level licensing or approving agency. In addition, accredited schools must provide proof of certification by an accrediting agency recognized by the Department of Education. 24 Unaccredited schools must provide other evidence, including: • a school catalog or written statement including information on the school’s facilities and faculty; • for unaccredited schools seeking to enroll F visa students, “in lieu of” letters from three accredited institutions stating that graduates or credits of the petitioning school are unconditionally accepted at the accredited institution; • for unaccredited schools seeking to enroll M visas students, “in lieu of” letters from three employers stating that graduates of the petitioning school are fully qualified in the field of training provided by the petitioning school; and • for schools offering flight training, Federal Aviation Administration (FAA) certificates. Following a school’s petition and receipt of supporting evidence, ICE uses contracted firms to conduct a site visit to the school, including each instructional site foreign students attend, to interview school officials and review the facilities. In particular, site inspectors review whether schools’ facilities are commensurate with the number of students and type of academic programs. After receiving all necessary evidence and a site visit report from the contracted firm, ICE staff in the SEVP School 24 The goal of accreditation is to ensure that education provided by institutions of higher education meets acceptable levels of quality. Accrediting agencies, which are private educational associations of regional or national scope, develop evaluation criteria and conduct peer evaluations to assess whether or not those criteria are met. Institutions and/or programs that request an agency’s evaluation and that meet an agency’s criteria are then “accredited” by that agency. There are more than 70 accrediting bodies recognized by the Department of Education, including the Accrediting Council for Continuing Education and Training, and the Accrediting Commission of Career Schools and Colleges. Page 8 GAO-12-572 Student and Exchange Visitor Program Certification Branch analyze the documentation, determine the school’s eligibility, and certify those schools that they determine meet all of the program’s requirements. According to the School Certification Branch Chief, the initial certification process takes at least 4 months. During the recertification process, the School Certification Branch requires schools to resubmit evidence for certification and evaluates schools’ compliance with recordkeeping and reporting on its enrolled foreign students. Figure 2 illustrates the initial certification and recertification processes that are described in SEVP’s regulations, policy, and guidance. Figure 2: Key Steps in SEVP’s Initial and Recertification Processes ICE’s SEVP Analysis and Operations Center (compliance unit) may conduct out-of-cycle, compliance reviews of certified schools at its Page 9 GAO-12-572 Student and Exchange Visitor Program discretion. The compliance unit may decide to conduct a compliance review if it has evidence that indicates a school may no longer be legitimate or eligible. As part of these reviews, SEVP staff may conduct unannounced site visits to schools. Based on the results of compliance reviews, some schools may be withdrawn from the program or referred to CTCEU for possible criminal investigation. 25 CTCEU tracks, coordinates, and oversees criminal investigations related to potential cases of student and school certification fraud. In that role, CTCEU identifies both foreign students who fail to enroll in or maintain status at their schools and SEVP-certified schools that do not remain in compliance with program requirements. For example, CTCEU takes the lead in pursuing criminal investigations against school officials that may have exploited the system by operating “sham” institutions, which are operating solely to admit foreign nationals into the country without participation in educational programs. CTCEU refers leads to ICE field offices for further review and investigation, and these offices also open their own investigations based on local leads. CTCEU also conducts outreach to schools through its Campus Sentinel program which aims to foster relationships between ICE law enforcement officials and schools through on-site visits and information sessions at national and regional conferences. ICE does not have a process to identify and analyze risks across schools Identifying and applying for certification, as well as across the more than 10,000 schools Assessing Risks to that are SEVP-certified. Specifically, SEVP faces two key challenges in (1) evaluating information on prior and suspected cases of school SEVP Could noncompliance and fraud, and (2) obtaining and assessing information Strengthen ICE’s from CTCEU and ICE field offices’ investigations and school outreach events to identify possible trends and lessons learned. In addition, ICE Management of the has not conducted an analysis to assess how to allocate resources based Program on risk to help ensure that SEVP resources are targeted to the highest- risk program activities. ICE has taken initial actions to study the potential 25 Withdrawing a school’s certification is the final action in the compliance process. SEVP notifies schools of withdrawal decisions through a letter and schools have an opportunity to appeal these decisions. If SEVP denies the appeal, the program disseminates an official notification of certification withdrawal to the school. SEVP requires students who are enrolled at a school that is withdrawn from the program to transfer to another SEVP- certified school to maintain their student visa status. Page 10 GAO-12-572 Student and Exchange Visitor Program risks posed by schools that are not in compliance with requirements, but it is too early to evaluate the results of these actions. ICE Does Not Have a ICE has not developed and implemented a process to identify and Process to Identify and analyze program risks since assuming responsibility for SEVP in 2003, Assess Risks Posed by making it difficult for ICE to determine the potential security and fraud risks across the more than 10,000 SEVP-certified schools and to identify Schools in SEVP actions that could help mitigate these risks and reduce schools’ noncompliance. SEVP and CTCEU officials expressed concerns about the security and fraud risks posed by schools that do not comply with program requirements. For example, investigators at CTCEU and each of the eight ICE field offices we interviewed told us that they are concerned about the cases of school certification fraud they have seen. They stated that identifying and assessing risk factors, such as the type of school (accredited or unaccredited), is critical to addressing security vulnerabilities and removing opportunities for criminal exploitation within SEVP. In 2011, CTCEU began tracking data on school fraud using increased resources funded with SEVP’s fee collections. For example, CTCEU focused more attention on fraud detection through its SEVIS Exploitation Unit, established in September 2011, which analyzes SEVIS data to identify potentially fraudulent activity among schools and allows CTCEU to generate additional leads on school fraud or noncompliance. In its Fiscal Year 2013 Congressional Budget Justification, DHS reported that during fiscal year 2011, CTCEU analyzed 48 percent more leads on potential school and student visa fraud than in fiscal year 2010. In addition, various cases of school fraud have demonstrated vulnerabilities in the management and oversight of SEVP-certified schools. For example: • In the case of California Union University, foreign students stated they paid the school owner fees ranging from $600 to more than $10,000 for documentation enabling the students to fraudulently obtain visas and, in some cases, bogus degrees, despite the fact that they never attended class. In the case affidavit, one student who purportedly received his bachelor’s degree in education from California Union University recounted how the school owner staged a graduation ceremony at the campus where students received their phony diplomas. • In the case of Florida Language Institute, foreign nationals who had been issued Forms I-20—a key document required in obtaining a student visa—were not required to attend classes. When ICE officials conducted a site visit at the Institute while the school was supposed to Page 11 GAO-12-572 Student and Exchange Visitor Program be conducting classes, no students were present. The school had reported to ICE that 150 students attended class daily. • In other instances, school officials have run criminal enterprises that are tied to illegitimate schools. For example, in the Tri-Valley University case in California, the owner was indicted for issuing fraudulent Forms I-20, which falsely certified that its students were required to attend a full course of study. Investigators believe school officials were intentionally maintaining false information in SEVIS in an effort to acquire and maintain immigration status for students that were actually ineligible for that status. ICE could benefit from a process that identifies and analyzes risks because previous investigations of school fraud indicate that there are vulnerabilities within the program. Moreover, given that there are more than 10,000 SEVP-certified schools, identifying and assessing programwide risks could help ICE target its operations to those program areas that are of highest risk. Standards for Internal Control in the Federal Government provides guidance on the importance of identifying and analyzing risks, and using that information to make decisions. 26 These standards address various aspects of internal control that should be continuous, built-in components of organizational operations. One internal control standard, risk assessment, calls for identifying and analyzing risks that agencies face from internal and external sources and deciding what actions should be taken to manage these risks. The standards indicate that conditions governing risk continually change and periodic updates are required to ensure that risk information, such as vulnerabilities in the program, remains current and relevant. Information collected through periodic reviews, as well as daily operations, can inform the analysis and assessment of risk. Furthermore, DHS’s Policy for Integrated Risk Management states that DHS and its component agencies should use a risk-based approach when managing programs that includes, among other things, identifying potential risks; assessing and analyzing identified risks; and using risk information and analysis to inform decision making. SEVP faces two primary challenges to identifying and assessing risks posed by schools: (1) it does not evaluate program data on prior and suspected instances of school fraud and noncompliance and (2) it does not obtain and assess information from CTCEU and ICE field office school investigations and outreach events. Information from these 26 GAO/AIMD-00-21.3.1. Page 12 GAO-12-572 Student and Exchange Visitor Program sources could help ICE identify trends and lessons learned from prior and ongoing cases and outreach events, providing it with factors it could consider in identifying and assessing SEVP programwide risks. Evaluating SEVP information on prior and suspected cases of school noncompliance and fraud. SEVP does not have a process to evaluate prior and suspected cases of school fraud and noncompliance to identify lessons learned from such cases, which could help it better identify and assess program risks. SEVP has maintained a compliance case log since 2005—a list of approximately 172 schools as of December 2011—that officials have determined to be potentially noncompliant with program requirements. The compliance case log represents those schools that SEVP, based on tips and leads and out-of-cycle reviews, is monitoring for potential noncompliance. SEVP uses this log for monitoring potentially noncompliant schools, but, according to SEVP officials, it has not looked across schools on this list to identify and evaluate possible trends in schools’ noncompliance, which could provide useful insights to SEVP to assess programwide risks. Further, according to SEVP officials, SEVP has not looked across previous cases of school fraud and school withdrawals to identify lessons learned on program vulnerabilities and opportunities to strengthen internal controls. They stated that developing a comprehensive list of prior cases for school fraud would require significant time and effort because information on school fraud and noncompliance is maintained in multiple databases and files are not linked electronically and do not share information, including SEVIS, the Student and Exchange Visitor Program Automated Management System, 27 and paper-based case files. However, SEVP could use the existing compliance case log as a starting point to identify any trends or factors in schools’ noncompliance. Further, SEVP could select a sample of prior school fraud cases to analyze for possible trends and lessons learned, and leverage this analysis to help identify programwide risks. As of March 2012, ICE reported that it had withdrawn 860 SEVP-certified schools from the program since 2003 for various reasons including compliance issues, voluntary withdrawals, and school closures. ICE reported that it has withdrawn at least 88 of these schools since 2003 for noncompliance issues, such as failure to report a change in ownership. 