Pseudo Social Security Numbers

## FINAL INSPECTION REPORT

![](media/image1.wmf)

###  ED-OIG/I13-F0015

##### March 2006

![](media/image2.png)

Our mission is to promote the efficiency, U.S. Department of Education

effectiveness, and integrity of the Office of Inspector General

Department's programs and operations. Washington, D.C.

Statements that managerial practices need improvements, as well as other
conclusions and recommendations in this report represent the opinions of
the Office of Inspector General. Determinations of corrective action to
be taken will be made by the appropriate Department of Education
officials.

In accordance with the Freedom of Information Act (5 U.S.C. § 552),
reports issued by the Office of Inspector General are available, if
requested, to members of the press and general public to the extent
information contained therein is not subject to exemptions in the Act.

####### TABLE OF CONTENTS

# [EXECUTIVE SUMMARY 1](#executive-summary) {#executive-summary-1 .TOC-1}

# [BACKGROUND 3](#background) {#background-3 .TOC-1}

[Flow of student loan applications, disbursement, and loan data through
FSA
3](#flow-of-student-loan-applications-disbursement-and-loan-data-through-fsa)

[Background on PSSNs 3](#background-on-pssns)

# [INSPECTION RESULTS 5](#inspection-results) {#inspection-results-5 .TOC-1}

[Objective 1: Determine whether FSA has established adequate internal
controls for PSSNs and whether those controls are being followed.
5](#objective-1-determine-whether-fsa-has-established-adequate-internal-controls-for-pssns-and-whether-those-controls-are-being-followed.)

[CPS/SSA Match and CPS Data Entry Edits adequately verify student and
parent SSNs.
5](#cpsssa-match-and-cps-data-entry-edits-adequately-verify-student-and-parent-ssns.)

[COD system edits for SSNs do not reject PSSNs on Direct PLUS Loans.
6](#cod-system-edits-for-ssns-do-not-reject-pssns-on-direct-plus-loans.)

[Direct Loan Servicing Quarterly Invalid SSN Report mitigates the lack
of controls in COD.
6](#direct-loan-servicing-quarterly-invalid-ssn-report-mitigates-the-lack-of-controls-in-cod.)

[NSLDS instructions for assigning PSSNs do not provide adequate guidance
and are not implemented as designed.
7](#nslds-instructions-for-assigning-pssns-do-not-provide-adequate-guidance-and-are-not-implemented-as-designed.)

[Collections Division Virtual Library section on SSN Error does not
provide consistent procedures.
8](#collections-division-virtual-library-section-on-ssn-error-does-not-provide-consistent-procedures.)

[NSLDS system edit and rule do not automatically identify SSNs starting
with a nine as pseudo numbers.
9](#nslds-system-edit-and-rule-do-not-automatically-identify-ssns-starting-with-a-nine-as-pseudo-numbers.)

[Conclusion 9](#conclusion)

[Recommendations 9](#recommendations)

[**Objective 2: Determine if there are data accuracy problems associated
with the use of PSSNs in NSLDS.
10**](#objective-2-determine-if-there-are-data-accuracy-problems-associated-with-the-use-of-pssns-in-nslds.)

[GAs failed to store SSN histories.
10](#gas-failed-to-store-ssn-histories.)

[GAs failed to correct borrowers' PSSN accounts.
10](#gas-failed-to-correct-borrowers-pssn-accounts.)

[Conclusion 11](#conclusion-1)

[Recommendations 11](#recommendations-1)

# [OBJECTIVES, SCOPE, & METHODOLOGY 12](#objectives-scope-methodology) {#objectives-scope-methodology-12 .TOC-1}

# [APPENDIX 14](#appendix) {#appendix-14 .TOC-1}

#  {#section .TOC-1 .unnumbered}

####### EXECUTIVE SUMMARY

This report provides the results of our evaluation of the use of Pseudo
Social Security Numbers (PSSNs) in the Title IV, Higher Education Act of
1965, as amended (HEA) programs.[^1] A PSSN is used as a student
identifier by FSA when there is a Social Security Number (SSN) conflict
between two borrowers. This occurs when an individual with a valid SSN
is entered into the system and the SSN is in use by another individual.
When this happens, a PSSN is created and the loans for the borrower who
is already on the system are moved to a PSSN account. Our inspection
objectives were (1) to determine whether FSA has established adequate
internal controls for PSSNs and whether those controls are being
followed, and (2) to determine if there are data accuracy problems
associated with the use of PSSNs in the National Student Loan Data
System (NSLDS). Our inspection identified weaknesses in the internal
controls for PSSNs and that the controls in place were not always
followed. We also identified data accuracy problems with the use of
PSSNs in NSLDS.

