oversight

Student and Exchange Visitor Program: DHS Needs to Take Actions to Strengthen Monitoring of Schools

Published by the Government Accountability Office on 2012-07-24.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                             United States Government Accountability Office

GAO                          Testimony
                             Before the Subcommittee on Immigration,
                             Refugees, and Border Security, Committee
                             on the Judiciary, U.S. Senate

                             STUDENT AND
For Release on Delivery
Expected at 10:00 a.m. EST
Tuesday, July 24, 2012

                             EXCHANGE VISITOR
                             PROGRAM
                             DHS Needs to Take Actions
                             to Strengthen Monitoring of
                             Schools
                             Statement of Rebecca Gambler, Acting Director
                             Homeland Security and Justice




GAO-12-895T
Chairman Schumer, Ranking Member Cornyn, and Members of the
Subcommittee:

I am pleased to be here today to discuss the findings from our June 2012
report assessing U.S. Immigration and Customs Enforcement’s (ICE)
oversight of the Student and Exchange Visitor Program (SEVP). 1 ICE,
within the Department of Homeland Security (DHS), is responsible for
managing SEVP, including ensuring that foreign students studying in the
United States comply with the terms of their admission into the country.
ICE also certifies schools as authorized to accept foreign students in
academic and vocational programs. As of January 2012, more than
850,000 active foreign students were enrolled at over 10,000 certified
schools in the United States. In addition, ICE manages the Student and
Exchange Visitor Information System (SEVIS), which assists the agency
in tracking and monitoring certified schools, as well as approved students.
We reported in April 2011 on the need for close monitoring and oversight
of foreign students, and that some schools have attempted to exploit the
immigration system by knowingly reporting that foreign students were
fulfilling their visa requirements when they were not attending school or
attending intermittently. 2

Schools interested in accepting foreign students on F and M visas must
petition for SEVP certification by submitting a Form I-17 to ICE. 3 Once
this certification is achieved, schools issue Forms I-20 for students, which
enable them to apply for nonimmigrant student status. The Border
Security Act requires DHS to confirm, every 2 years, SEVP-certified
schools’ continued eligibility and compliance with the program’s
requirements. 4 During the initial petition and recertification processes, a
school must provide ICE with evidence of its legitimacy and its eligibility,



1
 GAO, Student and Exchange Visitor Program: DHS Needs to Assess Risks and
Strengthen Oversight Functions, GAO-12-572 (Washington, D.C.: June 18, 2012).
2
 GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and
Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs, GAO-11-411
(Washington, D.C.: Apr. 15, 2011).
3
 F visas are for academic study at 2- and 4-year colleges and universities and other
academic institutions. M visas are for nonacademic study at institutions, such as
vocational and technical schools. As of March 2012, schools applying for initial
certification were required to pay DHS $1,700, as well as a $655 site visit fee per campus.
4
8 U.S.C. § 1762.




Page 1                                                                        GAO-12-895T
such as designated school officials’ attestation statements that both the
school and officials intend to comply with program rules and regulations.

My testimony today summarizes the key findings of our report on ICE’s
management of SEVP, which was publicly released last week. 5 Like that
report, my statement will address ICE’s efforts to (1) identify and assess
risks in SEVP, and (2) develop and implement procedures to prevent and
detect fraud during the initial certification process and once schools begin
accepting foreign students. To conduct our work, we interviewed officials
from each of SEVP’s seven branches and criminal investigators from the
Counterterrorism and Criminal Exploitation Unit (CTCEU), as well as eight
ICE field offices, which allowed us to obtain their perspective on the
magnitude and risks associated with school fraud. We reviewed publicly
available information on 12 cases of school fraud dating from 2006 to
2011, which allowed us to better understand SEVP program risks.
Additionally, we reviewed standard operating procedures and tested
internal controls designed to ensure school oversight. To test SEVP’s
internal controls, we selected a nongeneralizable, stratified random
sample of 50 SEVP-certified schools and reviewed their case files to
verify that evidence required for certification existed, such as designated
school officials’ proof of citizenship or lawful permanent residency. We
conducted this work in accordance with generally accepted government
auditing standards. More detailed information on the scope and
methodology of our published report can be found therein.