27 The Student and Exchange Visitor Program Automated Management System is a document management system that contains case file information on schools, such as site visit reports and evidence provided to support the I-17petition. Page 13 GAO-12-572 Student and Exchange Visitor Program However, a senior official told us that SEVP has not conducted a lessons learned evaluation of school withdrawals to determine potential trends in their noncompliant actions, and use that information to focus compliance activities. Our analysis indicates that there are patterns in the noncompliant schools, such as the type of school. For example, of the 172 post-secondary institutions on SEVP’s December 2011 compliance case log, about 83 percent (or 142) offer language, religious, or flight studies, with language schools representing the highest proportion. CTECU identified, and shared with SEVP officials other potential indicators of higher-risk schools based on prior school fraud cases, including school location/type of campus; the ratio of foreign students to overall students; the ratio of enrolled students to reported average annual number of students; the concentration of online courses; and the average length of time that students, particularly foreign language students, have been in the United States. SEVP’s Policy Branch Chief told us that while the program has not conducted a comprehensive analysis of previous fraud cases, the Policy Branch developed a lessons learned analysis in response to the 2011 Tri- Valley University case in California and submitted this analysis to SEVP senior management. In the Tri-Valley University case, the school’s owner was indicted for issuing fraudulent documentation without regard for students’ academic qualifications or intent to pursue a course of study required to maintain lawful immigration status. In February 2012, SEVP’s Director stated that he did not recall this analysis and thus had not made any policy or operational changes recommended in the analysis. He noted, however, that his office had made a number of changes as a direct result of the Tri-Valley University case, including establishing a separate compliance unit in August 2011 and instituting a process to identify schools that have more enrolled students than their stated capacity, which is an indicator of risk. 28 The SEVP Director further stated that although the program has not systematically evaluated previous fraud cases, it has devoted increased attention to fraud prevention and detection since the Tri-Valley University case, such as through funding 28 As part of initial certification, schools are required to report to SEVP their average annual number of students. In the case of Tri-Valley University, the school reported the average annual number of students as less than 100. However, at the time that ICE began investigating the school, the population of students was close to 1,000. Based on the Tri- Valley University case, SEVP officials stated that they began evaluating discrepancies between schools’ average annual number of students and the number of Forms I-20 issued. Page 14 GAO-12-572 Student and Exchange Visitor Program additional investigative resources in CTCEU. Officials at both SEVP and CTCEU stated that evaluating prior school fraud cases could help in assessing program risks, but the agency has not completed an analysis on data from school case files. According to DHS’s Policy for Integrated Risk Management, risk information and analysis can help provide defensible decisions, made with the best available tools and information, for the best achievable outcomes. In addition, the U.K. National Audit Office’s Good Practice in Tackling External Fraud advises that in the fraud context, a risk-based approach involves such things as assessing areas most vulnerable to fraud and the characteristics of those who commit fraud. SEVP officials told us that case information is not organized well, and that they generally operate on a reactive basis after evidence indicates that a fraud has been perpetrated and do not have sufficient quantitative data to help detect the fraud before it occurs. However, ICE could use its existing compliance case log and a sample of prior cases of school fraud, which contain qualitative information, as a starting point to help identify and assess factors that could pose security and fraud risks to the program. Without an evaluation of prior and suspected cases of school fraud and noncompliance, ICE is not well- positioned to identify and apply lessons learned from prior school fraud cases, which could help it take action to identify and mitigate program risks going forward. Obtaining information from CTCEU and ICE field offices’ investigations and outreach efforts. SEVP’s Director and other senior officials stated that SEVP has not established a process to obtain information from CTCEU’s criminal investigators. Investigators may have valuable knowledge in working cases of school fraud for identifying and assessing program risks, including information such as the characteristics of schools that commit fraud, how school officials exploited weaknesses in the school certification process, and what actions ICE could take to strengthen internal controls. For example, according to investigators in one ICE field office, CTCEU was hampered in pursuing a criminal investigation because SEVP officials did not obtain a signed attestation statement within the I-17 application from a school official stating that the official agreed to comply with rules and regulations. Another risk area is designated school officials’ access to SEVIS. In 2011, CTCEU provided SEVP officials with a position paper expressing concerns that designated school officials, who are not required to undergo security background checks, are responsible for maintaining updated information of foreign students in SEVIS. Further, according to investigators at three of the eight field offices we interviewed, SEVP allowed designated school officials to maintain SEVIS access and the ability to modify records in the system Page 15 GAO-12-572 Student and Exchange Visitor Program while being the subject of an ongoing criminal investigation, despite requests from CTCEU to terminate SEVIS access for these officials. The SEVP office has the authority to immediately terminate SEVIS access upon request from CTCEU in cases where criminal wrongdoing is suspected, and SEVP officials stated that they have taken action in the past to terminate SEVIS access due to noncompliance. SEVP’s Director stated that his office has, on occasion, requested more information or evidence from CTCEU to substantiate a request to terminate SEVIS access for a designated school official. In addition, he stated that, in some instances, his office may be hesitant to terminate access because doing so might alert the school to an open investigation and thus compromise CTCEU’s efforts. In addition to information from CTCEU’s criminal investigations, CTCEU collects data on its outreach efforts with schools through its Campus Sentinel program; however, the SEVP Director stated that his office has not obtained and analyzed reports on the results of these visits. CTCEU initiated Campus Sentinel in 2011, which ICE operates across all of its field offices nationwide. Funded with SEVP fee collections and facilitated based on SEVP’s outreach and liaison efforts with schools, the program aims to foster relationships between ICE law enforcement officials and schools through on-site visits and information sessions at national and regional conferences and to make school officials more aware of recent investigations of school fraud. CTCEU officials stated that the goal of Campus Sentinel is to enable CTCEU officials and schools to better identify and report criminal behavior within the population of certified schools. From October 1, 2011 through March 6, 2012, CTCEU conducted 314 outreach visits to schools. According to CTCEU investigators that we interviewed, these visits provide an opportunity to identify potential risks, including whether schools have the physical capacity and necessary resources to support programs for foreign students. As of March 2012, CTCEU initiated two criminal investigations based on information obtained as part of Campus Sentinel outreach. ICE field offices document the results of each site visit, as well as information on school investigations, in the Treasury Enforcement Communication System (TECS), which is accessible to SEVP officials in the compliance unit, Page 16 GAO-12-572 Student and Exchange Visitor Program including an SEVP compliance liaison in CTCEU. 