We evaluated FSA's PSSN control activities for PSSNs with loan
disbursements in the Central Processing System (CPS), the Common
Origination and Disbursements System (COD), Direct Loan Servicing,
Collections Division, and the National Student Loan Data System (NSLDS).
According to the Government Accountability Office's (GAO's) *Internal
Control Management and Evaluation Tool* (GAO Evaluation Tool), internal
control activities require management to ensure "\[a\]ppropriate
policies, procedures, techniques, and mechanisms exist with respect to
each of the agency's activities."

We identified the following with regard to FSA's control activities for
PSSNs:

-   COD does not have adequate control activities to address PSSN issues
    for the William D. Ford Federal Direct Loan (Direct Loan) Program.
    The COD system edits do not identify or reject PSSNs for all Direct
    PLUS Loan transactions. This weakness is mitigated by control
    activities in Direct Loan Servicing.

-   The NSLDS instructions to data providers on assigning PSSNs do not
    provide adequate guidance for the creation and use of PSSNs, and the
    number assignment format is not consistently followed.

-   The Collections Division polices and procedures on PSSNs are
    inadequate because they do not provide consistent procedures for the
    treatment and use of PSSNs.

-   The NSLDS system rule, requiring data providers to identify an SSN
    starting with nine as a pseudo number, is not consistently followed.

We determined that the following caused inaccurate data in NSLDS:

-   Data providers did not always follow the NSLDS instructions.

```{=html}
<!-- -->
```
-   The instructions lack explicit guidance for nullifying PSSN accounts
    and do not provide Guaranty Agencies (GAs) with instructions for
    moving borrowers from pseudo accounts to valid accounts when the
    borrower's valid SSN has been established.

We recommend that FSA ensure the following:

-   Data providers provide consistent and accurate data and that their
    policies include instructions for creating, using, and retiring
    PSSNs.

-   Parent SSNs on PLUS loans are validated.

-   Data providers follow the NSLDS instructions and other guidance to
    appropriately create, use, and retire PSSNs.

-   Additional accounts are linked to the borrower's valid account and
    FSA should periodically identify any additional PSSN or SSN
    accounts.

The Department responded to our draft report on March 1, 2006. The
Department generally concurred with our inspection results and
recommendations.

**\
**

####### BACKGROUND

# Flow of student loan applications, disbursement, and loan data through FSA

Financial aid applications and loan data run through a variety of FSA
systems that evaluate student eligibility, account for disbursed funds,
and store the Title IV, HEA recipient data.

The CPS processes the Free Application for Federal Student Aid (FAFSA)
to evaluate student eligibility, calculate the Expected Family
Contribution (EFC), and conduct quality control and eligibility checks
on application data. After the CPS processes the FAFSA, the data is sent
to schools for a final Title IV, HEA recipient eligibility
determination. Schools participating in the Direct Loan Program use COD
to report origination, receipt of a valid promissory note, and
disbursements to FSA.

Once Direct Loan transactions are processed in COD, the data is sent to
Direct Loan Servicing to begin servicing the loan. Direct Loan Servicing
maintains the data on Direct Loans and reports the loan information to
NSLDS. NSLDS is a data repository of information about the history of
Title IV, HEA loans and Pell Grants. NSLDS stores information about
students, borrowers, loans, grants, lenders, GAs, schools, and
servicers.

When a Direct Loan borrower defaults on a loan, Direct Loan Servicing
transfers the loan to the Collections Division in Borrower Services to
get the borrower out of default status. Federal Family Education Loan
Program (FFELP) Loans are also assigned to the Collections Division by
GAs.

# Background on PSSNs

Section 484(a)(4) of the HEA requires a student to report "as part of
the original financial aid application process, a . . . student's social
security number" to be eligible for Title IV funds. Section 484(p)
states, "The Secretary of Education, in cooperation with the
Commissioner of the Social Security Administration, shall verify any
social security number provided by a student to an eligible institution
. . . ." Additionally, Section 428B(f) states, "A parent who wishes to
borrow funds under this section shall be subject to verification of the
parent's . . . social security number in the same manner as social
security numbers are verified for students under section 484(p)."

