Audit of the Department of Education's

Followup Process for External Audits

# FINAL AUDIT REPORT

# 

# 

# 

# 

# 

# 

# 

# ED-OIG/A19-D0007

**March 2005**

![](media/image3.png)

Our mission is to promote the efficiency, U.S. Department of Education

effectiveness, and integrity of the Office of Inspector General

Department's programs and operations. Operations Internal Audit Team
Washington, DC

######## 

Statements that managerial practices need improvements, as well as other

conclusions and recommendations in this report,

represent the opinions of the Office of Inspector General.
Determinations of

corrective action to be taken will be made by

the appropriate Department of Education Officials.

In accordance with the Freedom of Information Act (5 U.S.C. § 552),
reports issued

by the Office of Inspector General are available to members of the

press and general public to the extent information contained therein is
not

**subject to exemptions in the Act.**

> ![](media/image4.wmf)

**[MEMORANDUM]{.underline}**

March 31, 2005

**TO:** Jack Martin

> Chief Financial Officer
>
> Office of the Chief Financial Officer

**FROM:** Helen Lew /s/

Assistant Inspector General for Audit Services

**SUBJECT:** Final Audit Report

> Audit of the Department of Education's Followup Process for External
> Audits

Control Number ED-OIG/A19-D0007

Attached is the subject final audit report that covers the results of
our review of the followup process for external audits at various
Principal Offices for external OIG audits issued during the period
October 1, 1997, through September 30, 2002. An electronic copy has been
provided to your Audit Liaison Officer. We received your comments which
generally concurred with the findings and most of the recommendations in
our draft report.

Corrective actions proposed (resolution phase) and implemented (closure
phase) by your office will be monitored and tracked through the
Department's Audit Accountability and Resolution Tracking System
(AARTS). ED policy requires that you develop a final corrective action
plan (CAP) for our review in the automated system within 30 days of the
issuance of this report. The CAP should set forth the specific action
items, and targeted completion dates, necessary to implement final
corrective actions on the findings and recommendations contained in this
final audit report.

In accordance with the Inspector General Act of 1978, as amended, the
Office of Inspector General is required to report to Congress twice a
year on the audits that remain unresolved after six months from the date
of issuance.

In accordance with the Freedom of Information Act (5 U.S.C. §552),
reports issued by the Office of Inspector General are available to
members of the press and general public to the extent information
contained therein is not subject to exemptions in the Act.

We appreciate the cooperation given us during this review. If you have
any questions, please call Michele Weaver Dugan at (202) 245-6941.

Enclosure

**TABLE OF CONTENTS**

[Page]{.underline}

## EXECUTIVE SUMMARY 1

BACKGROUND 4

AUDIT RESULTS 6

> Finding No. 1 -- Office of the Chief Financial Officer Post Audit
> Group Did Not Ensure the Department's Audit Followup System for
> External Office of Inspector General (OIG) Audits Was Effective 6
>
> Recommendations 10
>
> Finding No. 2 --The Department Closed External OIG Audits Prior to
> Completion of Corrective Actions 11
>
> Recommendations 14

OBJECTIVE, SCOPE, AND METHODOLOGY 18

STATEMENT ON INTERNAL CONTROLS 21

ATTACHMENTS

Attachment 1 -- Principal Office Reports Issued in Conjunction with This
Audit

Attachment 2 --Audit Reports Reviewed in This Audit

Attachment 3 -- Department Response to Draft Audit Report

######### EXECUTIVE SUMMARY

Office of Management and Budget (OMB) Circular A-50, *Audit Followup*,
states,

> Each agency shall establish systems to assure the prompt and proper
> resolution and implementation of audit recommendations. These systems
> shall provide for a complete record of action taken on both monetary
> and nonmonetary findings and recommendations.

The Circular requires that each agency designate a top management
official to oversee followup, including resolution and corrective
action. The Department of Education's (Department's) designated followup
official is the Chief Financial Officer (CFO). Within the Office of the
Chief Financial Officer (OCFO), the Post Audit Group (PAG) is
responsible for assisting the CFO in the audit followup process.

The objective of our audit was to evaluate the effectiveness of the
Department's audit followup process to ensure that external auditees
implement corrective actions as a result of Office of Inspector General
(OIG) audits.

We found that the Department's audit followup system was not always
effective. PAG did not fulfill its responsibilities to ensure that
Action Officials (AOs) had systems in place to follow up on corrective
actions, monitor the Department's compliance with OMB Circular A-50, and
ensure the overall effectiveness of the Department's audit resolution
and followup system. In total, we found that audit followup activities
were not effective for 17 of the 46 audits reviewed. As a result, the
Department did not have assurance that requested corrective actions were
completed for 40 of the 239 recommendations reviewed. The risks remain
that related programs are not being effectively managed and Department
funds are not being used as intended.

We also found that Principal Office (PO) staff closed audits prior to
completion of corrective actions. As a result, PAG was no longer
tracking audits for which all corrective actions had not been completed,
and these audits were underreported to Congress.

To correct the identified weaknesses, we recommend that the Chief
Financial Officer:

-   Develop and implement a process to periodically evaluate the
    appropriateness of the PO followup systems for external OIG audits.

-   Develop and implement guidance that (a) defines the roles of PAG and
    the POs for followup activity for discretionary grant audits
    resolved by PAG, and (b) defines audit closure for external OIG
    audits, including audits on appeal and audits for which collection
    activity is ongoing.

-   Provide training to PO audit resolution staff on the requirements
    for audit followup, the documentation that should be maintained, and
    the requirements that must be met before an audit should be
    considered closed.

-   Develop and implement a process requiring AO certification and PAG
    validation that adequate documentation was received to support
    completion of corrective actions prior to closing external OIG
    audits.

-   Ensure the status of external OIG audits currently in litigation, or
    awaiting re-evaluation, is reflected as resolved, but not closed, in
    the Audit Accountability Resolution Tracking System (AARTS) to
    accurately reflect status.

-   Identify all external OIG audits that were closed since September
    30, 2004, determine those audits for which corrective actions have
    been completed, and those for which corrective actions are still in
    process. For those audits where corrective action has been
    completed, ensure an appropriate "closed" date is reflected in
    AARTS. For those audits where corrective actions are still in
    process, correct the data in AARTS to accurately reflect the status
    of the audits, and continue tracking the completion of corrective
    actions.

-   Ensure the Department's *Semiannual Report to Congress on Audit
    Follow-up* accurately reports audits which have been resolved, but
    for which corrective actions have not been completed.

We discussed our findings and recommendations in our exit conference
with OCFO and PO staff. OCFO provided a written response to the
preliminary findings and recommendations presented at the exit
conference. Where appropriate, we included and addressed elements of the
OCFO response to the exit conference in this draft report.

The Department concurred with our recommendations with two exceptions.
The Department stated our recommendation to develop and implement a
process requiring AO certification and the PAG review of the adequacy of
audit follow-up documentation prior to closing external OIG audits was
impractical in terms of cost, travel and staff hours it will demand. The
Department added the PO should have discretion in how follow-up is
accomplished based upon resources available, and that implementing this
recommendation would require a dedication of staff and budgetary
resources that far exceeds any marginal benefits to be realized.

We recognize the role and responsibility of the Department in resolving
and closing OIG external audits. However, in accordance with OMB
Circular A-50, the Department's *Post Audit User Guide,* and the
Department's *AARTS User Manual,* when corrective actions are defined,
the Department has the responsibility to ensure they are taken. The
Department also expressed concern in certifying actions taken by
external entities. Based on the Department's comments we modified the
recommendation to clarify that the recommended certification and review
process relates to the adequacy of information obtained prior to closing
the audit.

The Department also disagreed with our recommendation to identify all
external OIG audits that have been closed since September 30, 2003, and
review the status of each corrective action. The Department stated this
would be extremely resource intensive and detract from current
resolution efforts. Finally, the Department did not believe that the
findings in the draft audit report warrant this degree of scrutiny. Our
audit determined that the Department closed recommendations prior to the
completion of corrective action in 24 of the 46 audits reviewed (52
percent). We found that this caused data to be underreported to Congress
in reports submitted by the Department and the OIG. We believe it is
imperative that data provided to Congress is complete and accurate. We
reconsidered this recommendation in response to the Department's request
at our exit conference for this audit and reduced the time period
subject to review from external OIG audits closed over the past two
years to those closed since September 30, 2003. We have subsequently
modified this period to those closed since September 30, 2004 to help
ensure the data included in the next reports to Congress are accurate.

In its response, the Department requested a meeting with OIG to further
discuss these issues and the impact of the recommendations before the
final report is issued.  OIG modified two of its recommendations based
on the Department\'s comments as detailed above, and is willing to meet
with the Department during the audit resolution process to discuss any
concerns that may remain in these areas.  The entire text of the
Department\'s response is provided as Attachment 3 to this report.