29 Standards for Internal Control in the Federal Government states that management needs to comprehensively identify risks and ensure there are adequate means of obtaining information from external stakeholders that may have a significant impact on the agency achieving its goals. SEVP officials, including the Director, stated that the program conducts ongoing outreach with schools through annual conferences and efforts related to the Campus Sentinel program, among other things. The Director indicated that SEVP officials helped launch and fund it through SEVP fee collections, but were not aware of the site visit reports and thus have not taken steps to obtain information on them. A senior SEVP official stated that the program lacks processes to obtain information from CTCEU due to a strained relationship between the organizations. CTCEU officials disagreed that the relationship is strained and stated that there are processes in place to share information, such as through regular, bimonthly meetings between CTCEU and SEVP officials that began in late 2011; however, they stated that SEVP has not adequately emphasized enforcement in its mission. In February 2012, SEVP’s Director stated that data on the results of Campus Sentinel would be valuable and planned to follow up with staff on how best to utilize access to available case information in TECS. Obtaining information on lessons learned from CTCEU investigators could help provide SEVP with additional insights on such issues as characteristics of schools that have committed fraud and the nature of those schools’ fraudulent activities, which ICE could leverage in identifying and assessing programmatic risks. In addition, ICE has taken some initial actions to study the potential risks posed by schools that are not in compliance with SEVP requirements, but it is too early to evaluate the results of these actions. Specifically, in September 2011, ICE hired a contractor to develop a risk-based approach to overseeing schools applying for certification as well as those already certified schools under the program. The objective of this contract is to define and document programmatic risks and incorporate such information into a risk-based approach to school oversight. As of March 2012, the contractor had reviewed ICE’s SEVP standard operating procedures and interviewed agency officials responsible for school 29 TECS is an automated enforcement and antiterrorism database that provides information for law enforcement and border security purposes, and can exchange information automatically with other U.S. government systems. Page 17 GAO-12-572 Student and Exchange Visitor Program certification and recertification, among other areas. Using the results from background research and interviews of subject matter experts, the contractor completed several deliverables, including identifying and defining preliminary program risks (e.g., non-accredited schools); developing a risk scorecard, which ICE plans to use to categorize schools by risk level (e.g. high, medium, low); and developing a risk-based testing plan to ensure that adequate internal controls exist and are followed. However, this methodology was limited because ICE does not have complete and reliable historical data on its schools, according to the contractor. In November 2011, the contractor reported that there are several key limitations to its ongoing analysis of risk factors in SEVP, including that it must rely on qualitative, rather than quantitative data. In particular, the contractor reported that it faced challenges in accessing compliance data, given that is it maintained in multiple data sources. SEVP’s Deputy Director stated that DHS’s Office of Risk Management Analysis has begun developing such quantitative data separate from its risk management contract. As of March 2012, ICE has not yet implemented any of the contractor’s recommendations because the contractor had just completed the work. Going forward, ICE plans to evaluate the results before determining actions for implementation. ICE Has Not Allocated SEVP revenues have increased in recent years, but ICE has not analyzed SEVP Resources Based on how to allocate its resources among mission areas, such as certification, Program Risks compliance monitoring, and recertification. Once ICE has assessed risks in SEVP, analyzing how to allocate resources based on those risks could help ensure that SEVP is using its resources in a cost-effective manner. We have previously reported that homeland security resource investments should be informed by risk. 30 In particular, we reported that DHS must carefully weigh the benefit of homeland security endeavors and allocate resources where the benefit of reducing risk is worth the additional cost. Additionally, risk-based, priority-driven decisions can help inform decision makers in allocating finite resources to the areas of greatest need. In the homeland security arena, this means determining which vulnerabilities should be addressed in what ways with available resources. 30 GAO, Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities, GAO-05-824T (Washington, D.C.: Jun. 29, 2005). Page 18 GAO-12-572 Student and Exchange Visitor Program SEVP is funded entirely by the fees that ICE collects from schools and students. In fiscal year 2009, based on an internal fee study, application fees for students and schools increased, which contributed to approximately 60 percent increase in fee collection revenue from fiscal year 2008. 31 As shown in table 1, fee collections for SEVP have increased from approximately $53 million in fiscal year 2006 to about $123 million in fiscal year 2011. Subsequent fee studies in 2009 and 2011 projected that the program’s revenues would be sufficient to meet resource needs for the period covering fiscal years 2009 through 2013. Table 1: ICE’s Budget Authority, Obligations, and Fee Collections for SEVP, Fiscal Years 2006 through 2012 Dollars in millions 2006 2007 2008 2009 2010 2011 2012a Enacted budget authority 66.6 54.3 56.2b 120.0 120.0 120.0 120.0 Fee collections 52.9 57.9 63.3 101.0 113.2 122.7 33.9c Obligations 45.8 44.7 63.0 81.0 72.9 95.6 120.0 Source: GAO analysis of SEVP documentation and DHS budget data. a Based on fiscal year 2012 enacted budget authority. b SEVP also received $9.7 million in supplemental funding in fiscal year 2008. c Data as of March 2012. Also, SEVP’s forecast takes into account that the majority of some fee payments occur during the second half of the fiscal year. As a result, 73 percent, or $93 million, of SEVP’s revenue is forecast to be collected over the remaining months in 2012. With the exception of fiscal year 2011, ICE’s fee collections for SEVP since fiscal year 2009 have generally fallen short of its enacted budget authority. 32 ICE had intended to use the projected increases in fee collections to fund several initiatives, including developing SEVIS II, establishing field liaisons nationwide for school coordination and monitoring purposes, and hiring additional personnel for recertification. 31 In fiscal year 2009, student fees increased from $100 to $200; school certification and petitions for change in ownership fees increased from $230 to $1,700; school site-visit fees increased from $350 to $655; and additional campus site visit increased from $350 to $655. 32 Budget authority refers to the authority provided by federal law to enter into financial obligations that will result in immediate or future outlays involving federal government funds. The basic forms of budget authority include (1) appropriations, (2) borrowing authority, (3) contract authority, and (4) authority to obligate and expend offsetting receipts and collections. See GAO, A Glossary of Terms Used in the Federal Budget Process, GAO-05-734SP (Washington, D.C.: Sept. 2005). Page 19 GAO-12-572 Student and Exchange Visitor Program SEVP deferred funding these initiatives, however, for a number of reasons such as challenges in designing SEVIS II, delays in hiring additional staff members, and lower than expected fee collections. For example, based on the fiscal year 2009 fee increase, ICE planned to allocate approximately $3 million to hire additional staff for SEVP recertification; however, an SEVP official stated that they did not complete hiring these staff in fiscal year 2010 because of the unanticipated reduction in fee collections. 33 A senior policy official indicated it is important to hire additional staff for recertification activities to help address school noncompliance and meet the statutory requirements for recertification as set forth in the Border Security Act. Although fee collections were lower than expected during this time frame, from October 2008 through October 2011, SEVP’s carryover cash balance increased from approximately $40 million to $105 million. SEVP’s Director stated that the program transferred staff from the Policy Branch to the compliance unit in 2011, and that there may be additional opportunities to target resources based on risk. SEVP is a fee-funded program, and revenues can and do fluctuate from fiscal year to fiscal year (see Table 1). However, SEVP’s director stated that SEVP has not conducted an analysis of its resource allocations based on risk to ensure that those resources are allocated in an efficient manner to high-risk activities. Additionally, in February 2012, SEVP’s Director realigned the organization into two main divisions, one focused on internal operations, such as information technology and human resources, and one focused on external operations, such as school certification. However, he stated that SEVP had not conducted a resource analysis or considered risk information to support this reorganization. By analyzing how to allocate its resources based on risk, SEVP could be better positioned to ensure that it is using those resources in a cost-effective manner to help address the program’s highest risk activities. 33 SEVP plans to complete hiring additional staff for recertification activities by the end of fiscal year 2012. Page 20 GAO-12-572 Student and Exchange Visitor Program ICE has not consistently implemented certain controls to verify schools’ Weaknesses in ICE’s legitimacy and eligibility during initial SEVP-certification and ongoing Monitoring and monitoring processes. In particular, ICE has not consistently implemented policies that require schools offering flight training to have certain FAA Oversight of SEVP- certifications to remain eligible to enroll foreign nonimmigrant students. In Certified Schools addition, weaknesses in managing and sharing information on SEVP- Contribute to Security certified schools among ICE stakeholders hinder the agency’s efforts to prevent and detect school certification fraud. and Fraud Vulnerabilities Inconsistent ICE has not consistently implemented its procedures to verify and monitor Implementation of Certain schools’ legitimacy and eligibility, hindering efforts to prevent and detect Controls Impede ICE’s school fraud. Regulations require schools to establish that the schools are legitimate and meet other eligibility criteria for the program to obtain Efforts to Verify and certification from ICE. 34 ICE’s policies and procedures direct SEVP Monitor Schools’ officials to collect, validate, and maintain evidence of schools’ eligibility Legitimacy and Program during the initial certification, recertification, and ongoing review Eligibility processes. Internal control standards advise that controls should be generally designed to ensure that ongoing monitoring occurs in the course of normal operations. Further, according to fraud control practices, agencies should strengthen internal controls where needed for fraud prevention. However, ICE officials have not consistently implemented existing internal control procedures for SEVP in four areas: (1) initial verification of evidence submitted in lieu of accreditation, (2) recordkeeping to ensure schools’ continued eligibility, (3) ongoing compliance monitoring of school licensing and accreditation status, and (4) certification of schools offering flight training. Initial verification of evidence submitted in lieu of accreditation. ICE requires schools to present evidence demonstrating that the school is legitimate; is an established institution of learning or other recognized place of study; possesses the necessary facilities, personnel, and finances to conduct instruction in recognized courses; and is engaged in instruction in those courses. Non-accredited, post-secondary schools, in particular, must provide “in lieu of” letters, which are evidence provided by 34 8 C.F.R. § 214.3(a)(3) states that a school, to be eligible for certification, must establish that it is bona fide. For the purposes of this report, we use the term “legitimate” synonymously with the term “bona fide.” Page 21 GAO-12-572 Student and Exchange Visitor Program petitioning schools in lieu of accreditation by a Department of Education- recognized accrediting agency. ICE policy and guidance require that SEVP adjudicators render an approval or denial of schools’ petitions based on such evidence and supporting documentation. 