In summary, we reported that ICE does not have a process to identify and
assess risks posed by schools in SEVP. Specifically, SEVP (1) does not
evaluate program data on prior and suspected instances of school fraud
and noncompliance, and (2) does not obtain and assess information from
CTCEU and ICE field office school investigations and outreach events.
Moreover, weaknesses in ICE’s monitoring and oversight of SEVP-
certified schools contribute to security and fraud vulnerabilities. For
example, ICE has not consistently implemented internal control
procedures for SEVP in the initial verification of evidence submitted in lieu
of accreditation. In addition, ICE has not consistently followed the
standard operating procedures that govern the communication and
coordination process among SEVP, CTCEU, and ICE field offices. We
recommended that ICE, among other things, identify and assess program



5
GAO-12-572.




Page 2                                                            GAO-12-895T
                      risks; consistently implement procedures for ensuring schools’ eligibility;
                      and, revise its standard operating procedure to specify which information
                      to share among stakeholders during criminal investigations. ICE
                      concurred with all the recommendations we made to address these
                      challenges and has actions planned or under way to address them.


                      ICE has not developed and implemented a process to identify and
ICE Does Not Have a   analyze program risks since assuming responsibility for SEVP in 2003,
Process to Identify   making it difficult for ICE to determine the potential security and fraud
                      risks across the more than 10,000 SEVP-certified schools and to identify
and Assess Risks      actions that could help mitigate these risks. SEVP and CTCEU officials
Posed by Schools in   expressed concerns about the security and fraud risks posed by schools
SEVP                  that do not comply with program requirements. Furthermore, various
                      cases of school fraud have demonstrated vulnerabilities in the
                      management and oversight of SEVP-certified schools. We reported that
                      SEVP faces two primary challenges to identifying and assessing risks
                      posed by schools: (1) it does not evaluate program data on prior and
                      suspected instances of school fraud and noncompliance, and (2) it does
                      not obtain and assess information from CTCEU and ICE field office
                      school investigations and outreach events.

                      Evaluating SEVP information on prior and suspected cases of
                      school noncompliance and fraud. SEVP does not have a process to
                      evaluate prior and suspected cases of school fraud and noncompliance to
                      identify lessons learned from such cases, which could help it better
                      identify and assess program risks. SEVP has maintained a compliance
                      case log since 2005—a list of approximately 172 schools (as of
                      December 2011) that officials have determined to be potentially
                      noncompliant with program requirements. The compliance case log
                      represents those schools that SEVP, on the basis of leads and out-of-
                      cycle reviews, is monitoring for potential noncompliance. According to
                      SEVP officials, it has not used this list to identify and evaluate possible
                      trends in schools’ noncompliance, although this list could provide useful
                      insights to SEVP to assess programwide risks. Further, SEVP officials
                      said that they have not looked across previous cases of school fraud and
                      school withdrawals to identify lessons learned on program vulnerabilities
                      and opportunities to strengthen internal controls. Our analysis indicates
                      that there are patterns in the noncompliant schools, such as the type of
                      school. For example, of the 172 postsecondary institutions on SEVP’s
                      December 2011 compliance case log, about 83 percent (or 142) offer
                      language, religious, or flight studies, with language schools representing
                      the highest proportion. Without an evaluation of prior and suspected


                      Page 3                                                           GAO-12-895T
cases of school fraud and noncompliance, ICE is not well positioned to
identify and apply lessons learned from prior school fraud cases, which
could help it identify and mitigate program risks going forward.