**BACKGROUND**

Office of Management and Budget (OMB) Circular A-50, *Audit Followup*,
provides the requirements for establishing systems to assure prompt and
proper resolution and implementation of audit recommendations. The
Circular states,

> Audit followup is an integral part of good management, and is a shared
> responsibility of agency management officials and auditors. Corrective
> action taken by management on resolved findings and recommendations is
> essential to improving the effectiveness and efficiency of Government
> operations. Each agency shall establish systems to assure the prompt
> and proper resolution and implementation of audit recommendations.
> These systems shall provide for a complete record of action taken on
> both monetary and non-monetary findings and recommendations.

The Circular requires that each agency designate a top management
official to oversee followup, including resolution and corrective
action. The Department of Education's (Department's) designated followup
official is the Chief Financial Officer (CFO). Within the Office of the
Chief Financial Officer (OCFO), the Post Audit Group (PAG) is
responsible for assisting the CFO in the audit followup process.

When an external Office of Inspector General (OIG) audit report is
issued, Department officials review available information including
items such as the audit report and the auditee response. They develop a
resolution document that provides notice to the auditee of management
decisions or program determinations made by the Department.[^1] These
determinations relate to the monetary and non-monetary findings in the
audit report. Once this document has been issued to the auditee, the
audit is considered "resolved."

OMB Circular A-50 defines audit resolution as follows:

> For most audits, the point at which the audit organization and agency
> management or contracting officials agree on action to be taken on
> reported findings and recommendations; or, in the event of
> disagreement, the point at which the audit followup official
> determines the matter to be resolved.

OMB Circular A-50 further states that the audit followup official has
the responsibility for ensuring that corrective actions are taken.

The Department implemented the Audit Accountability and Resolution
Tracking System (AARTS) in July 2003. AARTS is a web-based application
designed to assist the Department's management with audit reporting and
followup activities. The AARTS User Manual for External Audits states
that an audit is considered "closed" when ". . .the PO \[Principal
Office\] Specialist indicates that all required corrective action has
been taken." The Common Audit Resolution System (CARS) preceded AARTS as
the Department's audit tracking system for external audits.

The Department has established a *Post Audit User Guide* (Guide) to
provide policy and procedures for the audit resolution and followup
process. The Guide provides that,

> Each Assistant Secretary (or equivalent office head) with cooperative
> audit resolution or related responsibilities must ensure that the
> overall cooperative audit resolution process operates efficiently and
> consistently.

The Guide defines the responsibilities of an Action Official (AO) --
generally an Assistant Secretary or equivalent office head -- to
include:

-   Determining the action to be taken and the financial adjustments to
    be made in resolving findings in audit reports concerning respective
    program areas of responsibility,

-   Monitoring auditee actions in order to ensure implementation of
    recommendations sustained in program determinations, and

-   Maintaining formal, documented systems of cooperative audit
    resolution and followup.

The Guide also defines roles and responsibilities for PAG that include:

-   Ensuring that AOs have appropriate audit followup systems in place
    and that these systems are being effectively used,

-   Monitoring the Department\'s compliance with OMB Circular A-50, and

-   Ensuring the overall effectiveness of the Department's audit
    followup system.

This report presents the results of our audit of the Department's audit
followup process for external OIG audits. It combines the results of
work conducted within seven POs. In conducting this audit, separate
reports were issued to POs with responsibility for audit resolution and
followup for the audits included in our scope. A listing of these
reports is included as Attachment 1 to this report. The following POs
were included in our audit:

-   Federal Student Aid (FSA)

-   Office of Elementary and Secondary Education (OESE)[^2]

-   Office of Postsecondary Education (OPE)

-   Office of Special Education and Rehabilitative Services (OSERS)

-   Office of the Chief Financial Officer (OCFO)

-   Institute of Educational Services (IES)[^3]

-   Office of English Language Acquisition (OELA)

A listing of the audits reviewed is included as Attachment 2 to this
report.

**AUDIT RESULTS**

We found that the Department's audit followup system was not always
effective. PAG did not fulfill its responsibilities to ensure that AOs
had systems in place to follow up on corrective actions, monitor the
Department's compliance with OMB Circular A-50, and ensure the overall
effectiveness of the Department's audit resolution and followup system.
In total, we found that audit followup activities were not effective for
17 of the 46 audits reviewed. As a result, the Department did not have
assurance that requested corrective actions were completed for 40 of the
239 recommendations reviewed. The risks remain that related programs are
not being effectively managed and Department funds are not being used as
intended.

We also found that PO staff closed audits prior to completion of
corrective actions. As a result, PAG was no longer tracking audits for
which all corrective actions had not been completed, and these audits
were underreported to Congress.

**Finding No. 1 -- PAG Did Not Ensure the Department's Audit Followup
System for External OIG Audits was Effective**

PAG did not fulfill its responsibilities to ensure that the Department's
audit followup system for external OIG audits was operating effectively.
Specifically, we found that PAG did not effectively:

-   Ensure that AOs had systems in place to follow up on corrective
    actions,

-   Monitor the Department's compliance with OMB Circular A-50, and

-   Ensure the overall effectiveness of Department's audit resolution
    and followup system.

During our review we evaluated audit resolution documents and the
corrective actions requested by the Department when resolving OIG
external audits. The 46 audits reviewed included a total of 239
recommendations sustained by the Department. We evaluated the resolution
documents to identify whether any corrective actions were requested in
response to the recommendations. We discussed the audit followup process
with PO staff, and evaluated documentation maintained by the POs to
determine whether the Department had obtained assurance that requested
corrective actions were taken. We found that in 17 of the 46 audits, for
40 of the 239 recommendations, the Department did not have documentation
adequate to support corrective actions taken by the auditee.

We found that some PO staff were not familiar with the requirements
included in OMB Circular A-50 and the *Post Audit User Guide* regarding
audit followup. Staff in one PO stated that they did not followup on
corrective actions once the audit resolution documents were issued. They
stated that they assumed the auditee would take the corrective actions
requested. Staff in one PO stated that they did not have sufficient
resources to follow up on all requested corrective actions. Staff in one
PO stated they were not familiar with the documentation needed and were
unsure of record retention requirements. Staff in one PO inappropriately
relied on subsequent single or compliance audits for assurance that
actions taken during OIG audits were corrected. We also found there was
confusion as to whether PO staff or PAG were responsible for following
up on corrective actions requested for OIG discretionary grant audits
resolved by PAG.

[Audit Followup Requirements]{.underline}

OMB Circular A-50, Section 7, "Responsibilities," states:

b.  Agency management officials are responsible for receiving and
    analyzing audit reports, providing timely responses to the audit
    organization, and taking corrective actions where appropriate....

> c\. The audit followup official has personal responsibility for
> ensuring that (1) systems of audit followup, resolution, and
> corrective action are documented and in place...(4) corrective actions
> are actually taken.

Government Accountability Office (GAO), "Standards for Internal Control
for the Federal Government," defines the minimum level of quality
acceptable for internal control in government. The fifth standard for
internal control, "Monitoring," states,

> Internal control monitoring should assess the quality of performance
> over time and ensure that findings of audits and other reviews are
> promptly resolved...Managers are to...(3) complete, within established
> timeframes, all actions that correct or otherwise resolve the matters
> brought to management's attention. . ..

OCFO's *Post Audit User Guide,* Chapter 1, Part D, states the Chief
Financial Officer is the designated Audit Followup Official (AFUO) for
the Department of Education. The Guide also states the AFUO is
responsible for:

> Ensuring that a system of cooperative audit resolution and follow-up
> is documented and in place, including follow-up to ensure corrective
> actions are implemented.

Part E of the same chapter states that the PAG within the OCFO provides
support to the AFUO. The Guide further states PAG/OCFO is responsible
for, ". . .\[M\]onitoring the Department\'s compliance with OMB Circular
A-50, Audit Follow-up."

Section III, "External Audits," Chapter 5, Part B, of the Guide states:

> Primary responsibility for following up on nonmonetary determinations
> rests with AOs, who must have systems in place to ensure that
> recommended corrective actions are implemented by auditees. PAG/OCFO
> has responsibility for verifying that AOs have systems in place to
> followup on corrective actions and ensuring overall effectiveness of
> ED's \[Department of Education's\] audit resolution followup system.

This section also states, "Accurate records must be kept of all audit
followup activities including all correspondence, documentation, and
analysis of documentation."