35 This includes verifying that schools’ claims in the Form I-17—such as accreditation status and “in lieu of” letters are accurate. Verifying an “in lieu of” letter would generally involve contacting the letter’s source and confirming that the letter is legitimate and that the signee has authority to issue statements of the school’s acceptance of the petitioning school’s credits and students. Based on our review of SEVIS data on the approximately 10,000 SEVP-certified schools, we estimate that approximately 1,250 schools are non-accredited, post-secondary schools and, therefore, should have provided “in lieu of” letters to ICE. 36 However, SEVP adjudicators have not consistently verified “in lieu of” letters submitted by schools that demonstrate their legitimacy and eligibility. For example, according to SEVP’s School Certification Branch Chief, adjudicators have not verified all “in lieu of” letters submitted to ICE by the approximately 1,250 non-accredited, post-secondary schools, as required by ICE’s policy. Rather, adjudicators use their discretion to determine whether to verify a letter’s source and the signatory authority of the signee based on any suspicions of the letters’ validity. Investigators at one of the eight ICE field offices we interviewed stated SEVP officials certified at least one illegitimate school—Tri-Valley University in California—because the program had not verified the evidence provided in the initial petition. These investigators directly attributed the initial certification of Tri-Valley University in California to the lack of verification of the school’s “in lieu of” letters. Investigators stated that if SEVP’s adjudicators had taken action to verify the letters, they may have discovered that the letters were manufactured by Tri-Valley University school officials to feign legitimacy and eligibility. 35 SEVP adjudicators are federal government employees responsible for reviewing all school certification petitions, for researching and sending requests for additional evidence, and issuing a decision either certifying or denying schools’ SEVP-certification. 36 To identify those schools that are post-secondary, we sorted SEVIS school data as of December 8, 2011, based on the “Type of Education” offered and excluded those schools that offered only elementary through high school education. From our list of post- secondary schools, we cross referenced each school’s reported accrediting agency (if any) against the Department of Education’s list of approved accrediting agencies. We considered schools non-accredited if they reported having no accreditation or reported an accrediting agency that was not approved by the Department of Education. Page 22 GAO-12-572 Student and Exchange Visitor Program Furthermore, CTCEU officials and investigators at five of the eight ICE field offices we interviewed stated that School Certification Branch officials should scrutinize non-accredited schools to a higher degree because such schools have demonstrated a higher risk of fraud than other schools. Subsequent to investigation, Tri-Valley University closed and the owner was indicted on 33 criminal counts, including charges of visa fraud, money laundering, and alien-harboring. In another case, the owner of an English language school in Georgia provided fraudulent documents to ICE, including forged or fraudulently obtained “in lieu of” letters supposedly issued by three educational institutions of higher learning. Following the English language school’s certification, the school began facilitating the issuance of student visas to foreign nationals and further manufactured and provided false documents, including resumes, school transcripts, diplomas, financial plans and statements, to those foreign nationals. Furthermore, in March 2012, CTCEU officials stated that several of their ongoing investigations involve schools that provided fraudulent evidence of accreditation or evidence in lieu of accreditation to ICE. SEVP adjudicators have not consistently verified all evidence submitted in lieu of accreditation, specifically “in lieu of” letters” that support non-accredited schools’ petitions for SEVP certification because, according to SEVP officials, the program has not historically focused enough attention on fraud prevention until the Tri-Valley University case demonstrated the program’s vulnerabilities. In analyzing the Tri-Valley University case, a senior official in SEVP’s Policy Branch reiterated that adjudicators should verify all “in lieu of” letters per the program’s current procedures. Consistent verification of these letters could help ICE ensure that schools are legitimate and detect potential fraud early in the certification process. Recordkeeping to ensure continued eligibility of schools. ICE’s standard operating procedures for recordkeeping require SEVP officials to maintain records to document ongoing compliance. Our analysis of selected school case files indicates that ICE has not consistently maintained certain evidence of selected schools’ eligibility for the program. Based on our review of a stratified random sample of 50 SEVP- certified school case files, 30 files lacked at least one piece of evidence required by the program’s policies and procedures. In addition, ICE was unable to produce two schools’ case files that we requested as part of our Page 23 GAO-12-572 Student and Exchange Visitor Program randomly selected sample. 37 The results of our analysis of the 48 remaining case files are not generalizable, but the following summarizes these results. • 7 of the 48 school case files did not include reports of the required initial site visit; • 22 of the 48 school case files did not include proof of the designated school officials’ U.S. citizenship or lawful permanent residency; • 7 of the 34 case files for non-flight schools and non-accredited schools lacked adequate evidence in lieu of accreditation (e.g. “in lieu of” letters); and • 7 of the 11 case files for schools offering flight training included expired FAA certificates. Without the schools’ information and evidence contained in these case files, including attestation statements, site visit reports, and designated school officials’ proof of citizenship, ICE does not have an institutional record to provide reasonable assurance that these schools were initially and continue to be legitimate and eligible for certification. The Mission Support Branch Chief indicated that school case files may be missing or may lack pieces of evidence because of the transition from the legacy Immigration and Naturalization Service (INS) to DHS in 2003. DHS initially delegated authority for school certification and monitoring to U.S. Citizenship and Immigration Services (USCIS), but DHS later delegated that responsibility to ICE in February 2005. The Mission Support Branch Chief stated that DHS attempted to facilitate a smooth transition from INS and USCIS by accepting schools’ prior certifications without additional review. Although the INS offices where school case files had been maintained were required to send the school case files to USCIS, which subsequently transferred files to SEVP, the Mission Support Branch Chief and School Certification Branch Chief stated that some files were completely or partially destroyed prior to the transfer. The School Certification Branch Chief told us that ICE has not followed up on the missing case files and that files may be available from former INS offices. Both officials stated that they have not conducted an analysis of the gaps in school information among case files and do not know the number of files that may be incomplete or missing. The Mission Support Branch Chief stated that they have not prioritized the analysis of the case files 37 Because ICE was unable to produce 2 schools’ case files, our results include the 48 files that we were able to analyze. Page 24 GAO-12-572 Student and Exchange Visitor Program because the program is relying on their various processes, including petition updates, compliance reviews, and recertification, to address previous deficiencies in information in case files. Based on our review of data on the initial certification dates of SEVP-certified schools, 7,130 of 10,038 (71 percent) were certified prior to 2005, indicating that these schools were initially certified by INS or USCIS and then transferred to ICE. Internal control standards indicate that operating information, such as the evidence in school case files, is necessary to determine whether an agency is meeting its compliance requirements. Further, our analysis indicated that case files for schools that have been certified since February 2005 were also incomplete. Of the 30 schools that we identified as lacking at least one piece of evidence required by the program’s policies and procedures, 13 (46 percent) were certified from 2005 through 2010. Therefore, gaps in the case files used to maintain evidence of schools’ eligibility affect those schools that ICE accepted from the former INS and USCIS as well as those that ICE certified after taking responsibility for the program. According to ICE officials, the school recertification process would help address issues with incomplete and missing school files because schools are required to resubmit all evidence required by regulation when going through recertification. The School Certification Branch Chief and the Policy Branch Chief stated that recertification would also help ICE address noncompliant schools and withdraw those that may have become illegitimate and ineligible since initial certification. The Border Security Act required recertification for all SEVP-certified schools (as well as State’s program sponsors of exchange students) by May 2004 and every 2 years thereafter. 38 However, ICE began the first recertification cycle in May 2010 and, according to senior SEVP officials, will not recertify all schools during this 2-year cycle, which ends in May 2012, because the process has taken longer than officials planned. As of March 31, 2012, ICE reported to have recertified 1,870 schools (approximately 19 percent of SEVP-certified schools) during the program’s first recertification cycle (see figure 3). 38 See 8 U.S.C. § 1762. The statute requires the review of institutions and other entities authorized to enroll or sponsor certain nonimmigrants. In addition to requiring DHS to review institutions certified to receive nonimmigrants under F and M visas, the act requires the Department of State to review entities designated to sponsor exchange visitor program participants under J visas. The Act requires that these reviews determine whether the institutions or entities are in compliance with recordkeeping and reporting requirements. Page 25 GAO-12-572 Student and Exchange Visitor Program Figure 3: ICE’s Recertification Milestones Note: Border Security Act of 2002 required that INS recertify schools every 2 years; however, DHS assumed this responsibility when it took over management of SEVP in 2003. According to ICE, the program intended to complete approximately 450 recertifications per month to finish the cycle in 2 years. However, it completed an average of 107 recertifications per month in 2011. According to SEVP’s Director and other senior officials, ICE delayed the recertification process until after SEVIS was deployed in 2003 and the program fee was increased in 2008 to support more staff in the program. SEVP senior management stated that the office is recruiting additional adjudicators, which may increase the program’s ability to recertify schools and potentially reach the program’s goal of recertifying 450 schools per month. Given the delays in completing the first recertification cycle, ICE is not positioned to address gaps in SEVP’s case files and cannot provide reasonable assurance that schools that were initially certified to accept foreign students are still compliant with SEVP regulations. Page 26 GAO-12-572 Student and Exchange Visitor Program Ongoing compliance monitoring of school licensing and accreditation status. ICE does not have a process to monitor the ongoing eligibility of licensed and accredited, non-language schools enrolling foreign students. ICE regulations require all certified schools to maintain state licensing (or exemption) and provide various forms of evidence to ICE supporting schools’ legitimacy and eligibility. ICE has taken action to monitor the accreditation status of English language schools; however, it does not have a process to monitor schools’ state licensing status and non-language schools’ accreditation status. For English language schools, ICE is enforcing a legislative change enacted in December 2010, which requires, as of June 2011, such schools to be accredited by a Department of Education-recognized accrediting agency to be eligible for SEVP certification. 