Obtaining information from CTCEU and ICE field offices’
investigations and outreach efforts. Based on our interviews with
SEVP’s Director and other senior officials, we reported that SEVP had not
established a process to obtain lessons learned information from
CTCEU’s criminal investigators. Investigators may have valuable
knowledge from working cases of school fraud in identifying and
assessing program risks, including information such as characteristics of
schools that commit fraud, how school officials exploited weaknesses in
the school certification process, and what actions ICE could take to
strengthen internal controls. For example, according to investigators in
one ICE field office, CTCEU was hampered in pursuing a criminal
investigation because SEVP officials did not obtain a signed attestation
statement within the I-17 application from a school official stating that the
official agreed to comply with rules and regulations. Another risk area we
reported on is designated school officials’ access to SEVIS. In 2011,
CTCEU provided SEVP officials with a position paper expressing
concerns that designated school officials, who are not required to
undergo security background checks, are responsible for maintaining
updated information on foreign students in SEVIS. Investigators at three
of the eight field offices we interviewed said that SEVP allowed
designated school officials to maintain SEVIS access and the ability to
modify records in the system while being the subject of an ongoing
criminal investigation, despite requests from CTCEU to terminate SEVIS
access for these officials. In addition, CTCEU collects data on its
outreach efforts with schools through its Campus Sentinel program;
however, the SEVP Director stated that his office had not obtained and
analyzed reports on the results of these visits. CTCEU initiated Campus
Sentinel in 2011, which ICE operates across all of its field offices
nationwide. 6 From October 1, 2011, through March 6, 2012, CTCEU
conducted 314 outreach visits to schools. According to CTCEU
investigators, these visits provide an opportunity to identify potential risks,
including whether schools have the capacity and resources to support


6
 Funded with SEVP fee collections, the program aims to foster relationships between ICE
law enforcement officials and schools through on-site visits and information sessions at
conferences and to make school officials more aware of recent investigations of school
fraud.




Page 4                                                                      GAO-12-895T
                         programs for foreign students. Obtaining information on lessons learned
                         from CTCEU investigators could help provide SEVP with additional
                         insights on such issues as characteristics of schools that have committed
                         fraud and the nature of those schools’ fraudulent activities.

                         To address these issues, we recommended that ICE develop and
                         implement a process to identify and assess risks in SEVP, including
                         evaluating prior and suspected cases of school noncompliance and fraud
                         to identify potential trends, and obtaining and assessing information from
                         CTCEU and ICE field office investigative and outreach efforts. DHS
                         concurred and stated that ICE will develop and implement such a process
                         by later this year.


                         ICE has not consistently implemented existing internal control procedures
Weaknesses in ICE’s      for SEVP in four areas: (1) initial verification of evidence submitted in lieu
Monitoring and           of accreditation, (2) recordkeeping to ensure schools’ continued eligibility,
                         (3) ongoing compliance monitoring of school licensing and accreditation
Oversight of SEVP-       status, and (4) certification of schools offering flight training. Regulations
Certified Schools        require schools to establish that they are legitimate and meet other
                         eligibility criteria for their programs to obtain certification from ICE. 7 In
Contribute to Security   addition, weaknesses in managing and sharing key information with
and Fraud                CTCEU impede SEVP’s prevention and detection of school fraud. The
Vulnerabilities          following summarizes these key findings and recommendations we made
                         to address these issues.

                         Initial verification of evidence submitted in lieu of accreditation. ICE
                         requires schools to present evidence demonstrating that the school is
                         legitimate and is an established institution of learning or other recognized
                         place of study, among other things. Non-accredited, post-secondary
                         schools, in particular, must provide “in lieu of” letters, which are evidence
                         provided by petitioning schools in lieu of accreditation by a Department of
                         Education-recognized accrediting agency. ICE policy and guidance
                         require that SEVP adjudicators render an approval or denial of schools’
                         petitions based on such evidence and supporting documentation. This
                         includes verifying that schools’ claims in the Form I-17, such as
                         accreditation status and “in lieu of” letters, are accurate. However, SEVP


                         7
                          8 C.F.R. § 214.3(a)(3) states that a school, to be eligible for certification, must establish
                         that it is bona fide. For the purposes of this report, we use the term “legitimate”
                         synonymously with the term “bona fide.”




                         Page 5                                                                            GAO-12-895T
adjudicators have not verified all “in lieu of” letters submitted to ICE by the
approximately 1,250 non-accredited, post-secondary schools, as required
by ICE’s policy. Rather, adjudicators decide whether to verify a letter’s
source and the signatory authority of the signee based on any suspicions
of the letters’ validity. Investigators at one of the eight ICE field offices we
interviewed stated SEVP officials certified at least one illegitimate
school—Tri-Valley University in California—because the program had not
verified the evidence provided in the initial petition. In March 2012,
CTCEU officials stated that several of their ongoing investigations involve
schools that provided fraudulent evidence of accreditation or evidence in
lieu of accreditation to ICE. Consistent verification of these letters could
help ICE ensure that schools are legitimate and detect potential fraud
early in the certification process. We recommended that ICE consistently
implement procedures for ensuring schools’ eligibility, including
consistently verifying “in lieu of” letters. DHS agreed and stated that
SEVP personnel have initiated mandatory verification of all “in lieu of”
letters.