While PAG did issue policy and procedures on audit followup requirements
through the *Post Audit User Guide*, and clarification in September 2002
on specific documentation requirements, it had not established a process
to verify that the POs fully understood the requirements, were in
compliance, and had appropriate systems in place to follow up on
corrective actions. As a corrective action to a prior OIG audit of the
effectiveness of the audit followup process for OIG internal audits,[^4]
PAG implemented a process to review PO audit resolution files to ensure
that appropriate documentation had been obtained to assure that
corrective actions were completed. PAG's process requires this review to
be conducted before audits can be considered closed. This process went
into effect as of January 1, 2003, but only applies to internal OIG and
GAO audits of the Department. PAG does not review the adequacy of
documentation obtained to support corrective actions taken for external
OIG audits.

Without this review, PAG could not evaluate the effectiveness of the PO
systems for audit followup and could not identify that PO staff did not
always obtain and maintain appropriate documentation that corrective
actions were taken by the auditees. We also found that PAG was not
effectively following up on corrective actions requested for the
discretionary grant audits it resolved, or ensuring that the appropriate
program office was following up on the requested corrective actions. As
a result, the Department was not in compliance with OMB Circular A-50,
and its audit resolution and followup system for external OIG audits was
not always effective. The Department did not have assurance that the
requested corrective actions were taken and that the issues noted in the
audits were corrected. As such, the risks remain that related programs
are not being effectively managed and Department funds are not being
used as intended.

In a written response to our preliminary findings and recommendations
presented at the exit conference, PAG stated:

> \[T\]here is a discrepancy in the definitions of the terms "resolved"
> and "closed" as interpreted by OIG in its point sheets versus the
> practicality of how these terms are currently defined by management.
> Once a management decision (PDL or FAD) is issued, the audit is both
> "resolved" and "closed" *unless* the decision specifically requests
> follow-up activity from the auditee, e.g., within 60 days provide
> written policies....

PAG further stated:

> \[T\]he findings and recommendations are based on the premise that all
> external audit findings have equal value, either procedurally or
> monetarily, without consideration of management's discretion to
> determine the degree of effort required based on the complexity or
> severity of the finding and staff resources. Triage is a process that
> has been effectively used throughout the Department, with OIG and
> OGC's support and participation, for many years. It provides a
> consensus and direction on how to address audit findings. Requesting
> an entity to take a particular action for a finding determined by
> Triage members to be "minor," and not obligating resources to follow
> up on the action, should not be construed as a management weakness;
> instead, it should be acknowledged as management using its discretion
> to dedicate staff resources responsibly.

OIG did not misinterpret the definitions of the terms "resolved" and
"closed" as used by the Department. Our audit began with closed audits
for which the Department requested corrective actions in the management
decision. These audits would be considered resolved at the time of the
management decision, but not closed until corrective actions were
completed. We confirmed the definitions of these terms with PAG staff
during our review. PAG staff confirmed our understanding of these terms
in verbal discussions, and also provided the following in an email
during our review:

> An audit is considered closed when all findings/recommendations are
> closed. A finding or recommendation is closed when a PDL has been
> issued or, if there are instructions in the PDL to provide additional
> data or assurances, when the material has been received, analyzed and
> determined sufficient.

This definition of "closed" agrees with that provided in the
Department's response to the exit conference, and the definition in the
AARTS User Manual for External Audits, which states that an audit is
considered "closed" when ". . .the PO Specialist indicates that all
required corrective actions have been taken." This is the definition
used in our review.

As stated above, our basis for determining corrective actions to review
was the audit resolution document. We identified the corrective actions
[requested by the Department]{.underline} and obtained and evaluated the
adequacy of supporting documentation for each corrective action. Since
Department managers made the determination as to what actions were
required, we did not evaluate the significance of the actions requested
in the audit resolution document. We merely identified that the
Department did request corrective action. At no time during our review
did we find or were we provided with any documentation to indicate a
recommendation was determined to be "minor," and/or that the Department
did not intend to dedicate resources to follow up on the corrective
action.

Our audit methodology was conveyed to PAG and other Department staff
during our entrance conference, discussions with PO staff, and interim
status briefings with PAG staff. At no time prior to or during our
fieldwork within each office did Department staff indicate to us that
they had concerns with the audit methodology or selected
audits/recommendations. The Department's position that some actions were
considered minor and therefore would not require followup was not
mentioned until presentation of our findings at the exit conferences for
one PO and for the overall project.

OIG did not question the discretion of the Department in sustaining or
not sustaining the findings, or in determining the corrective actions
needed. However, without documentation regarding the Department's
determination that some corrective actions were considered minor, and
its intent not to follow up on those actions, we cannot conclude that
such a decision process took place prior to the presentation of our
findings from this audit. In each case where we cited ineffective
followup, the Department had requested corrective actions from the
auditee. In resolving the audits, the Department had the discretion to
concur with the finding but not require any corrective action due to
materiality, if that was its determination.

[Recommendations]{.underline}

We recommend the Chief Financial Officer:

1.  Develop and implement a process to periodically evaluate the
    appropriateness of the PO followup systems for external OIG audits.

2.  Develop and implement procedures to periodically report on the
    adequacy of AO systems for followup on external corrective actions,
    and the overall effectiveness of the Department's external audit
    followup system, based on the reviews of audit followup
    documentation and any other related factors currently tracked by the
    Department.

3.  Provide training to PO audit resolution staff on the requirements
    for audit followup and on the documentation that should be
    maintained to provide assurance that corrective actions are taken.

4.  Develop and implement guidance that defines the roles of PAG and the
    respective program offices in completing followup activity for
    external OIG discretionary grant audits resolved by PAG.

**[Department of Education Response:]{.underline}**

The Department generally concurred with each of the above
recommendations. With respect to recommendation 1.4, the Department
stated a process had already been implemented in response to an OIG
recommendation from a prior audit report.

**Finding No. 2 -- The Department Closed External OIG Audits Prior to
Completion of Corrective Actions**

Principal Office staff closed external OIG audits prior to completion of
corrective actions. We identified nine audits that were reported as
closed, but for which corrective action had not been completed at the
time of our review. We also identified 15 additional audits where the
corrective actions had been completed at the time of our review, but had
not been completed at the time the audits were closed. In total, we
found that 24 of the 46 audits reviewed (52 percent) were closed before
corrective actions were completed. As a result, PAG was no longer
tracking the status of the corrective actions, and the number of audits
for which corrective actions had not yet been completed was
underreported to Congress.

The results by PO were as follows:

+----------------------+----------------+------------------------------+
| **Principal Office** | **\# Audits    | **\# Closed Before           |
|                      | Reviewed**     | Corrective Actions           |
|                      |                | Completed**                  |
+----------------------+----------------+------------------------------+
| FSA                  | > 27           | > 13                         |
+----------------------+----------------+------------------------------+
| Discretionary        | > 9            | > 3                          |
| Grants[^5]           |                |                              |
+----------------------+----------------+------------------------------+
| OESE                 | > 4            | > 3                          |
+----------------------+----------------+------------------------------+
| OCFO                 | > 3            | > 2                          |
+----------------------+----------------+------------------------------+
| OSERS                | > 2            | > 2                          |
+----------------------+----------------+------------------------------+
| IES                  | > 1            | > 1                          |
+----------------------+----------------+------------------------------+
| **Total**            | > **46**       | > **24**                     |
+----------------------+----------------+------------------------------+

For the nine audits where corrective actions had not been completed at
the time of our review, we found PO staff:

-   Closed two of the audits although corrective actions were ongoing,

-   Were reevaluating the management decision for three audits, and

-   Closed four audits although the management decision was under
    appeal.

[Audit Followup Requirements]{.underline}

OMB Circular A-50, Section 8.a.(4), states that systems for resolution
and corrective action must, "\[M\]aintain accurate records of the status
of audit reports or recommendations through the entire process of
resolution and corrective action."

Section 5(a) of the Inspector General Act of 1978, as amended, states:

> Each Inspector General shall, not later than April 30 and October 31
> of each year, prepare semiannual reports summarizing the activities of
> the Office during the immediately preceding six-month periods ending
> March 31 and September 30. Such reports shall include. . .(3) an
> identification of each significant recommendation described in
> previous semiannual reports on which corrective action has not been
> completed. . ..

Since the Department is responsible for audit followup, information for
this section of the OIG's Semiannual Report is received from the
Department through its audit resolution and tracking system.

Section 5(b)(4) of the Act also requires the Department to provide to
Congress a semiannual report along with the Inspector General's report,
which includes:

> \[A\] statement with respect to audit reports on which management
> decisions have been made but final action has not been taken, other
> than audit reports on which a management decision was made within the
> preceding year. . .except that such statement may exclude such audit
> reports that are under formal administrative or judicial appeal or
> upon which management of an establishment has agreed to pursue a
> legislative solution, but shall identify the number of reports in each
> category so excluded.