39 The act allows English language schools already certified on the date of enactment to continue issuing Forms I-20 until December 2014, as long as they apply for accreditation by December 14, 2011. Subsequent to this change, ICE took actions to coordinate with nationally recognized accrediting agencies to determine which English language schools applied for accreditation by the legislatively mandated date of December 14, 2011. ICE does not have a similar process for monitoring the state licensing status of all schools and the accreditation of schools offering higher education or vocational training other than language training. If a school’s licensing or accreditation status changes after initial certification, ICE’s regulations and policy require designated school officials to report this change to ICE through SEVIS. 40 At initial certification, ICE requires designated school officials to report which agencies license or accredit their school in SEVIS, but the system allows school officials to list any response. For example, a school may list an accrediting agency that is not Department of Education-recognized in an attempt to fulfill SEVP requirements. Because schools may enter any information in this field, SEVP officials cannot easily query the number of schools that are accredited by Department of Education-recognized agencies or sort such data by the accrediting agencies. According to SEVP Information Technology officials, the planned November 2014 deployment of SEVIS II is intended to improve the program’s analytical capabilities by addressing 39 See Act of Dec. 14, 2010, Pub. L. No. 111-306, 124 Stat. 3280. 40 8 C.F.R. § 214.3(g)(2)(i). Page 27 GAO-12-572 Student and Exchange Visitor Program the variation in self-reported licensing and accreditation statuses. 41 Specifically, SEVIS II is intended to provide drop-down menus or other multiple choice selections for state licensing agencies as well as Department of Education-recognized accrediting agencies. These data collection tools are intended to address the inconsistent reporting of licensing or accrediting agencies’ names but not the issue of inaccurate (both intentional and unintentional) self-reporting by schools. Therefore, even with the planned SEVIS II deployment in 2014, ICE does not have reasonable assurance that SEVIS data on schools’ licensing or accreditation status is accurate following initial certification. If a school loses its state license, the school would be unable to operate legally as a school within that state. However, ICE does not have controls to ensure that SEVP compliance unit officials would be aware of this issue; therefore, a school without a proper business license may remain certified to enroll foreign students and the school’s designated school officials may continue to access SEVIS. For example, SEVP had been notified by ICE investigators that a religious school was closed in September 2011; as of March 2012, the school remained SEVP-certified. In another example, SEVP officials learned in May 2011 that a flight school had closed; as of March 2012, the school remained SEVP-certified. After we brought these issues to attention of ICE officials in March 2012, they stated that, while they initially thought these two schools had been withdrawn, the schools were SEVP-certified. ICE officials stated that they are working on withdrawing the schools. SEVP’s Policy Branch Chief and Deputy Director stated that they rely on the recertification process in addition to other methods, such as information-sharing with CTCEU and compliance reviews by the compliance unit, to verify that schools are self-reporting changes in their status consistent with ICE policies. However, ICE has not yet completed its first round of recertification of all certified schools. Moreover, since ICE is mandated to conduct recertification on schools every two years, a 41 ICE is developing the functional requirements for SEVIS II, a second generation version of the data system that is intended to be more technologically advanced and user-friendly and to streamline the process of students obtaining student visas and studying in the United States. Initially planned for deployment in September 2009, SEVIS II has been delayed until November 2014 due to difficulties in system design. ICE terminated the original contractor based on its challenges in developing an accurate and complete set of functional requirements for the system, which required the agency to hire a new contractor for system design. ICE also plans to hire a contractor for SEVIS II development and implementation. Page 28 GAO-12-572 Student and Exchange Visitor Program process to monitor the ongoing status of schools would help ensure their continuous eligibility. For example, this process could include notification from Department of Education-recognized accrediting agencies regarding changes in schools’ accreditation status. In addition to recertification, the SEVP Director stated that the planned field liaison initiative will improve school compliance, as well as data integrity in SEVIS. SEVP’s Director stated that the field liaisons will establish a more proactive relationship with schools and provide additional resources for schools and designated school officials to access to better understand and comply with immigration laws, regulations, and SEVP policies and procedures. However, the initiative remains under development and ICE has not deployed any liaisons as of March 2012. Developing and implementing a process to monitor the ongoing status of schools enrolling foreign students could better position ICE to reduce the risk of fraud and ensure schools’ legitimacy and eligibility. Certification of schools offering flight training. ICE’s policies and procedures require flight schools to have FAA Part 141 or 142 certification to be eligible for SEVP certification; however, ICE has certified schools offering flight training without such FAA certifications. As the federal agency responsible for regulating safety of civil aviation in the United States, FAA administers pilot certification (licensing) and conducts safety oversight of pilot training. 42 FAA’s regulations for pilot training and certification can be found in three parts—Parts 61, 141, and 142. 43 Part 61 relates to individual providers/instructors that are not subject to direct FAA oversight beyond the initial certification and subsequent renewal of each flight instructor’s certificate. Parts 141 and 142 outline requirements for flight schools and training centers. FAA oversees these Part 141 and 142 flight schools and training centers with annual inspections and by reviewing and approving the schools’ facilities and programs. FAA requires the flight training programs to include, among other things, detailed training course outlines or curriculums for approval. ICE established a policy that requires Part 141 and 142 for eligibility in SEVP—and excluded Part 61 providers—because FAA directly oversees 42 For more information on FAA’s oversight of pilot training, see GAO, Initial Pilot Training: Better Management Controls Are Needed to Improve FAA Oversight, GAO-12-117 (Washington, D.C.: Nov. 15, 2011). 43 Federal aviation regulations are found under title 14 of the United States Code of Federal Regulations (14 C.F.R. pts. 61, 141, and 142). Page 29 GAO-12-572 Student and Exchange Visitor Program Part 141 and 142 flight schools and training centers on an ongoing basis. The Form I-17 petition for certification specifies that only FAA Part 141 flight schools are eligible to apply for certification to enroll foreign students. We identified 434 SEVP-certified schools that, as of December 2011, offer flight training to foreign students. 44 However, 167 (38 percent) of these flight training providers do not have FAA Part 141 or 142 certification. SEVP’s Director, Policy Branch Chief, and Compliance Unit Chief acknowledged that all SEVP-certified schools offering flight training do not have FAA Part 141 or 142 certification even though the program requires it. In 2011, SEVP’s compliance unit initially identified schools offering flight training that appeared to not have Part 141 or 142 certification and began determining those schools’ statuses by contacting designated school officials and FAA Flight Standard District Offices. 45 During the course of our review, the SEVP Director stated that they plan to take action to address these noncompliant flight schools. Specifically, he stated that his office plans to notify all SEVP-certified schools that do not have the required FAA certification that they must re-obtain Part 141 or 142 certification. Moreover, SEVP School Certification Branch officials stated that they plan to coordinate directly with FAA to determine which schools have not met the requirements by the deadlines and will take withdrawal actions against such schools. While these are positive steps, SEVP officials have not yet established target time frames for implementing and completing these planned actions. Program management standards state that successful execution of any program includes developing plans that include a time line for program deliverables. 46 Setting target time frames to notify certified flight schools that lack FAA certifications that they must re-obtain Part 141 or 142 certification could help ICE hold SEVP accountable for taking such 44 This is a relatively small percentage of providers nationwide that offer flight training. 45 As of April 2012, SEVP’s compliance unit identified 469 SEVP-certified schools that offer flight training and determined that 153 of those may not be Part 141 or 142 certified. The discrepancy in the population that we identified and the population that SEVP identified is due to the fact that SEVP’s compliance unit included schools that have issued Forms I-20 for flight training without having flight training approved through the Form I-17 petition. 