The FAFSA requires that applicants report their SSNs to be eligible to
receive aid. The CPS verifies a student's SSN and other personal
identifiers through a data match with Social Security Administration
(SSA) records. FSA then uses the SSN as a student identifier.

A PSSN resembles a valid SSN, but starts with the number nine and falls
outside the range of SSNs assigned by SSA. SSA has never issued an SSN
starting with the number nine. Though the CPS/SSA Match identifies
invalid SSNs, FSA and data providers use PSSNs in cases where the
personal identifiers for a new borrower conflict with the personal
identifiers of a borrower already on the system. SSN conflicts between
borrowers arise in cases such as identity theft and data entry errors.

According to FSA, when the owner of a valid SSN, usually a new borrower,
applies for Title IV, HEA aid, his or her loan information may conflict
with a previous borrower whose loan information is captured under the
same SSN. Therefore, the new borrower's loans cannot be entered into the
system under his or her valid account number. The data provider will
reconcile the personal identifiers of the two borrowers and determine
which borrower owns the valid SSN and whether the other borrower has a
different valid SSN or will need a PSSN.

The data provider will enter the new borrower's loans under his or her
valid SSN and move the other borrower's loan information to a different
account number. If the data provider can establish the other borrower's
valid SSN, then it will move his or her loan information to that account
number. If the data provider cannot establish the borrower's valid SSN,
then it will generate a PSSN and move all loan information to this newly
created account. The Directors of both NSLDS and Direct Loan Servicing
informed us that borrowers on PSSN accounts should not receive new loans
or disbursements until their valid SSNs are established.

On July 15, 2005, NSLDS identified 176,348 PSSNs on its system. While
the largest number of PSSNs in the system have been created through
NSLDS, data providers such as schools, the Collections Division, Direct
Loan Servicing, and GAs also assign and move loan records to PSSN
accounts.

From 2000 through 2004, 56,581 PSSNs were created through NSLDS and data
providers created 21,412 PSSNs. We analyzed the 21,412 accounts created
by data providers and found that 12,855 loans were disbursed to 8,807
different PSSN accounts. Of the accounts created by data providers, 41
percent (8,807 PSSNs) had loan disbursements associated with the
accounts. As the loan status analysis shows below, 35 percent of the
12,855 loans or 21 percent of all accounts with PSSNs created by data
providers from 2000 to 2004 (21,412 PSSN accounts) were in default.

  ------------- ----------- ------------- ----------- ----------- -----------
  Loan Status   School      Collections   GAs         "Others"    Total
                            Division                              

  Abandoned,    33          14            224         33          304
  Bankrupt                                                        

  Canceled      45          32            636         272         985

  Defaulted     1,402       817           1,070       1,236       4,525

  Deferred,     6           0             289         5           300
  Forbearance                                                     

  Paid in Full  1,817       104           1,620       1,643       5,184

  In Grace, In  156         5             1,204       149         1,514
  Repayment                                                       

  Other         2           0             40          1           43

  Total         3,461       972           5,083       3,339       12,855
  ------------- ----------- ------------- ----------- ----------- -----------

####### INSPECTION RESULTS

######## [Objective 1: Determine whether FSA has established adequate internal controls for PSSNs and whether those controls are being followed.]{.underline} 

We determined that the CPS/SSA Match and CPS Data Entry Edits are
adequate control activities for student and parent SSNs at the point of
application. Although COD does not have adequate control activities for
identifying and resolving PSSN issues related to Direct Loans, we found
that the Direct Loan Servicing Quarterly Invalid SSN Report, as
implemented, mitigates the risks associated with PSSNs from the lack of
control activities over PSSNs in COD. We also found that the control
activities for NSLDS and the Collections Division are not adequate
because they are inconsistent and lack specific guidance.

All Federal agencies are required to comply with the GAO's *Standards
for Internal Control in the Federal Government* (GAO Standards).[^2] To
assist agencies with compliance, the GAO Evaluation Tool was developed.
The Department has implemented these requirements through the
Departmental Directive OCFO: 1-101 *Federal Managers' Financial
Integrity Act Management/Reporting on Internal Controls* (OCFO:
1-101).[^3] The requirements in OCFO: 1-101 apply to all of the
Department's Principal Offices' programs and administrative activities.