We found that audits were closed before corrective actions were
completed in part because the Department did not previously track
external audits as resolved or closed. In CARS, the prior audit
resolution tracking system, one status code was entitled "Resolved
(Closed)." The CARS database provided another status code entitled, "All
corrective actions completed," but this status code was not used. In
addition, the database included separate fields for the audit resolution
document date (indicating an audit was resolved), and the closed date
(indicating all corrective actions were completed). However, the closed
field was not always used appropriately and was often the same as or
within a short time after the audit resolution document date. Used in
this manner, the closed date did not accurately reflect the date all
corrective actions were completed.

The Department's current system, AARTS, also includes the ability to
distinguish between these phases of the audit resolution and followup
process and accurately report status of the corrective actions. While
the recently issued AARTS User Manual for External Audits states that an
audit is considered "closed" when all required corrective actions have
been taken, prior Department guidance did not include any definition or
instruction for closing external OIG audits.

As discussed in Finding 1, staff from one PO did not followup on actions
requested in audit resolution documents, and assumed that the auditees
would take the requested actions. Some PO staff stated that they did not
have sufficient resources to followup on all requested corrective
actions. PAG stated that limited resources and an increasing workload
made it difficult to ensure that corrective actions were taken for
external audits. PAG also stated that in some cases prior practice was
to consider audits closed when the resolution documents were issued.

While OCFO's *Post Audit User Guide* includes specific direction
relating to closure for internal OIG audits, it does not contain similar
direction for external OIG audits. The *Post Audit User Guide* also
requires certification by AOs that all corrective actions were completed
prior to closure for internal OIG audits. However, it does not require a
similar certification for external OIG audits. As discussed in Finding
1, PAG reviews audit followup documentation for internal OIG and GAO
audits before the audits are considered closed. The same type of review
is not conducted for external audits.

As a result, audits that were reported as closed but for which
corrective actions were still in process may not have been appropriately
tracked and could not be monitored by OCFO. Department management may
not have been aware of the audits for which corrective actions were
still in process. In addition, audits that were listed as closed, but
for which all corrective actions had not been completed, were
underreported to Congress in the OIG Semiannual Report, Table 1,
"Recommendations Described in Previous Semiannual Reports on Which
Corrective Action Has Not Been Completed," and in the Department's
Semiannual Report to Congress on Audit Follow-up, Chapter Three,
"Reports Pending Final Action One Year or More After Issuance of a
Management Decision."

Of the nine audits we identified where corrective actions were not
completed at the time of our review, two were audits where corrective
actions were currently ongoing, four were currently under appeal, and
the Department was reevaluating the management decision for three
audits. Only four of these nine audits were correctly reflected in
statistical data in Department's semiannual reports. Two audits where a
corrective action was ongoing and three audits still on appeal were not
reflected in the Department's semiannual report. None of the nine audits
were correctly listed in OIG's semiannual report since the audits were
closed in the Department's audit resolution tracking system, OIG's
source for this information.

In a written response to our preliminary findings and recommendations
presented at the audit exit conference, PAG stated:

> It has been a long-standing practice, and one we support continuing,
> not to keep an external audit "open" that is on appeal or results in
> the establishment of a receivable. As discussed at the exit
> conference, PAG will work with POs, OGC \[Office of General Counsel\],
> and OIG to issue clearer guidance on audit follow-up, including
> precise definitions for the terms "resolved" and "closed."

While OMB Circular A-50 does provide a definition for resolution, we
could not identify a definition of audit closure in the Circular or in
the Department's guidance for external OIG audits. During our audit we
contacted PAG regarding the definition of audit closure, to which it
provided the following:

> An audit is considered closed when all findings/recommendations are
> closed. A finding or recommendation is closed when a PDL has been
> issued or, if there are instructions in the PDL to provide additional
> data or assurances, when the material has been received, analyzed and
> determined sufficient. Resolution specialists and AOs have the
> latitude to determine when material received in response to a request
> for additional information or information presented in the audit is
> sufficient to resolve and close a finding. Oftentimes, a decision to
> close a finding is reached after consultation from OGC and/or OIG.
> Because of the myriad of requirements unique to each program, there is
> no one-way to determine when a finding is closed. These decisions are
> reached on a finding by finding basis.

We recognize that issuing clearer guidance on audit follow-up, including
precise definitions for the terms "resolved" and "closed" could remove
some of the confusion that exists in this area. However, we do not
concur that an audit should be "closed" when corrective action is under
appeal. OMB Circular A-50 allows that audits under appeal may still be
considered resolved. The *Post Audit User Guide* does not specify how
audits under appeal should be reflected. When an audit is appealed, the
auditee does not concur with the management decision and corrective
actions requested. There is no certainty the requested corrective
actions will be upheld and ultimately completed by the auditee. As such,
the audit cannot accurately be considered closed.

With respect to audits for which a receivable has been established, but
collection has not been completed, OCFO policy does not address how to
reflect the status of these audits. As such, it is not clear whether
these audits should be considered closed, since the return or repayment
of funds is a corrective action not yet completed. OCFO indicated in its
response to the exit conference that it would develop clearer guidance
on audit followup and the definitions of "resolved" and "closed." The
status of audits currently under appeal and in collection status should
also be addressed in this revised guidance. As appropriate separate
categories for tracking the status of these audits in AARTS should be
established.

**[Recommendations]{.underline}**

We recommend that the Chief Financial Officer:

[]{.mark}

1.  Develop and implement a process requiring AO certification and PAG
    validation that adequate documentation was received to support
    completion of corrective actions prior to closing external OIG
    audits.

2.  Ensure the status of external OIG audits currently under appeal,
    awaiting re-evaluation, or in collection, is reflected as resolved,
    but not closed, in AARTS, to accurately reflect the status of the
    audit. Establish additional categories in AARTS as appropriate to
    allow for tracking these audits.

3.  Enhance the accuracy of AARTS data by identifying all external OIG
    audits that were closed since September 30, 2004, and coordinate
    with the program offices to identify those audits for which
    corrective actions have been completed, and those for which
    corrective actions are still in process. For those audits where
    corrective action has been completed, ensure an appropriate "closed"
    date is reflected in AARTS. For those audits where corrective
    actions are still in process, correct the data in AARTS to
    accurately reflect the status of the audits.

4.  Ensure the Department's *Semiannual Report to Congress on Audit
    Follow-up* accurately reports audits which have been resolved, but
    for which corrective actions have not been completed.

5.  Develop and implement guidance that defines audit closure for
    external audits. The guidance should be consistent with OMB policy
    and definitions identified in other documents such as AARTS User
    Manuals, and address audits on appeal and those for which the only
    remaining corrective action is collection of funds due the
    Department.

6.  Provide training to PO staff to ensure they are informed of the
    updated policy guidance and that audits should not be considered
    closed until all corrective actions have been completed.

Implementation of the recommendations made in Finding 1 will also
strengthen controls and the accuracy of reporting in this area.

**[Department of Education Response:]{.underline}**

The Department generally concurred with recommendations 2.2, 2.4, 2.5,
and 2.6. With respect to recommendation 2.1, the Department stated:

> As discussed during the exit conference; program offices, OGC and OCFO
> have very serious concerns with this recommendation and respectfully
> request that the OIG reconsider its position. Certification does work
> well for internal audits. However, the AO is certifying the completion
> of corrective actions taken [within]{.underline} the PO. The
> logistical and resource ramifications involved with having an AO
> certify the actions of an entity external to the Department of
> Education and subsequently with having PAG review the adequacy of
> follow-up documentation, is impractical in terms of cost, travel and
> staff hours it will demand. The PO should have discretion in how
> follow-up is accomplished based upon resources available. Implementing
> this recommendation would require a dedication of departmental staff
> and budgetary resources that far exceeds any marginal benefits to be
> realized. We believe that corrective actions taken on Recommendations
> 1.1, 1.2 and 1.3 above will adequately address weaknesses in the audit
> follow-up process. We request that the OIG meet with the program
> offices, OGC and OCFO to further discuss the concerns expressed in
> implementing this recommendation.

With respect to recommendation 2.3 the Department stated:

As discussed during the exit conference, program offices, OGC and OCFO
have concerns with this recommendation. The task of determining
OIG-issued external audits closed during the past year and a half and
reviewing the status of each corrective action would be extremely labor
intensive and would not add value to the process. We also do not believe
that the findings in the draft audit report warrant this degree of
scrutiny. The Department's audit workload has increased dramatically
over the past year; therefore, implementing this recommendation would
have an adverse impact on efforts to resolve and close external audits
that are currently in the follow-up process. During the exit conference,
we requested that the OIG reconsider this recommendation, and we were
given assurances that this would occur. We request that the OIG meet
with the program offices, OGC and OCFO to further discuss the concerns
expressed in implementing this recommendation.