46 The Project Management Institute, The Standard for Program Management © (Newton Square, Pa., 2006). Page 30 GAO-12-572 Student and Exchange Visitor Program actions and better position ICE to reduce the risk of fraud and ensure all flight schools’ legitimacy and eligibility. There are various reasons why ICE has certified or allowed non-Part 141 or 142 schools to remain in the program. For example, a DHS flight training working group conducted a flight study that found that many FAA Part 61 schools were providing equal if not superior instruction than Part 141 schools. Based on that finding, the DHS flight training working group recommended that ICE re-examine the program’s requirement for Part 141 or 142 certification for flight schools to enroll foreign students. Based on the DHS group’s recommendation, ICE conducted a preliminary review and certified a limited number of non-Part 141 or 142 flight schools. Specifically, ICE certified one Part 61 provider following a site visit during which SEVP officials determined that the provider was equally qualified as a Part 141 or 142 flight school. Subsequent to this certification, additional Part 61 providers petitioned for SEVP certification, resulting in the certification of at least two additional flight providers that did not meet SEVP’s policy requiring Part 141 or 142 certification. SEVP officials in the Policy Branch stated that the program certified these providers because, in their view, there is no difference in quality between Part 61 providers and Part 141 or 142 flight schools. ICE also indicated that in most of the cases, it may have initially certified flight schools with Part 141 or 142 certification but the schools allowed their FAA certification to expire, and ICE did not identify or take compliance action against these schools. Further, a senior SEVP compliance official stated that ICE may also be unaware of flight schools that have had their FAA certification revoked. We identified one school that offers flight training that remains SEVP-certified (as of February 2012) after FAA revoked its Part 141 certification in 2007 for multiple violations, including certifying and graduating students who have not completed the required curriculum and training as well as not following FAA-approved courses of training. Senior SEVP officials stated that the school officials have never updated the school’s petition in SEVIS following its initial certification in 2003; thus, ICE was unaware of this revocation. Additionally, ICE was unable to locate the school’s case file upon our request. We also identified a previous case of school certification fraud involving a flight school in El Cajon, California. This school lost its FAA certification to train commercial pilots but remained SEVP-certified, continued to issue Forms I-20 and enroll foreign nonimmigrant students, and illegally hired such students as flight instructors. Specifically, school officials issued Forms I-20 in SEVIS for more than 100 foreign students in 3 months and illegally hired 11 such Page 31 GAO-12-572 Student and Exchange Visitor Program students as flight training instructors from 2001 through 2008. According to ICE field investigators, the actions taken by the school and its officials posed a significant security threat, especially considering the schools involvement in flight training. In particular, CTCEU recommended in 2011 that SEVP should not allow Part 61 providers into the program. In November 2011, we reported that FAA rarely uses punitive means such as revoking licenses and assessing penalties against Part 141 schools, having revoked certificates in three cases. 47 Because ICE has certified or maintained certification of schools that provide flight training without the required FAA certification and oversight, the program is vulnerable to security and fraud risks. ICE has not consistently verified and maintained all evidence submitted in support of schools’ petitions and has not monitored schools’ state licensing, accreditation, and FAA certification status because, according to SEVP officials, ICE has not historically focused enough attention on fraud prevention and detection. To effectively prevent and detect fraud, Standards for Internal Control in the Federal Government, as well as the U.K. National Audit Office’s Good Practice in Tackling External Fraud, suggest agencies clearly define key areas of authority and responsibility for operating activities and develop specific strategies to coordinate their fraud control efforts, ensuring that someone is fully responsible for implementing the plans as intended. Following the case of Tri-Valley University, ICE created the SEVP compliance unit in August 2011 to target more of the program’s resources on school oversight and to strengthen compliance monitoring. The SEVP Director stated that his office’s branches historically operated in an autonomous manner, which has created past coordination challenges when responding to compliance cases, and the newly established compliance unit aims to correct these issues. However, SEVP has drafted but not finalized the unit’s standard operating procedures as of April 2012. The SEVP official in charge of the compliance unit stated that SEVP has not finalized the compliance unit’s procedures because the unit was established quickly in response to Tri- Valley University and has relied upon previous compliance procedures 47 GAO-12-117. In addition, we plan to report later in 2012 on general aviation security, including the Alien Flight Student Program, which is a program administered by the Transportation Security Administration to screen foreign nationals applying for flight training in the United States. We are conducting this work at the request of the House of Representatives Committee on Homeland Security and Subcommittee on Transportation Security. Page 32 GAO-12-572 Student and Exchange Visitor Program when the process was managed by the School Certification Branch. Specifically, the compliance unit is responsible for addressing the deficiencies in SEVP’s ongoing monitoring of schools’ licensing and accreditation, as well as flight schools’ FAA certification. Because the compliance unit operates without clearly defined parameters, the majority of its fraud control efforts are reactionary and performed on an ad hoc basis. For example, SEVP’s compliance staff began comparing the number of Forms I-20 issued to the schools’ reported number of students in reaction to the Tri-Valley University case, which highlighted that schools issuing Forms I-20 well above the schools’ reported average number of students is a potential fraud indicator. SEVP officials stated that they plan to finalize their procedures by summer 2012. Completing procedures by which the compliance unit monitors school compliance could better position ICE to conduct fraud control efforts on a systematic basis, which could help provide ICE with reasonable assurance that previously certified schools remain legitimate and eligible on an ongoing basis. Weaknesses in Managing ICE has not consistently followed the standard operating procedures that and Sharing Key govern the communication and coordination process between SEVP, Information Impede ICE’s CTCEU, and ICE field offices. Specifically, these procedures delineate roles and responsibilities on criminal investigations and establish Prevention and Detection protocols for SEVP taking administrative actions against schools during of School Fraud and following a criminal investigation. In some instances, SEVP management has not followed CTCEU requests to take or cease administrative actions and has not referred potentially criminal cases to CTCEU in accordance with ICE’s procedures. ICE’s standard operating procedure for coordination requires SEVP to defer to CTCEU regarding whether to proceed with administrative actions during ongoing criminal investigations because criminal investigations take precedence over administrative actions. Additionally, this procedure states that ICE field offices determine the timing and extent of SEVP engagement in criminal investigations based on the needs of those investigations, which includes requesting SEVP to take administrative action in SEVIS to remove designated school officials’ access to the system and to withdraw school certification. ICE’s procedure also directs SEVP to refer allegations or leads revealing possible criminal violations to CTCEU in a timely manner, but it does not include criteria for determining when a compliance-type case under SEVP’s review becomes a potentially criminal case. Internal control standards advise agencies to develop strategies for coordinating fraud prevention and control efforts, including establishing means of Page 33 GAO-12-572 Student and Exchange Visitor Program information exchange and developing approaches to identifying and addressing potential fraud. Under the standard operating procedure, CTCEU is to inform SEVP officials of a pending criminal investigation of school fraud (or other fraudulent activity) to prevent SEVP from unknowingly compromising such investigations through conducting compliance reviews or other administrative processes. The procedure requires that SEVP officials defer to the judgment of the CTCEU Unit Chief regarding whether to proceed with an administrative action or review during an ongoing criminal investigation. However, in our interviews with eight ICE field offices, field investigators at two offices gave examples of SEVP officials continuing administrative activities when asked to cease such activity. In one case, investigators stated that the target (an owner of a flight school) became suspicious of increased attention by SEVP officials and fled the United States in 2011 to avoid prosecution. Our review of the December 2012 compliance case log confirms that the SEVP office was aware of this specific criminal investigation and continued to take administrative actions. SEVP officials indicated that there were mitigating circumstances related to this case, including challenges in communicating with the ICE field office. SEVP officials also stated that SEVP and CTCEU management later agreed that the investigation was not compromised by SEVP’s administrative activities. In another ongoing case in California, field investigators stated that SEVP officials conducted a site visit to an institution following the owner’s indictment after the local ICE field office investigators instructed SEVP to stop administrative activities. SEVP’s Director stated that, in some cases, they believe it is necessary to communicate with or conduct routine activities related to schools under investigation in order to not alert these schools to a potential investigation. The SEVP Director stated that these two examples were outliers and that the program typically works well with the field office investigators, fully supporting criminal investigations and abiding by investigator directions to cease activity. The standard operating procedure also allows CTCEU and ICE field offices to request that SEVP take administrative action in SEVIS to support criminal investigations either while the investigation is ongoing or following the investigation. Such administrative actions may include the removal of designated school officials from SEVIS access or withdrawal of a school’s certification. Because each criminal investigation is unique, the procedures state that the ICE field office determines the timing and extent of SEVP engagement based on the needs of the investigation. However, an ICE field office provided us with an example of SEVP Page 34 GAO-12-572 Student and Exchange Visitor Program officials not complying with this administrative action protocol. According to this field office, as of February 2012, although CTCEU requested withdrawal of a school, SEVP had not begun withdrawal procedures for the school or denied SEVIS access to a school owner, following the owner’s indictment in May 2011 on charges including conspiracy and false statements. SEVP officials stated that they revoked the school owner’s SEVIS access following the indictment, but accidently restored his access following the owner’s call to SEVP’s response center. SEVP officials stated that the compliance unit immediately terminated the owner’s access after becoming aware of the situation. SEVP officials stated that, as of March 2012, the compliance unit is preparing the notice of intent to withdraw the school. SEVP officials stated that staff typically will follow instruction from CTCEU or field investigators regarding either ceasing or taking administrative action, but the SEVP office may not know which schools are under investigation and CTCEU and field offices may not be fully informed on SEVP’s policies and procedures. SEVP officials stated that they may conduct administrative activities on schools that are not known to be under investigation because CTCEU and field office investigators have not routinely shared information regarding which schools are under investigation. However, the SEVP Director stated that his compliance unit staff have access to the TECS database, which includes information on ongoing investigations being directed by CTCEU and field office investigators. He also stated that it is important for all program branches to coordinate to assure that those responsible for administrative activities do not continue activities when CTCEU or ICE field office investigators have requested such activity to cease. SEVP officials in the School Certification and Policy Branches stated that the program has previously taken administrative actions requested by CTCEU and ICE field offices in support of criminal investigations. However, these