We evaluated FSA's PSSN control activities for five systems that hold
student loan information using the control activities standard in the
Department Directive OCFO: 1-101 and in the GAO Evaluation Tool. The GAO
Evaluation Tool states, "Internal control activities are the policies,
procedures, techniques, and mechanisms that help ensure that
management's directives to mitigate risks identified during the risk
assessment process are carried out." The application control for control
activities "covers the structure, policies, and procedures designed to
help ensure completeness, accuracy, authorization, and validity of all
transactions during application processing." Control activities also
require management to ensure, "\[a\]ppropriate policies, procedures,
techniques, and mechanisms exist with respect to each of the agency's
activities."

# CPS/SSA Match and CPS Data Entry Edits adequately verify student and parent SSNs.

The primary CPS control activities for PSSNs are the CPS/SSA Match and
the CPS Data Entry Edits. The student CPS/SSA Match verifies the
validity of the applicant's SSN, name, and date of birth. It also
identifies ineligible SSNs such as those assigned to dead persons,
individuals with different names and dates of birth, and SSNs that are
outside the range of SSNs assigned by SSA. Our August 2003 Management
Information Report, *PLUS Could Be Disbursed to Ineligible Non-Citizens*
(ED-OIG/E06D0008), found that the Department had not established the
same verification procedures for parent identifying information that the
Department had for student applicants. Since the Department did not
verify the identifying information for PLUS loan applicants the
potential existed that FFELP PLUS loans were disbursed to ineligible
borrowers. We acknowledged that the process to verify
student-identifying information could not be performed on FFELP PLUS
loan applicants. The CPS has since included parents in the CPS/SSA Match
for the 2004-2005 FAFSA processing cycle.

The CPS/SSA Match compares the student applicant and parent SSNs listed
on the FAFSA to the SSA database of assigned SSNs. The CPS will reject a
student SSN and flag a parent SSN with a comment code when either SSN is
inaccurate or incomplete. Likewise, the CPS Data Entry Edits reject
invalid SSN values and ensure that personal identifiers on the
application are complete and within SSA parameters before the CPS
calculates an EFC.

Based on our inspection we concluded that the control activities for
PSSNs through the CPS/SSA Match and CPS Data Entry Edits are adequate.
They are correctly implemented to reasonably mitigate the risks
associated with PSSNs of students and parents in the application
process. The CPS/SSA Match adequately identifies PSSNs. The system edits
reject any student SSNs and flag any parent SSNs the match identifies as
invalid. As a result, the edits prevent the student's EFC from being
calculated for applications with PSSNs.

# COD system edits for SSNs do not reject PSSNs on Direct PLUS Loans.

COD is used to establish Direct Loans and account for Direct Loan
disbursements. We identified two COD system edits related to PSSNs. The
first system edit will reject any loan application with a PSSN that has
a nine in all fields (999-99-9999). The second system edit will check
the SSN on all Direct Loans, except Direct PLUS Loans, against the
CPS/SSA Match results and will reject the transaction if there is no
match. Direct PLUS Loans are available to parents of dependent children.
Though CPS conducts a CPS/SSA Match for parent SSNs in the Title IV, HEA
application process, COD does not verify parent SSNs on Direct PLUS Loan
applications against the CPS data. Similarly, there is no process for
lenders in FFELP to confirm the SSN of parent PLUS borrowers.

We determined that the control activities for PSSNs in COD were not
adequate because the COD System Edits do not identify or reject PSSNs
for all loan transactions. Direct PLUS Loan disbursements are made to
borrowers using PSSNs without confirming whether the borrower has a
valid SSN. The same problem that exists for Direct PLUS Loans in COD may
be present in FFELP.

# Direct Loan Servicing Quarterly Invalid SSN Report mitigates the lack of controls in COD.

Once loan transactions are processed in COD, the data is sent to Direct
Loan Servicing. Direct Loan Servicing maintains the data on Direct Loans
and reports the loan information to NSLDS. Data on Direct PLUS Loan
borrowers with disbursements using PSSNs is sent to Direct Loan
Servicing without identifying a valid SSN.