**[Office of Inspector General Comments:]{.underline}**

With respect to recommendation 2.1, during our audit we identified
corrective actions sought by the Department through the resolution
document and obtained and evaluated the adequacy of supporting
information for each requested corrective action. We recognize the role
and responsibility of the Department in resolving and closing OIG
external audits. However, when corrective actions are defined the
Department has the responsibility to ensure they are taken.

OIG agrees the Department's discretion includes determining the means to
gain assurance that requested corrective actions were completed. The
method chosen to ensure that corrective actions were completed need not
be resource intensive. For example, the Department could require the
auditee to submit documentation rather than conducting on-site visits.
However, in accordance with OMB Circular A-50, the Department's *Post
Audit User Guide,* and the Department's *AARTS User Manual,* the method
chosen should provide evidence that the required corrective action has
been taken. During this review we noted instances where the applicable
method selected by the Department was not completed or did not provide
adequate information to show that corrective actions were completed.
This included instances where planned on-site monitoring was not
conducted, documentation to support completion of requested actions was
not obtained, and single audits did not provide assurance that the
independent auditor reviewed the action item for completion.

Based on the Department's comments regarding certifying actions taken by
external entities, we modified the recommendation to clarify that the
suggested certification and review process relate to the adequacy of
information obtained prior to closing the audit.

With respect to recommendation 2.3, the audit determined that the
Department closed recommendations prior to the completion of corrective
action in 24 of the 46 audits reviewed (52 percent). We found that this
caused data to be underreported to Congress in reports submitted by the
Department and the OIG. We believe it is imperative that data provided
to Congress is complete and accurate. We reconsidered this
recommendation in response to the Department's request at our exit
conference for this audit and reduced the time period subject to review
from external OIG audits closed over the past two years to those closed
since September 30, 2003, in the draft report. We have subsequently
modified this period to those audits closed since September 30, 2004, to
help ensure data included in the next reports to Congress is accurate.

OIG modified two of its recommendations based on the Department\'s
comments as detailed above and is willing to meet with the Department
during the audit resolution process to discuss any concerns that may
remain in these areas. 

**OBJECTIVES, SCOPE, AND METHODOLOGY**

The objective of our audit was to evaluate the effectiveness of the
Department's process to ensure that external auditees implement
corrective action. To accomplish our objective, we reviewed applicable
laws and regulations, and Department policies and procedures. We
conducted interviews with Department staff responsible for resolving and
following up on corrective actions for the audits selected. We also
reviewed documentation provided by Department staff to support the
corrective actions taken for the recommendations included in our review.

The universe for our audit included OIG audits of external entities
issued during the period October 1, 1997, through September 30, 2002. We
identified a total of 204 audits in this universe, as shown below by PO.

### **Table 1**

## **Audit Reports in Universe - By PO**

  ------------------------------------------ ------------- --------------
  **PO Title**                               **PO          **Number of
                                             Acronym**     Reports in the
                                                           Audit
                                                           Universe**

  Office of Federal Student Aid              FSA           103

  Office of Elementary and Secondary         OESE/OSDFS    30
  Education and Office of Safe and Drug Free               
  Schools                                                  

  Office of Special Education and            OSERS         25
  Rehabilitative Services                                  

  Office of the Chief Financial Officer      OCFO          18

  Office of Postsecondary Education          OPE           18

  Institute of Education Sciences            IES           5

  Office of Vocational and Adult Education   OVAE          3

  Office of the Chief Information Officer    OCIO          1

  Office of English Language Acquisition,    OELA          1
  Language Enhancement, and Academic                       
  Achievement for Limited English Proficient               
  Students                                                 

  **Total**                                                **204**
  ------------------------------------------ ------------- --------------

We refined our scope to include only those audits reported by the
Department's audit resolution system as "closed" on or before September
30, 2002. We also excluded certain categories of audits from our scope,
including those relating to Year 2000 compliance, alternative products,
and discontinued programs. We determined a total of 75 audits were
within the scope of our audit. The number of audits and recommendations
within our scope is shown below for each PO.

### **Table 2**

## **Audit Reports within Audit Scope - By PO**

  --------------------- --------------------- ---------------------------
  **PO**                **Number of Reports   **Number of Recommendations
                        Within Audit Scope**  Within Audit Scope**

  FSA                   38                    181

  OESE/OSDFS            12                    49

  OPE                   10                    51

  OSERS                 7                     38

  OCFO                  4                     17

  IES                   3                     19

  OELA                  1                     2

  **Total**             **75**                **357**
  --------------------- --------------------- ---------------------------

To select audits within our scope for review, we evaluated the status of
the recommendations and corrective actions required by the Department.
We excluded any internal or non-sustained recommendations in these
audits from our review. We judgmentally selected all 42 audits that
included monetary findings for this review. We also judgmentally
selected four additional audits from high-risk programs with no monetary
findings.

In total, we selected 46 audits and 239 related recommendations for
review. This represented 61 percent of the audits and 67 percent of the
recommendations within our scope. The number of selected audits and
recommendations for each PO is shown below. A complete listing of the
selected audits is included as Attachment 2 to this report.

### **Table 3**

## **Selected Reports and Recommendations - By PO**

  --------------------- ----------------------- --------------------------
  **PO**                **Number of Reports     **Total Number of
                        Selected**              Recommendations Selected**

  FSA                   27                      136

  OESE/OSDFS            4                       18

  OPE                   8                       46

  OSERS                 2                       15

  OCFO                  3                       13

  IES                   1                       9

  OELA                  1                       2

  **Total**             **46**                  **239**
  --------------------- ----------------------- --------------------------

We relied on computer-processed data initially obtained from OIG's Audit
Tracking System to identify OIG audits issued during the scope period.
We reconciled this data to the Department's CARS, and to audits reported
in the OIG semiannual reports to Congress to ensure that we had captured
all audits issued during the period. We also reviewed copies of the
audit reports to ensure the audits met the scope period under review. We
confirmed data in the audit reports to data in AARTS, which replaced
CARS in July 2003. Based on these tests and assessments, we determined
that the computer-processed data was reliable for meeting our audit
objective.

The focus of this audit was on assurance that corrective actions were
completed. We based our review on corrective actions requested in the
issued final audit resolution document. We reviewed and analyzed
documentation provided by the Department to determine if sufficient
assurance was obtained that auditees implemented requested corrective
actions. For monetary findings, we also evaluated documentation
supporting the return of funds to the Department.

We conducted fieldwork at Department offices in Washington, DC, during
the period September 2003 through June 2004. We held an exit conference
with PAG on July 1, 2004. Our audit was performed in accordance with
government auditing standards appropriate to the scope of the review
described above.

**STATEMENT ON INTERNAL CONTROLS**

We made a study and evaluation of the internal control structure
relating to the Department's audit followup process for external OIG
audits in effect from September 2003 through June 2004. This study and
evaluation was conducted in accordance with Government Auditing
Standards. For the purpose of this report, we assessed and classified
the significant internal control structure into the following
categories:

-   Documentation of Completed Corrective Actions

-   Effectiveness of Followup Systems

-   Timeliness of Resolution and Followup

Because of inherent limitations in any internal control structure,
errors or irregularities may occur and not be detected. Also, projection
of any evaluation of the system to future periods is subject to the risk
that procedures may become inadequate because of changes in conditions,
or that the degree of compliance with the procedures may deteriorate.

Our assessment disclosed internal control weaknesses that adversely
affected the Department's ability to ensure corrective actions were
taken by external entities in response to OIG external audits. These
weaknesses and their effects are fully discussed in the AUDIT RESULTS
section of this report. These weaknesses resulted in more than a
relatively low risk that errors, irregularities and other inefficiencies
may occur resulting in inefficient and/or ineffective performance.