officials stated that because SEVP is responsible for taking administrative actions, the program officials need details on why the school is being withdrawn to include in the notice of withdrawal letters to protect the program against appeals and potential lawsuits. The SEVP Director stated that the standard operating procedure is a high-level document that does not account for the mitigating factors that may influence how his staff should respond to ongoing criminal investigations. According to the Director, the intent of the procedure, given past coordination issues, is to ensure his office receives ample notification from CTCEU of criminal investigations so that SEVP can take appropriate and timely administrative actions. The standard operating procedure does not specifically state what information CTCEU or field office investigators should provide to SEVP. Without Page 35 GAO-12-572 Student and Exchange Visitor Program specification of this information, it will be difficult for CTCEU, field office investigators, and SEVP officials to share a clear of understanding of information needs for taking administrative action. Revising the standard operating procedure that governs the communication and coordination process between SEVP, CTCEU, and ICE field offices to more specifically delineate what information to share among the stakeholders during a criminal investigation could better position ICE to conduct criminal investigations and to better prevent and detect school fraud. In addition, while the coordination standard operating procedure for SEVP, CTCEU, and ICE field offices requires that SEVP refer allegations or leads revealing possible criminal violations to CTCEU in a timely manner, the procedure does not have criteria for determining when certain noncompliant activity becomes potentially criminal. The SEVP compliance unit first shared its compliance case log with CTCEU in October 2011, during the course of our review. Upon review of this information, CTCEU officials stated that several of the compliance cases could involve potential criminal violations. CTCEU officials identified examples of potentially criminal violations, including designated school officials sharing SEVIS passwords, a school not holding classes but reporting attendance, a school reporting its own address as students’ addresses, and a school charging additional fees for showing students as compliant. CTCEU officials stated that SEVP officials had not previously shared these cases with them; therefore, CTCEU had not distributed the information to ICE field offices as potential leads for further investigation. Officials at six of the eight ICE field offices that we interviewed reported not having opened any school fraud investigations based on leads from SEVP and have relied on locally generated leads. According to officials at all eight ICE field offices that we interviewed, referrals of schools that may exhibit criminal behavior within the offices’ area of responsibility would prove useful in that agents could better target these potentially fraudulent schools for further review or investigation. The Compliance Unit Chief and the Policy Branch Chief stated that the program had not previously shared its compliance case log or other information regarding the program’s compliance monitoring activities with CTCEU because the unit has never asked for such information. However, the coordination standard operating procedures as well as internal control guidance indicate that agencies could benefit from sharing internally generated information with key stakeholders, which may help with fraud management efforts. By establishing criteria for identifying potentially criminal activity, SEVP would be better positioned to adhere to existing requirements of referring criminal cases to CTCEU for investigation. Page 36 GAO-12-572 Student and Exchange Visitor Program ICE aims to facilitate study in the United States for hundreds of thousands Conclusions of foreign students each year. Effective oversight of SEVP entails balancing this objective against the program’s potential risks, including security vulnerabilities and opportunities for criminal exploitation. To find this balance, ICE is responsible for identifying the risks posed by schools, and being in a position to mitigate them. ICE has taken initial actions to identify program risks; however, it has not analyzed available information to identify and assess programwide risks, and make resource allocation decisions based on identified risks. Identifying and assessing program risks based on various factors, including information on prior and suspected cases of school noncompliance and fraud, and information from CTCEU and field office investigations and outreach events, could better position ICE to determine actions to help prevent school noncompliance and fraud and to address noncompliance and fraud when they occur. Further, developing and implementing a process to identify and assess risks could allow ICE to identify and address program weaknesses, take actions to strengthen school oversight, and allocate program resources in a more efficient and effective manner. Moreover, there are opportunities for ICE to improve its ability to prevent and detect fraud through the initial certification and ongoing monitoring of schools. By implementing existing fraud control practices, ICE could enhance its ability to detect school certification fraud and gain greater assurance that its operations are designed to protect the integrity of the system, even as it strives to enhance service and address work backlogs, such as in the recertification process. Specifically, establishing procedures for verifying and ensuring the completeness of school evidence; addressing missing case files; monitoring the licensing, accreditation status, and FAA certification status of schools; and setting target time frames for completing procedures to address SEVP-certified flight schools that do not have, or have not maintained, required FAA certifications, could help ICE ensure that legitimate institutions participate in SEVP. Further, by strengthening coordination and communication between SEVP and CTCEU, ICE could better ensure that SEVP, CTCEU, and ICE field offices understand information to be shared with regarding whether to take administrative actions during criminal investigations and that clear criteria exist for referring cases from CTCEU based upon potentially criminal behavior. Page 37 GAO-12-572 Student and Exchange Visitor Program To enhance ICE’s ability to assess program risks, prevent and detect Recommendations for school certification fraud, and improve the controls over SEVP, we Executive Action recommend that the Assistant Secretary of Immigration and Customs Enforcement take the following eight actions: • Develop and implement a process to identify and assess risks in SEVP, including o evaluating prior and suspected cases of school noncompliance and fraud to identify potential trends, and o obtaining and assessing information from CTCEU and ICE field office investigative and outreach efforts. • Once a risk assessment process is in place, conduct an analysis of how to allocate SEVP’s resources based on risk and use the results of that analysis in making resource allocation decisions. • Consistently implement procedures for ensuring schools’ eligibility, including consistently verifying “in lieu of” letters. • Establish a process to identify and address all missing school case files, including determining the magnitude of the problem; obtaining required documentation for schools whose case files are missing evidence, as appropriate; and taking necessary compliance actions. • Develop and implement a process to monitor state licensing and accreditation status of all SEVP-certified schools. • Establish target time frames for notifying SEVP-certified flight schools that lack required FAA certification that they must re-obtain FAA certification. • Revise the standard operating procedure that governs coordination among SEVP, CTCEU, and ICE field offices to specify what information to share among stakeholders during criminal investigations. • Establish criteria for referring cases of a potentially criminal nature from SEVP to CTCEU. We provided a draft of this report to DHS and the Department of State for Agency Comments their review and comment. DHS provided written comments, which are and Our Evaluation reproduced in full in appendix II. DHS concurred with our eight recommendations and described actions under way or planned to address them. DHS indicated that ICE plans to develop and complete a process to identify and assess risks in SEVP, as well as conduct an organizational analysis to determine if resources are properly allocated by risk. In addition, DHS indicated that ICE is developing a quality assurance process to ensure the completeness of records associated with school certification. DHS also indicated that SEVP personnel are developing procedures to ensure frequent validation of license or accreditation Page 38 GAO-12-572 Student and Exchange Visitor Program information on SEVP-certified schools. These actions should help address the intent of our recommendations. DHS also provided technical comments, which we incorporated as appropriate. The Department of State did not have formal comments on our draft report, but provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretaries of Homeland Security and State, and appropriate congressional committees. In addition, the report will be available at no charge on the GAO web-site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6912, or email@example.com. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors are listed in appendix III. Rebecca Gambler Acting Director, Homeland Security and Justice Issues Page 39 GAO-12-572 Student and Exchange Visitor Program List of Requesters The Honorable Charles E. Grassley Ranking Member Committee on the Judiciary United States Senate The Honorable Charles E. Schumer Chairman Subcommittee on Immigration, Refugees and Border Security Committee on the Judiciary United States Senate The Honorable Dianne Feinstein United States Senate The Honorable Claire McCaskill United States Senate Page 40 GAO-12-572 Student and Exchange Visitor Program Appendix I: Scope and Methodology Appendix I: Scope and Methodology This report examines the extent to which U.S. Immigration and Customs Enforcement (ICE) has (1) identified and assessed risks in Student and Exchange Visitor Program (SEVP), and (2) developed and implemented policies and procedures to prevent and detect fraud during the initial school certification process and once schools begin accepting foreign students. To determine the extent to which ICE identifies and assesses risk in the SEVP, we analyzed program documentation, collected and analyzed data on the population of SEVP-certified schools as of December 8, 2011, and interviewed officials from the Department of Homeland Security (DHS) and its components. We evaluated the extent to which ICE’s practices were consistent with Standards for Internal Control in the Federal Government and DHS’s Policy for Integrated Risk Management. 1 In particular, we analyzed ICE and SEVP documentation, such as standard operating procedures, policy statements, and guidance for adjudicators, to determine how ICE’s processes and systems identify and assess risk in SEVP. To understand the magnitude of previous cases of fraud, we collected and evaluated information on previous cases of fraud through analyzing ICE press releases, as well as collecting documents and interviewing investigators from ICE’s Counterterrorism and Criminal Exploitation Unit (CTCEU). We reviewed publicly available information on 12 cases of fraud dating from 2006 to 2011. The information obtained from these cases is not representative of all school fraud cases nationwide, but provided us with examples of school fraud. We also collected information from ICE on resources for SEVP, including budget data since fiscal year 2006, and information from ICE on SEVP’s contract to develop a risk-based approach for overseeing SEVP-certified schools. To evaluate ICE’s ability to identify and assess risk in SEVP, we examined information on SEVP’s data management systems, including the Student and Exchange Visitor Information System (SEVIS), SEVP Automated Management System (SEVPAMS), and I-17 Tracking and 1 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov. 1, 1999) and Department of Homeland Security, DHS Policy for Integrated Risk Management (Washington, D.C.: May 27, 2010). Page 41 GAO-12-572 Student and Exchange Visitor Program Appendix I: Scope and Methodology Reporting System. 