Our FY 2001 and FY 2002 *Financial Statement Audits* and *Management
Letters* (ED-OIG/A17D0005 and ED-OIG/A17D0006) issued on April 3, 2003,
identified 108 Direct Loan borrowers with invalid SSNs.[^4] We
determined that the Direct Loan Program did not have procedures in place
for verifying SSNs. We recommended that FSA research and resolve all
invalid SSNs in the Direct Loan Servicing System and other systems as
appropriate. FSA has since implemented the Direct Loan Servicing
Quarterly Reports, *Loans with Apparent Invalid SSNs Beginning with
\"7\"* and *Report on Apparent Invalid SSNs with High Numbers*
(Quarterly Invalid SSN Report).

The Quarterly Invalid SSN Report identifies loan accounts with invalid
SSNs by separating out numbers outside the range of valid SSNs issued by
SSA. Once the accounts with invalid SSNs are identified, Direct Loan
Servicing follows up with data providers to research and establish the
borrowers' valid SSNs. During our audit of the FY 2005 financial
statements we identified 73 invalid SSNs in the Direct Loan Servicing
System. Nineteen percent of the invalid SSNs were PLUS loans, which
passed from COD to the Direct Loan Servicing System without confirming a
valid SSN for the borrower.

When Direct Loan Servicing reviewed the June 30, 2005, Quarterly Invalid
SSN Report, which contained twelve PSSNs, the reviewer identified six
students from the same school with loan accounts starting with a nine.
Direct Loan staff contacted the school, determined that the school had
mistakenly entered the internal student identifier number in the SSN
field, and corrected the PSSNs. One PSSN, in addition to the twelve
identified in the June 30, 2005, Quarterly Invalid SSN Report, was
corrected by Direct Loan Servicing during the following quarter.

We determined that the Quarterly Invalid SSN Report and follow-up with
data providers provides an adequate monitoring control over PSSNs in
Direct Loan Servicing. This monitoring control assists in mitigating the
lack of PSSN control activities in COD; however, by the time this
control is initiated the Direct Loan funds have already been disbursed.
The current control activities do not prevent Direct PLUS borrowers with
PSSNs from receiving Title IV, HEA aid. Although we did not confirm
actual disbursements to parent borrowers without valid SSNs in FFELP,
nothing came to our attention to indicate that parent borrowers are not
receiving disbursements based on PSSNs in FFELP.

# NSLDS instructions for assigning PSSNs do not provide adequate guidance and are not implemented as designed. 

*NSLDS Appendix A-5: Assigning Pseudo Numbers* (NSLDS Appendix A-5),
created by NSLDS staff for internal use, is a compilation of the
instructions each data provider must follow when creating a PSSN. The
instructions included in NSLDS Appendix A-5 are found in the different
versions of the NSLDS Data Provider Instructions. The *National Student
Loan Data System, U.S. Department of Education, Guaranty Agency Data
Provider Instructions* (NSLDS GA DPI) (Version 4.1, June 1, 2005)
includes the PSSN number creation instructions for GAs. These PSSN
assignment instructions, issued in March 2001, are similar to the
instructions included in NSLDS Appendix A-5. The NSLDS GA DPI explains
that in cases of data conflict "\[w\]here a real SSN is not on file, a
pseudo SSN must be generated for the record" and the data provider must
follow the specific rules for PSSN assignment.

The NSLDS instructions for assigning PSSNs provide guidance for creating
pseudo numbers. They provide formatting or assignment codes for data
providers to use in generating pseudo numbers based on the entity's FSA
identifier code. The NSLDS instructions for assigning PSSNs do not
provide information detailing the type of situations that would require
a PSSN to be created, the steps that should be taken to monitor or
correct the inaccurate data, and do not require the merging of duplicate
loans or accounts into the NSLDS SSN history. The instructions also do
not detail when use of a PSSN would not be appropriate.

Data providers[^5] have not complied with the NSLDS instructions for
assigning PSSNs. From March 2001 through December 2004, data providers
created 16,345 PSSNs with 3,080 PSSNs or 19 percent not assigned
following the FSA's instructions for assigning PSSNs. We identified
these 3,080 PSSNs because the pseudo numbers assignment code did not
correspond with the entity's identifier code. Of the PSSNs not assigned
following FSA's instructions, 60 percent were assigned by FSA. The NSLDS
Director informed us that FSA does not enforce the NSLDS instructions
for assigning PSSNs.