###### 

###### Attachment 1: PO Reports Issued in Conjunction with This Audit

+-----+-----------+--------------------------------------+------------+
| *   | **Audit   | **Title**                            | **Final    |
| *Nu | Control   |                                      | Report     |
| mbe | Number**  |                                      | Date**     |
| r** |           |                                      |            |
+=====+===========+======================================+============+
| 1   | A19-E0003 | > Audit Followup Process -- External | > 9/23/04  |
|     | &         | > Audits -- OCFO (includes results   |            |
|     | A19-E0005 | > of audits resolved by Contracts    |            |
|     |           | > and Acquisitions Management within |            |
|     |           | > OCFO, and discretionary grants     |            |
|     |           | > resolved by PAG)                   |            |
+-----+-----------+--------------------------------------+------------+
| 2   | A19-E0002 | > Audit Followup Process -- External | > 9/16/04  |
|     |           | > Audits -- FSA                      |            |
+-----+-----------+--------------------------------------+------------+
| 3   | A19-E0004 | > Audit Followup Process -- External | > 8/27/04  |
|     |           | > Audits -- OESE/OSDFS               |            |
+-----+-----------+--------------------------------------+------------+
| 4   | A19-E0006 | > Audit Followup Process -- External | > 6/2/04   |
|     |           | > Audits -- OSERS                    |            |
+-----+-----------+--------------------------------------+------------+
| 5   | A19-E0007 | > Audit Followup Process -- External | > 4/1/04   |
|     |           | > Audits -- IES (Close-out letter -- |            |
|     |           | > one audit reviewed, no issues      |            |
|     |           | > noted.)                            |            |
+-----+-----------+--------------------------------------+------------+
| 6   | A19-E0010 | > Audit Followup Process -- External | > 3/16/04  |
|     |           | > Audits -- OELA (Close-out letter   |            |
|     |           | > issued since PAG is responsible    |            |
|     |           | > for resolution of discretionary    |            |
|     |           | > grant audits. Results included in  |            |
|     |           | > A19-E0003/A19-E0005 above.)        |            |
+-----+-----------+--------------------------------------+------------+
| 7   | A19-E0011 | > Audit Followup Process -- External | > 3/16/04  |
|     |           | > Audits -- OPE (Close-out letter    |            |
|     |           | > issued since PAG is responsible    |            |
|     |           | > for resolution of discretionary    |            |
|     |           | > grant audits. Results included in  |            |
|     |           | > A19-E0003/A19-E0005 above.)        |            |
+-----+-----------+--------------------------------------+------------+

###### 

###### Attachment 2: Audit Reports Reviewed in This Audit

+-----+--------+-----------------------------+--------+-------+-------+
| *   | *      | **Report Title**            | **     | *     | **N   |
| *Nu | *Audit |                             | Report | *PO** | umber |
| mbe | C      |                             | Issue  |       | of    |
| r** | ontrol |                             | Date** |       | Rec   |
|     | Nu     |                             |        |       | ommen |
|     | mber** |                             |        |       | -dati |
|     |        |                             |        |       | ons** |
+=====+========+=============================+========+=======+=======+
| 1   | A02    | > Audit of the Direct Loan  | 1      | FSA   | > 10  |
|     | -70001 | > Program Administered by   | 0/6/97 |       |       |
|     |        | > Dowling College           |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 2   | A09    | > Academy Pacific Business  | 12     | FSA   | > 2   |
|     | -80023 | > and Travel College        | /21/98 |       |       |
|     |        | > Eligibility to            |        |       |       |
|     |        | > Participate in Title IV   |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 3   | A05    | > Antonelli College's       | 2      | FSA   | > 5   |
|     | -80008 | > Administration of Student | /19/99 |       |       |
|     |        | > Financial Assistance      |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 4   | A05    | > East-West University's    | 5      | FSA   | > 9   |
|     | -90009 | > Administration of the     | /18/99 |       |       |
|     |        | > Student Financial         |        |       |       |
|     |        | > Assistance Programs       |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 5   | A09    | > Pacific Travel Trade      | 6      | FSA   | > 2   |
|     | -80029 | > School Eligibility to     | /11/99 |       |       |
|     |        | > Participate in Title IV   |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 6   | A05    | > City Colleges of          | 7      | FSA   | 8     |
|     | -80016 | > Chicago's Administration  | /23/99 |       |       |
|     |        | > of the Federal Pell Grant |        |       |       |
|     |        | > Program                   |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 7   | A06    | > Audit of Texas Careers'   | 8/6/99 | FSA   | 2     |
|     | -80011 | > Compliance With the 85    |        |       |       |
|     |        | > Percent Rule              |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 8   | A06    | > Audit of Collegiate       | 8/9/99 | FSA   | 1     |
|     | -80012 | > Systems, Inc., Compliance |        |       |       |
|     |        | > With the 85 Percent Rule  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 9   | A05    | > The Illinois Student      | 12     | FSA   | 3     |
|     | -90002 | > Assistance Commission's   | /29/99 |       |       |
|     |        | > Administration of the     |        |       |       |
|     |        | > Federal Family Education  |        |       |       |
|     |        | > Loan Program Federal and  |        |       |       |
|     |        | > Operating Funds           |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 10  | A06    | > Audit of Capital City     | 2      | FSA   | 2     |
|     | -80008 | > Trade and Technical       | /15/00 |       |       |
|     |        | > School, Inc., Compliance  |        |       |       |
|     |        | > with the 85 Percent Rule  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 11  | A09    | > Platt College - San       | 2      | FSA   | 10    |
|     | -90011 | > Francisco Administration  | /28/00 |       |       |
|     |        | > of Title IV Programs      |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 12  | A06    | > Hallmark Institute of     | 3/6/00 | FSA   | 2     |
|     | -80013 | > Aeronautics' Compliance   |        |       |       |
|     |        | > with the 85 Percent Rule  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 13  | A05    | > St Augustine College's    | 3/8/00 | FSA   | 2     |
|     | -90053 | > Administration of the     |        |       |       |
|     |        | > Federal Student Financial |        |       |       |
|     |        | > Assistance Programs for   |        |       |       |
|     |        | > the 1998-99 Award Year    |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 14  | A09    | > University of Phoenix's   | 3      | FSA   | 9     |
|     | -70022 | > Management of Student     | /31/00 |       |       |
|     |        | > Financial Assistance      |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 15  | A06    | > Review of Student         | 8/7/00 | FSA   | 3     |
|     | -90004 | > Financial Aid Compliance  |        |       |       |
|     |        | > at Success Institute of   |        |       |       |
|     |        | > Business                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 16  | A06    | > Review of Student         | 8/8/00 | FSA   | 4     |
|     | -90012 | > Financial Aid Compliance  |        |       |       |
|     |        | > at the International      |        |       |       |
|     |        | > Institute of Chinese      |        |       |       |
|     |        | > Medicine                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 17  | A05    | > Mount Senario College's   | 9      | FSA   | 11    |
|     | -90052 | > Administration of the     | /14/00 |       |       |
|     |        | > Title IV HEA Programs for |        |       |       |
|     |        | > the Period July 1, 1998,  |        |       |       |
|     |        | > through June 30, 1999     |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 18  | A05    | > Audit of the Title IV     | 9      | FSA   | 9     |
|     | -90054 | > Higher Education Act      | /28/00 |       |       |
|     |        | > Programs Administered by  |        |       |       |
|     |        | > Cleveland State           |        |       |       |
|     |        | > University Cleveland,     |        |       |       |
|     |        | > Ohio                      |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 19  | A05    | > Audit of Great Lakes      | 3      | FSA   | 4     |
|     | -A0002 | > Higher Education          | /30/01 |       |       |
|     |        | > Corporation's Federal     |        |       |       |
|     |        | > Family Education Loan     |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 20  | A05    | > The Illinois Student      | 3      | FSA   | 14    |
|     | -A0028 | > Assistance Commission's   | /30/01 |       |       |
|     |        | > Administration of the     |        |       |       |
|     |        | > Federal Family Education  |        |       |       |
|     |        | > Loan Program Federal and  |        |       |       |
|     |        | > Operating Funds           |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 21  | A05    | > Audit of the Michigan     | 9      | FSA   | 4     |
|     | -B0007 | > Guaranty Agency's         | /25/01 |       |       |
|     |        | > Administration of the     |        |       |       |
|     |        | > Federal Family Education  |        |       |       |
|     |        | > Loan Program Federal and  |        |       |       |
|     |        | > Operating Funds           |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 22  | A06    | > University of Arkansas at | 9      | FSA   | 1     |
|     | -B0013 | > Little Rock's Compliance  | /28/01 |       |       |
|     |        | > with the Title IV Student |        |       |       |
|     |        | > Financial Assistance      |        |       |       |
|     |        | > Verification Requirements |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 23  | A06    | > Southwest Texas State     | 9      | FSA   | 3     |
|     | -B0009 | > University Compliance     | /28/01 |       |       |
|     |        | > with the Title IV Student |        |       |       |
|     |        | > Financial Assistance      |        |       |       |
|     |        | > Verification Requirements |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 24  | A02    | > Audit of Drake College of | 3/5/02 | FSA   | 6     |
|     | -B0006 | > Business' Compliance with |        |       |       |
|     |        | > the Title IV Higher       |        |       |       |
|     |        | > Education Act Program     |        |       |       |
|     |        | > Requirements              |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 25  | A09    | > Audit of Glendale Career  | 3      | FSA   | 3     |
|     | -B0017 | > College\'s Administration | /18/02 |       |       |
|     |        | > of the Higher Education   |        |       |       |
|     |        | > Act Title IV Programs     |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 26  | A06    | > South Texas Vocational    | 3      | FSA   | 3     |
|     | -B0026 | > Technical Institute --    | /20/02 |       |       |
|     |        | > Brownsville's             |        |       |       |
|     |        | > Administration of the     |        |       |       |
|     |        | > Title IV Student          |        |       |       |
|     |        | > Financial Assistance      |        |       |       |
|     |        | > Programs                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 27  | A06    | > Livingstone College's     | 3      | FSA   | 4     |
|     | -B0011 | > Compliance with the Title | /29/02 |       |       |
|     |        | > IV Student Financial      |        |       |       |
|     |        | > Assistance Verification   |        |       |       |
|     |        | > Requirements              |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 28  | A05    | > Title VII Systemwide      | 1      | OELA  | 2     |
|     | -A0004 | > Improvement Grant         | 2/6/00 |       |       |
|     |        | > Administered by Community |        |       |       |
|     |        | > Unit School District 300, |        |       |       |
|     |        | > Carpentersville, Illinois |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 29  | A02    | > Recipient Financial       | 9      | OCFO  | 2     |
|     | -80002 | > Management System         | /22/00 |       |       |
|     |        | > Contract, Computer Data   |        |       |       |
|     |        | > Systems, Incorporated,    |        |       |       |
|     |        | > Rockville, Maryland       |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 30  | A07    | > Audit of Title IV Wide    | 5/6/99 | OCFO  | 6     |
|     | -80018 | > Area Network, Contract,   |        |       |       |
|     |        | > National Computer         |        |       |       |
|     |        | > Systems, Iowa City, IA    |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 31  | A07    | > Audit of the Central      | 3      | OCFO  | 5     |
|     | -90003 | > Processing System         | /15/00 |       |       |
|     |        | > Contract                  |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 32  | A09    | > WestEd's Administration   | 3      | OERI  | 9     |
|     | -60009 | > of the Regional Education | /31/98 |       |       |
|     |        | > Laboratory Contracts      |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 33  | A02    | > Audit of New York City    | 3      | OESE  | 2     |
|     | -A0001 | > Oversight of Title I      | /28/01 |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 34  | A05    | > The Chicago Public        | 3      | OESE  | 8     |
|     | -B0005 | > Schools' Administration   | /29/02 |       |       |
|     |        | > of Title I, Part A, Funds |        |       |       |
|     |        | > for Providing Services to |        |       |       |
|     |        | > Private School Children   |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 35  | A06    | > New Mexico State and      | 9      | OESE/ | 6     |
|     | -A0006 | > Local Education           | /28/00 |       |       |
|     |        | > Agencies\' Compliance     |        | OSDFS |       |
|     |        | > with the Gun-Free Schools |        |       |       |
|     |        | > Act of 1994               |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 36  | A03    | > Colorado State and Local  | 9      | OESE/ | 2     |
|     | -A0008 | > Educational Agencies'     | /13/00 |       |       |
|     |        | > Compliance with the       |        | OSDFS |       |
|     |        | > Gun-Free Schools Act of   |        |       |       |
|     |        | > 1994                      |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 37  | A03    | > Audit of Lincoln          | 7      | OPE   | 7     |
|     | -A0019 | > University's              | /27/01 |       |       |
|     |        | > Administration of the     |        |       |       |
|     |        | > Title III Grant           |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 38  | A04    | > Higher Education Act      | 9      | OPE   | 2     |
|     | -A0009 | > Title III, Part A, Higher | /29/00 |       |       |
|     |        | > Education Grant at Mars   |        |       |       |
|     |        | > Hill College              |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 39  | A05    | > Central State University  | 3      | OPE   | 2     |
|     | -80005 | > Student Support Services  | /16/98 |       |       |
|     |        | > Program                   |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 40  | A05    | > Audit of the Student      | 3      | OPE   | 10    |
|     | -90045 | > Support Services Project  | /27/00 |       |       |
|     |        | > Administered by Marian    |        |       |       |
|     |        | > College, Fond Du Lac,     |        |       |       |
|     |        | > Wisconsin                 |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 41  | A05    | > Audit of the Student      | 9      | OPE   | 9     |
|     | -A0003 | > Support Services Project  | /28/00 |       |       |
|     |        | > Administered by Mount     |        |       |       |
|     |        | > Senario College,          |        |       |       |
|     |        | > Ladysmith, Wisconsin      |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 42  | A05    | > Audit of Selected Aspects | 1      | OPE   | 4     |
|     | -A0022 | > of the Talent Search      | /22/01 |       |       |
|     |        | > Grant Administered by     |        |       |       |
|     |        | > South Suburban College,   |        |       |       |
|     |        | > South Holland, Illinois   |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 43  | A07    | > Audit of Creighton        | 3      | OPE   | 4     |
|     | -80027 | > University's              | /31/00 |       |       |
|     |        | > Administration of its     |        |       |       |
|     |        | > Federal TRIO Projects     |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 44  | A07    | > Audit of Independence     | 10     | OPE   | 8     |
|     | -A0006 | > Community College's       | /15/01 |       |       |
|     |        | > Administration of its     |        |       |       |
|     |        | > Federal TRIO Projects     |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 45  | A09    | > Arizona Department of     | 9      | OSERS | 7     |
|     | -A0001 | > Education Management      | /22/00 |       |       |
|     |        | > Controls Over IDEA, Part  |        |       |       |
|     |        | > B- Special Education      |        |       |       |
|     |        | > Performance Data          |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
| 46  | A09    | > California Department of  | 3      | OSERS | 8     |
|     | -A0016 | > Education Management      | /30/01 |       |       |
|     |        | > Controls Over IDEA, Part  |        |       |       |
|     |        | > B- Special Education      |        |       |       |
|     |        | > Performance Data          |        |       |       |
+-----+--------+-----------------------------+--------+-------+-------+
|     | ##     |                             |        |       | **    |
|     |  Total |                             |        |       | 239** |
+-----+--------+-----------------------------+--------+-------+-------+