Recordkeeping to ensure continued eligibility of schools. ICE’s
standard operating procedures for recordkeeping require SEVP officials
to maintain records to document ongoing compliance. We reported that
ICE had not consistently maintained certain evidence of selected schools’
eligibility for the program. According to our review of a stratified random
sample of 50 SEVP-certified school case files, 30 files did not contain at
least one piece of evidence required by the program’s policies and
procedures. In addition, ICE was unable to produce two schools’ case
files that we requested as part of our randomly selected sample. 8 Without
the schools’ information and evidence contained in these case files,
including attestation statements and site visit reports, ICE does not have
an institutional record to provide reasonable assurance that these schools
were initially and continue to be legitimate and eligible for certification.
According to ICE officials, the school recertification process would help
address issues with incomplete and missing school files because schools
are required to resubmit all evidence required by regulation when going
through recertification. The Border Security Act required recertification for
all SEVP-certified schools by May 2004 and every 2 years thereafter. 9


8
 Since ICE was unable to produce two schools’ case files, our results include the 48 files
that we were able to analyze.
9
 See 8 U.S.C. § 1762. The statute requires the review of institutions and other entities
authorized to enroll or sponsor certain nonimmigrants.




Page 6                                                                         GAO-12-895T
However, ICE began the first recertification cycle in May 2010 and did not
recertify all schools during this 2-year cycle, which ended in May 2012. As
of March 31, 2012, ICE reported to have recertified 1,870 schools
(approximately 19 percent of SEVP-certified schools). Given the delays in
completing recertification, ICE is not positioned to address gaps in
SEVP’s case files and cannot provide reasonable assurance that schools
that were initially certified to accept foreign students are still compliant
with SEVP regulations. Thus, we recommended that ICE establish a
process to identify and address all missing school case files, including
obtaining required documentation for schools whose case files are
missing evidence. DHS concurred and stated that SEVP plans to work
with ICE Records Management to develop protocols and actions to
strengthen records management.

Ongoing compliance monitoring of school licensing and
accreditation status. ICE does not have a process to monitor the
ongoing eligibility of licensed and accredited, non-language schools
enrolling foreign students. ICE regulations require all certified schools to
maintain state licensing (or exemption) and provide various forms of
evidence to ICE supporting schools’ legitimacy and eligibility. If a school
loses its state license, the school would be unable to operate legally as a
school within that state. However, ICE does not have controls to ensure
that SEVP compliance unit officials would be aware of this issue;
therefore, a school without a proper business license may remain certified
to enroll foreign students and its designated school officials may continue
to access SEVIS. We recommended that ICE develop and implement a
process to monitor state licensing and accreditation status of all SEVP-
certified schools. DHS concurred and stated that SEVP personnel are
developing procedures to ensure frequent validation of license or
accreditation information.

Certification of schools offering flight training. ICE’s policies and
procedures require flight schools to have Federal Aviation Administration
(FAA) Part 141 or 142 certification to be eligible for SEVP certification;
however, ICE has certified schools offering flight training without such
FAA certifications. As the federal agency responsible for regulating safety
of civil aviation in the United States, FAA administers pilot certification
(licensing) and conducts safety oversight of pilot training. FAA’s
regulations for pilot training and certification are found in three parts—