The NSLDS GA DPI is not an adequate control activity because it does not
include instructions detailing the type of situations where a PSSN
should or should not be created, the steps that should be taken to
monitor or correct the inaccurate data, and does not require the merging
of duplicate loans or accounts into the PSSN history. Even if FSA
enforces the instructions on PSSN assignment, the NSLDS GA DPI will
still be inadequate, because it does not instruct data providers how to
create, use, and retire PSSNs. NSLDS Appendix A-5, which is based on the
NSLDS GA DPI, has similar inadequacies.

# Collections Division Virtual Library section on SSN Error does not provide consistent procedures.

When a Direct Loan borrower defaults on a loan, Direct Loan Servicing
transfers the loan to the Collections Division in Borrower Services to
get the borrower into repayment. FFELP Loans are also assigned to the
Collections Division by GAs.

The Director of Debt Collections indicated that the Collections Division
has unwritten, but understood, policies for SSN changes. When we asked
the regional office Directors, however, if they had policies and
procedures regarding SSNs, each regional office Director informed us
that their office uses their Virtual Library section on "Social Security
Number Error."

The Virtual Library is a data information source available to
collections loan analysts through the Department's intranet. The Virtual
Library provides instructions to follow when the Collections Division
receives a claim from an individual stating that he or she did not
receive the loans that have defaulted, but the Collections Division has
a valid SSN for those loans. These policies and procedures do not
provide guidance on the acceptable reasons for creating a PSSN, how to
assign PSSNs, or the specific steps for the creation of PSSNs. We also
found that all three regional offices assign PSSNs differently and in a
way that does not follow the number assignment procedure described by
the Director of Debt Collections or the NSLDS instructions for assigning
PSSNs. From this, we concluded that headquarters is unaware of the
policies the regions are following and the procedures those offices have
adopted to create and use PSSNs.

We determined that the Collections Division has not implemented adequate
control activities for PSSNs because it lacks policies and procedures
regarding PSSNs. The lack of guidance has resulted in inconsistencies in
the treatment and use of PSSNs in the regional offices.

# NSLDS system edit and rule do not automatically identify SSNs starting with a nine as pseudo numbers.

The NSLDS system edit specifications for data providers describe a
system edit and a system rule. The system edit will only prevent a data
provider from loading loans that conflict with existing SSN accounts and
borrowers. There are no SSN matches with CPS data or with SSA, nor is
there an SSN valid range edit. Therefore, NSLDS will accept an SSN as
long as the number does not conflict with an SSN already in the system.

The system rule requires the data provider to identify a pseudo number
loaded onto the system as a PSSN rather than a real SSN. FSA NSLDS staff
explained that unless the data provider indicates this during the
loading process, NSLDS will not identify SSNs beginning with a nine as
PSSNs and will instead identify them as real SSNs. The NSLDS GA DPI
instructs data providers to indicate "whether the Student's Social
Security Number is a pseudo SSN or a real number" by entering a "P" or
an "R" in the SSN indicator field. During our analysis of the 77,993
PSSNs created from 2000 through 2004, we found that 23 percent of these
numbers are categorized as real numbers instead of pseudo numbers. Of
the PSSNs created by FSA, 25 percent were incorrectly categorized as
real SSNs.

We determined that the NSLDS GA DPI instructions for identifying SSNs
starting with a nine as PSSNs by entering a "P" are not followed. While
FSA currently has the ability to identify all PSSNs by separating out
the SSNs that start with a nine, at some future date SSA may begin
assigning SSNs that start with a nine. Should they do so, this coupled
with the lack of data provider compliance would pose a risk to the data
integrity of NSLDS.

# Conclusion

We determined that the control activities for PSSNs are inadequate
because they are inconsistent and lack specific guidance.

## Recommendations

We recommend that the Chief Operating Officer for FSA --

1.  Ensure that all data providers have effective and consistent
    instructions for creating, using, and retiring PSSNs.

```{=html}
<!-- -->
```
1.  Revise and strengthen the NSLDS code to automatically identify PSSNs
    as pseudo numbers in the SSN indicator field. FSA should be prepared
    to modify the system should SSA begin issuing SSNs in the 900
    series.

2.  Implement a process to ensure that Direct and FFELP PLUS loan
    borrowers have valid SSNs.

The Department responded to our draft report on March 1, 2006. The
Department generally concurred with our inspection results and
recommendations.