2 We analyzed SEVP’s compliance case log, which identifies specific SEVP-certified schools that are under additional review for suspected noncompliant activity. We analyzed these schools for specific school attributes—such as the type of school—of the potentially noncompliant schools. To determine the potential threat posed by designated school officials, who issue the Forms I-20 to the students and oversee all enrolled foreign students, we cross-referenced SEVP’s list of primary designated school officials (as of December 2011) with the Department of Justice’s National Security Division list of individuals convicted as a result of terrorism-related investigations through March 2010, which was previously used in GAO’s work on criminal alien statistics, and found no matches. 3 Moreover, we interviewed SEVP officials to evaluate the extent to which the program identifies and assesses risk. We met with senior officials from SEVP, including SEVP’s Director, Deputy Directors, and management for all branches—School Certification, Response, Policy, Analysis and Operations Center, Field Representative Program, Mission Support, and Information Technology. We also interviewed officials from CTCEU and criminal investigators from 8 of the 26 ICE field offices. We visited ICE field offices located in Atlanta, Georgia; Dallas, Texas; Miami, Florida; New York, New York; and Washington, D.C. We conducted telephone interviews with the ICE field offices in Los Angeles, San Diego, and San Francisco, California. We selected these locations based on a mix of criteria, including whether the office had any of the following characteristics: (1) investigated a case of school fraud; (2) had previous or current experience with school fraud based on CTCEU referrals; and (3) was investigating a school according to SEVP’s compliance case log during the period of this review. As we did not select a probability sample of ICE field offices to interview, the results of these interviews cannot be projected to all of ICE’s 26 field offices. However, the interviews provided 2 SEVIS is a web-based application that is used by SEVP-certified schools to submit petitions for certification and recertification, update petition information, issue forms to students, and update student data. SEVIS is used by SEVP to certify and recertify schools, track students, and monitor schools’ program compliance. SEVPAMS is a system used by SEVP and intended to store and create documents associated with SEVP- certified schools such as documentation of initial petition, compliance review activity, and school information updates. The I-17 Tracking and Reporting System is a system used by SEVP and is intended to track the progress of schools applying for SEVP-certification. 3 GAO, Criminal Alien Statistics: Information on Incarcerations, Arrests and Costs, GAO-11-187 (Washington, D.C.: Mar. 24, 2011). Page 42 GAO-12-572 Student and Exchange Visitor Program Appendix I: Scope and Methodology us with the perspectives of ICE officials responsible for conducting school fraud investigations, including their views on the processes SEVP has established for certifying and monitoring these schools and any challenges field offices have faced in their investigations. To determine the extent to which DHS has implemented policies and procedures to prevent and detect fraud, we analyzed the processes SEVP uses to (1) initially certify schools to enroll nonimmigrant foreign students; (2) maintain records to ensure schools’ continued eligibility; (3) monitor schools’ eligibility once certified; and (4) oversee schools offering flight training. We also analyzed the processes SEVP uses to manage and share key information with other ICE stakeholders, including CTCEU and ICE field offices. As part of our effort to evaluate these processes, we reviewed applicable laws and regulations, such as the Border Security Act and regulations governing nonimmigrant visa classes. 4 We also reviewed ICE’s standard operating procedures for certifying and recertifying schools, recordkeeping, compliance reviews, and information- sharing during criminal investigations. In addition, we reviewed SEVP’s internal policies and guidance specifically concerning English language and flight schools and the recertification process. We compared these processes to criteria established in laws and regulations, as well as to criteria in the Standards for Internal Control in the Federal Government, the U.K. National Audit Office’s Good Practice in Tackling External Fraud, and the Project Management Institute’s The Standard for Program Management. 5 We collected and analyzed data from ICE’s SEVIS (as of December 8, 2011) to identify schools certified by SEVP to enroll nonimmigrant foreign students under F and M visas. We assessed the reliability of these data by (1) reviewing existing documentation on the controls in the system and the policies for ensuring data reliability; and (2) interviewing agency officials about the data’s sources, the system’s built-in internal controls, and any quality assurance steps performed after data are entered into the system. We identified several limitations to the data due to ICE’s reliance 4 8 U.S.C. § 1762. The regulations governing nonimmigrant classes are found in 8 C.F.R. pt. 214. 5 U.K. National Audit Office, Good Practice in Tackling External Fraud (London, England: 2008) and Project Management Institute’s The Standard for Program Management © (2006). Page 43 GAO-12-572 Student and Exchange Visitor Program Appendix I: Scope and Methodology on school officials for data entry and updates. SEVIS is used by school officials to apply for and receive certification as well as to keep records of individual students who enter the United States on F and M visas. Although SEVP officials may allow a designated school official to make edits to the school’s petition, all data or information corrections are incumbent upon those school officials. Therefore, invalid data elements appear in the data, including entries for school names, as well as for mailing and physical location addresses, cities, and states. While we identified such limitations, we found the data sufficiently reliable for providing general background information on the population of SEVP- certified schools and selecting a sample of schools for which to conduct a case file review. We used SEVIS school data as the population from which to select a nongeneralizable stratified random sample of 50 SEVP- certified schools’ case files. To select the sample, we relied upon the data on certified schools (as of December 8, 2011) provided by SEVP. We focused our analysis on post-secondary schools that reported either being unaccredited or not being accredited by a Department of Education-recognized accrediting agency. We then stratified the population of post-secondary, unaccredited schools based on the schools’ reported type of education provided. These five strata included flight training, language training, religious training, combination of flight/language/religious training, and general post-secondary education. Our random sample of 50 SEVP-certified schools included at least one of each strata indicated. We analyzed the schools’ case files to evaluate SEVP maintenance of school records per program requirements found in SEVP’s recordkeeping standard operating procedure. Specifically, we verified that SEVP maintained historic and more current records of the schools’ accreditation or evidence provided in lieu of accreditation, school officials’ proof of citizenship or residency, school officials’ attestation statements, and flight schools’ FAA certification. Further, we used the SEVIS data to identify all SEVP-certified schools that offer flight training by querying the following SEVIS categories: Type of Education and Nature of Subject Matter. We cross-referenced the list of schools that reported offering flight training to FAA’s lists of Part 141 and Part 142 schools. We also cross-referenced the list of SEVP-certified schools offering flight training to information on FAA certificate revocations. We previously used FAA’s data on Part 141 and 142 flight Page 44 GAO-12-572 Student and Exchange Visitor Program Appendix I: Scope and Methodology schools and revocations in work on pilot training in the United States and found such data reliable. 6 In addition to document and data collection and analysis, we interviewed the SEVP Director, Deputy Directors, and officials from SEVP’s branches as well as officials from CTCEU and our selected 8 SAC field offices to determine the extent to which ICE has policies and procedures to prevent and detect fraud within SEVP and to discuss SEVP’s management and information-sharing practices with CTCEU and SAC field offices. We also interviewed officials from Department of State to obtain officials’ views on State’s redesignation of exchange visitor sponsors and SEVP’s recertification of certified schools, which were both mandated in the Border Security Act. We conducted this performance audit from September 2011 through June 2012, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 6 GAO, Initial Pilot Training: Better Management Controls Are Needed to Improve FAA Oversight, GAO-12-117 (Washington, D.C.: Nov. 15, 2011). Page 45 GAO-12-572 Student and Exchange Visitor Program Appendix II: Comments from the Department Appendix II: Comments from the Department of Homeland Security of Homeland Security Page 46 GAO-12-572 Student and Exchange Visitor Program Appendix II: Comments from the Department of Homeland Security Page 47 GAO-12-572 Student and Exchange Visitor Program Appendix II: Comments from the Department of Homeland Security Page 48 GAO-12-572 Student and Exchange Visitor Program Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments Acknowledgments Rebecca Gambler, (202) 512-6912 or firstname.lastname@example.org GAO Contact In addition to the contact named above, Kathryn H. Bernet, Assistant Staff Director; Frances Cook, Mike Dino, Elizabeth Dunn, Anthony Fernandez, Acknowledgments David Greyer, Kirsten Lauber, Lara Miklozek, Richard Stana, and Julia Vieweg made significant contributions to this work. (441005) Page 49 GAO-12-572 Student and Exchange Visitor Program GAO’s Mission The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no Obtaining Copies of cost is through GAO’s website (www.gao.gov). Each weekday afternoon, GAO Reports and GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, Testimony go to www.gao.gov and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov. Contact: To Report Fraud, Waste, and Abuse in Website: www.gao.gov/fraudnet/fraudnet.htm E-mail: email@example.com Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, firstname.lastname@example.org, (202) 512- Congressional 4400, U.S. Government Accountability Office, 441 G Street NW, Room Relations 7125, Washington, DC 20548 Chuck Young, Managing Director, email@example.com, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Please Print on Recycled Paper.
Student and Exchange Visitor Program: DHS Needs to Assess Risks and Strengthen Oversight Functions
Published by the Government Accountability Office on 2012-06-18.
Below is a raw (and likely hideous) rendition of the original report. (PDF)