###### 

###### Attachment 3: Department Response to Draft Audit Report

# 

# Memorandum

**To:** Michelle Weaver-Dugan, Director

Operations Internal Audit Team

Office of Inspector General

**From:** Jack Martin

**Subject:** OCFO Response to Draft Audit Report: Audit of the
Department of Education's Follow-up Process for External Audits

ACN: ED-OIG/A19-D0007

We appreciate the opportunity to respond to the referenced draft audit
report. Audit follow-up is an integral part of good management and is a
shared responsibility of agency management officials, program staff and
auditors. The Office of the Chief Financial Officer (OCFO) has long
recognized this fact, and as a result, has put in place policies,
procedures and systems for tracking, resolving and closing audit
findings, in compliance with Office of Management and Budget (OMB)
Circular A-50.

While we agree with the thrust of the overall findings and most of the
report's recommendations to improve the audit follow-up system, we
believe the report could be more balanced to reflect improvements in the
process. In this regard, the Department has made great strides over the
last few years to enhance the efficiency and effectiveness of the
Department's audit follow-up process. Significant efforts have been
taken to: (1) improve policies and procedures for audit follow-up, (2)
continually enhance the Audit Accountability and Resolution Tracking
System (AARTS) to effectively track the Department's follow-up and
resolution activities, (3) provide appropriate training to departmental
staff on AARTS, the single audit process, and the Federal Audit
Clearinghouse, (4) promote communications and consistency across the
Department regarding audit follow-up, and (5) issue improved guidance on
maintaining supporting documentation for corrective actions taken and on
the role of OCFO and the Principal Offices (POs) in following up on
discretionary grant audits. These actions and other enhancements we have
taken to improve the process provide a reasonable assurance that OIG
external audits are receiving appropriate attention and timely follow-up
actions. This assurance is also supported by the report's findings
showing a low percentage (11%) of audit recommendations with incomplete
corrective actions and finding significance. But, as with any process,
there is always room for improvement, and we are constantly looking for
additional ways to build upon the progress we have achieved to-date.

As discussed during the exit conference on this audit, we have concerns
with a couple of the report's recommendations. Specifically, we have
concerns with the recommendation that the Department develop and
implement a process, similar to that established for internal OIG
audits, requiring Action Official (AO) certification and the OCFO's Post
Audit Group's (PAG) review of the adequacy of audit follow-up
documentation prior to closing external OIG audits. This recommendation
is impractical in terms of the resources it will demand to document
corrective actions taken by entities prior to closing external OIG
audits. As the OIG does in its audit plans and in its choice of
activities to audit and investigate, priority and follow-up attention
given to corrective actions should be weighted and \"triaged\"
appropriately. Based on such factors as risk and the significance of the
underlying violation being corrected, resolution officials should have
discretion to decide which corrective actions to track by on-site
monitoring, which to monitor by other means, which to review in writing,
and which to leave to single auditors to review in subsequent years.
Some of the audit findings and corrective actions chosen by the OIG to
review were relatively minor, and some follow-up actions suggested by
the OIG would use more resources than the value of the corrective action
to be taken. Additionally, the recommendation requiring the Department
to identify all external OIG audits that have been closed since
September 30, 2003, and review the status of each corrective action
would be extremely resource intensive and detract from current
resolution efforts.