Page 7                                                           GAO-12-895T
Parts 61, 141, and 142. 10 ICE established a policy that requires Part 141
and 142 for eligibility in SEVP because FAA directly oversees these flight
schools and training centers on an ongoing basis. 11 We reported
identifying 434 SEVP-certified schools that, as of December 2011, offer
flight training to foreign students. 12 However, 167 (38 percent) of these
flight training providers do not have FAA Part 141 or 142 certification.
SEVP senior officials acknowledged that all SEVP-certified schools
offering flight training do not have FAA Part 141 or 142 certification even
though the program requires it. ICE indicated that in most of the cases, it
may have initially certified flight schools with Part 141 or 142 certification
but the schools allowed their FAA certification to expire, and ICE did not
identify or take compliance action against them. ICE is taking actions to
address noncompliant flight schools as of May 2012, including notifying
all SEVP-certified schools that do not have the required FAA certification
that they must re-obtain the certification. Moreover, SEVP officials stated
that they plan to coordinate with FAA to determine which schools have
not met the requirements and will take withdrawal actions against them.
While these are positive steps, we reported that SEVP had not yet
established target time frames for implementing and completing these
planned actions. Because ICE has certified or maintained certification of
schools that provide flight training without the required FAA certification
and oversight, the program is vulnerable to security and fraud risks. Thus,
we recommended that ICE establish target time frames for notifying
SEVP-certified flight schools that do not have the required FAA
certification that they must re-obtain FAA certification. DHS concurred
and stated that SEVP is consulting with FAA to develop target time
frames.

Coordination among SEVP, CTCEU, and ICE field offices. ICE has not
consistently followed the standard operating procedures that govern the
communication and coordination process among SEVP, CTCEU, and ICE



10
 Federal aviation regulations are found under title 14 of the United States Code of
Federal Regulations (14 C.F.R. pts. 61, 141, and 142).
11
  Part 61 relates to individual providers/instructors that are not subject to direct FAA
oversight beyond the initial certification and subsequent renewal of each flight instructor’s
certificate. Parts 141 and 142 outline requirements for flight schools and training centers.
FAA oversees these Part 141 and 142 flight schools and training centers with annual
inspections and by reviewing and approving the schools’ facilities and programs.
12
  This is a relatively small percentage of providers nationwide that offer flight training.




Page 8                                                                            GAO-12-895T
                  field offices. Specifically, these procedures delineate roles and
                  responsibilities for criminal investigations and establish protocols for
                  SEVP taking administrative actions against schools during and following a
                  criminal investigation. In some instances, SEVP management has not
                  followed CTCEU requests to take or cease administrative actions and has
                  not referred potentially criminal cases to CTCEU in accordance with ICE’s
                  procedures. By strengthening coordination and communication between
                  SEVP and CTCEU, ICE could better ensure that SEVP, CTCEU, and ICE
                  field offices understand which information to share regarding whether to
                  take administrative actions during criminal investigations and that clear
                  criteria exist for referring cases from CTCEU based upon potentially
                  criminal behavior. Thus, we recommended that ICE revise its standard
                  operating procedure to specify which information to share among
                  stakeholders during criminal investigations. DHS concurred and stated
                  that SEVP will work with CTCEU and ICE field personnel to make the
                  necessary revisions. We also recommended that ICE establish criteria for
                  referring cases of a potentially criminal nature from SEVP to CTCEU. ICE
                  agreed and stated that SEVP will work with CTCEU to improve this
                  process.


                  Chairman Schumer, Ranking Member Cornyn, and members of the
                  subcommittee, this concludes my prepared statement. I would be pleased
                  to answer any questions that you may have at this time.


                  For further information regarding this testimony, please contact Rebecca
Contacts and      Gambler at (202) 512-8777, or gamblerr@gao.gov. In addition, contact
Acknowledgments   points for our Offices of Congressional Relations and Public Affairs may
                  be found on the last page of this statement. Individuals who made key
                  contributions to this testimony are Kathryn Bernet, Assistant Director;
                  Frances Cook; Elizabeth Dunn; Anthony C. Fernandez; David Greyer;
                  and, Lara Miklozek.




(441091)
                  Page 9                                                         GAO-12-895T
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (www.gao.gov). Each weekday afternoon,
GAO Reports and       GAO posts on its website newly released reports, testimony, and
                      correspondence. To have GAO e-mail you a list of newly posted products,
Testimony             go to www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      http://www.gao.gov/ordering.htm.
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
                      Contact:
To Report Fraud,
Waste, and Abuse in   Website: www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548




                        Please Print on Recycled Paper.