We appreciate the thoughtful review the OIG performed and the
professional approach followed by the auditors throughout the
engagement. Given our above concerns and more detailed comments below,
we believe the OIG should carefully reconsider the viability of the two
above-mentioned recommendations. We also believe that prior to issuing a
final report that a meeting be held among the OIG, affected program
offices, OGC and OCFO to discuss these issues and the impact of
recommendations in more detail.

The following are our specific comments in response to the report's
findings and recommendations.

**Finding #1 PAG Did Not Ensure the Department's Audit Follow-up System
for External OIG Audits was Effective**

1.  **Develop and implement a process to periodically evaluate the
    appropriateness of the PO follow-up systems for external OIG
    audits.**

**OCFO Response**

> Current practice in the Department is to give the POs discretion in
> the type of follow-up that is appropriate for individual programs.
> OCFO provides written formal guidance through the *Post Audit User
> Guide* and periodically provides updates to the policy and procedures
> on an interim basis until such time that the guide is formally
> updated. Since the guide was issued in 2003, we have issued guidance
> on maintaining supporting documentation for corrective actions taken
> and on the role of OCFO and the POs in following up on discretionary
> grant audits. Based upon the low percentage (11%) of audit
> recommendations with incomplete corrective actions, we believe that
> audit follow-up in OCFO and the POs is being performed well. We will,
> however, look for ways to strengthen the process through continued
> staff training and sample testing of PO follow-up.

1.  **Develop and implement procedures to periodically report on the
    adequacy of Action Official (AO) systems for follow-up on external
    corrective actions, and the overall effectiveness of the
    Department's external audit follow-up system, based on the reviews
    of audit follow-up documentation and any other related factors
    currently tracked by the Department.**

## **OCFO Response**

As is stated in 1.1 above, we will look for ways to strengthen the
process based on sample testing of PO follow-up.

2.  **Provide training to PO audit resolution staff on the requirements
    for audit follow-up and on the documentation that should be
    maintained to provide assurance that corrective actions are taken.**

**OCFO Response**

We concur with this recommendation and will train audit resolution staff
on the requirement for follow-up and documentation maintenance. We are
currently working with OM to establish an Audit Resolution Curriculum,
and will ensure that training on follow-up activities is included. In
March 2005, we began the process of updating the *Post Audit User
Guide*, and once the guide is updated, staff training on updates and
revisions will take place.

3.  **Develop and implement guidance that defines the responsibilities
    of PAG and the respective program offices in completing follow-up
    activity for external OIG discretionary grant audits resolved by
    PAG.**

**OCFO Response**

> This recommendation is a duplicate of a recommendation in the OIG
> Audit Report on the Audit Follow-up Process for OCFO (ACN:
> ED-OIG/A19-E0003). On November 10, 2004, PAG issued a notice via
> e-mail to all appropriate parties titled "Clarification of Audit
> Resolution Policy for Audits Resolved in PAG and CAM." The OIG
> concurred with this action on November 29, 2004. Therefore, this
> recommendation has been implemented.

# 

#  

# 

# 

# Finding #2 The Department Closed External OIG Audits Prior to Completion of Corrective Actions.

1.  **Develop and implement a process, similar to that established for
    Internal OIG audits, requiring AO certification and PAG review of
    the adequacy of audit follow-up documentation prior to closing
    external OIG audits.**

## 

## OCFO Response

> As discussed during the exit conference; program offices, OGC and OCFO
> have very serious concerns with this recommendation and respectfully
> request that the OIG reconsider its position. Certification does work
> well for internal audits. However, the AO is certifying the completion
> of corrective actions taken [within]{.underline} the PO. The
> logistical and resource ramifications involved with having an AO
> certify the actions of an entity external to the Department of
> Education and subsequently with having PAG review the adequacy of
> follow-up documentation, is impractical in terms of cost, travel and
> staff hours it will demand. The PO should have discretion in how
> follow-up is accomplished based upon resources available. Implementing
> this recommendation would require a dedication of departmental staff
> and budgetary resources that far exceeds any marginal benefits to be
> realized. We believe that corrective actions taken on Recommendations
> 1.1, 1.2 and 1.3 above will adequately address weaknesses in the audit
> follow-up process. We request that the OIG meet with the program
> offices, OGC and OCFO to further discuss the concerns expressed in
> implementing this recommendation.

1.  **Ensure the status of external OIG audits currently under appeal,
    awaiting reevaluation, or in collection, is reflected as resolved,
    but not closed, in AARTS, to accurately reflect the status of the
    audit. Establish additional categories in AARTS as appropriate to
    allow for tracking these audits.**

> **OCFO Response**

This recommendation, to establish in AARTS additional categories for
tracking the status of audits under appeal or in receivables, is one we
support. Our contract resources for this year have been finalized, but
we will discuss these enhancements with the AARTS team and include them
as future improvements to AARTS.

3.  **Enhance the accuracy of AARTS data by identifying all external OIG
    audits that were closed since September 30, 2003, and coordinate
    with the program offices to identify those audits for which
    corrective actions have been completed, and those for which
    corrective actions are still in process. For those audits where
    corrective action has been completed, ensure appropriate "closed"
    date is reflected in AARTS. For those audits where corrective
    actions are still in process, correct the data in AARTS to
    accurately reflect the status of the audits.**

> **OCFO Response**

As discussed during the exit conference, program offices, OGC and OCFO
have concerns with this recommendation. The task of determining
OIG-issued external audits closed during the past year and a half and
reviewing the status of each corrective action would be extremely labor
intensive and would not add value to the process. We also do not believe
that the findings in the draft audit report warrant this degree of
scrutiny. The Department's audit workload has increased dramatically
over the past year; therefore, implementing this recommendation would
have an adverse impact on efforts to resolve and close external audits
that are currently in the follow-up process. During the exit conference,
we requested that the OIG reconsider this recommendation, and we were
given assurances that this would occur. We request that the OIG meet
with the program offices, OGC and OCFO to further discuss the concerns
expressed in implementing this recommendation.

3.  **Ensure the Department's *Semiannual Report to Congress on Audit
    Follow-up* accurately reports audits which have been resolved, but
    for which corrective actions have not been completed.**

> **OCFO Response**
>
> Once Recommendation 2.2 above is implemented, data can be drawn from
> AARTS for use in preparing management's *Semiannual Report to Congress
> on Audit Follow-up* that will differentiate in the report, [OIG
> audits]{.underline} that are resolved, but for which corrective
> actions have not been completed.

4.  **Develop and implement guidance that defines audit closure for
    external audits.**

> **The guidance should be consistent with OMB policy and definitions
> identified in other documents such as AARTS User Manuals, and address
> audits on appeal and those for which the only remaining corrective
> action is collection of funds due the Department.**
>
> **OCFO Response**
>
> We will issue guidance that defines audit closure for external OIG
> audits. The guidance will be incorporated into the *Post Audit User
> Guide*. In March 2005, we began the process of updating the guide. We
> will ensure that the AARTS User Manuals are also revised.

5.  **Provide training to PO staff to ensure they are informed of the
    updated policy guidance and that audits should not be considered
    closed until all corrective actions have been completed.**

> **OCFO Response**
>
> We concur with this recommendation and will train audit resolution
> staff on the updated policy guidance, that audits not be considered
> closed until all corrective actions have been completed. We are
> currently working with OM to establish an Audit Resolution Curriculum,
> and will ensure that training regarding this matter is included in the
> course.

Thank you for the opportunity to respond to the draft audit report. We
look forward to meeting with you to discuss further Recommendations 2.1
and 2.3. Please contact Randy Prindle of the Post Audit Group at
202-377-3821 with dates and times convenient to you. We will continue to
work with you and other offices in the Department to improve upon the
audit follow-up process.

[^1]: Audit resolution documents include Final Audit Determination
    Letters (FAD) issued by Federal Student Aid and Program
    Determination Letters (PDL) issued by other Department Principal
    Offices.

[^2]: Our review included four OIG audits of programs that were
    originally part of OESE. Followup activities for two of the four
    audits became the responsibility of the Office of Safe and Drug-Free
    Schools (OSDFS).

[^3]: This office was previously part of the Office of Educational
    Research and Improvement (OERI).

[^4]: Audit Controls Over of the Audit Followup Process,
    ED-OIG/A19-B0002, issued October 2001.

[^5]: Includes eight OPE discretionary grant audits, and one OELA
    discretionary grant audit. These audits are resolved by PAG, rather
    than by program officials.