#  

# [Objective 2: Determine if there are data accuracy problems associated with the use of PSSNs in NSLDS.]{.underline} 

In answering this objective we used the same criteria, the control
activities standard of internal control, as used in the first objective.
During our inspection we found two problems related to PSSNs that led to
inaccurate loan histories in NSLDS. The first is that GAs do not always
store invalid SSNs in the SSN history when they move borrowers to a
PSSN. The second is that GAs do not always correct borrower PSSN
accounts even after they obtain a valid borrower SSN. According to the
NSLDS GA DPI, failure to update and store student identifiers "can
create duplicate loan records that compromise the data integrity of
NSLDS . . . ." Furthermore, the borrower's Title IV, HEA history could
be lost and the borrower could obtain additional funds under an invalid
SSN.

# GAs failed to store SSN histories.

The NSLDS GA DPI assists data providers with the update process and
report creation. It also provides instructions about how to make changes
and load new data on the system. The NSLDS GA DPI section on student
identifier changes explains that when an SSN is changed or updated the
old SSN should be stored in the history: "When NSLDS updates a field for
which history is kept, the updated value becomes the current value and
the old current value becomes the historical value."

According to NSLDS staff, when they create a PSSN in NSLDS they conduct
a name search to identify duplicate records and SSNs for the borrower.
They then merge these into the SSN history of the PSSN account. NSLDS
staff explained that the NSLDS GA DPI instructs GAs to store an SSN
history if changes are made to this identifier. During our analysis of
the internal policies regarding PSSNs for four GAs, we found that only
one GA instructed employees to conduct a name search to ensure that all
borrower accounts on the system were moved to the correct SSN. The other
three GA internal policies did not include such instructions.

During our inspection, we took a random sample of 40 PSSNs created by
selected GAs. Our analysis of this sample showed that for 28 percent of
the PSSNs, the GA did not store the SSN history in NSLDS when the loans
were moved to a PSSN. Loans are moved to a PSSN when a new borrower's
SSN conflicts with the SSN of a borrower already on the system. Once the
new borrower provides proof that he or she owns the SSN, the GA will
move the borrower who is already on the system to a PSSN, if his or her
valid SSN cannot be established. In each case, the GA moved the borrower
from an incorrect SSN to a PSSN, but did not follow the NSLDS GA DPI to
store the borrower's incorrect SSN in the SSN history. Our analysis of
the PSSNs without SSN histories (the 28 percent discussed above) showed
that 27 percent of these borrowers still had unlinked SSN accounts in
NSLDS. We concluded that the data providers are not consistently
following the NSLDS GA DPI instructions for storing SSN histories when
they change or update SSNs in NSLDS.

# GAs failed to correct borrowers' PSSN accounts.

The NSLDS GA DPI states, "A pseudo SSN may not be used in place of a
real one if the Data Provider has the valid SSN." Although the NSLDS GA
DPI does not specifically state that a PSSN should be updated when a
valid SSN is obtained, NSLDS staff explained that this requirement is
implied in the NSLDS GA DPI. NSLDS staff also explained that when a data
provider moves records from a PSSN to a valid SSN, the data provider
should nullify[^6] the PSSN account and store the PSSN in the SSN
history.

Our analysis of the PSSN sample created by selected GAs showed that for
3 of the 40 PSSN accounts analyzed,[^7] the GA did not move the borrower
to the valid SSN once the valid number had been established.[^8] There
were also two cases where the data provider failed to nullify the PSSN
account. Only one of the four GAs had internal policies specifying that
a PSSN should be reversed when proof of a correct SSN is submitted.

# Conclusion

We determined that data providers did not always follow the NSLDS GA
DPI. In addition, the NSLDS GA DPI lacks explicit instruction for
nullifying PSSN accounts and does not provide GAs with instructions for
moving borrowers from pseudo accounts to valid accounts when the
borrower's valid SSN has been established. These practices have created
inaccurate loan histories in NSLDS. As a result, borrowers with
inaccurate loan histories may receive loans in excess of annual or
aggregate loan limits.

## Recommendations

We recommend that the Chief Operating Officer for FSA --

3.  Correct the problem accounts that we identified in our analysis and
    ensure the changes are reflected in NSLDS.

4.  Ensure that data providers store SSN history during SSN changes and
    updates, and ensure that data providers merge all of the borrower
    records into the newly created PSSN account.

5.  Improve the NSLDS Data Provider Instructions and other guidance to
    ensure that when the valid SSN for a borrower on a PSSN is
    established, all borrower records are moved to the valid SSN, the
    pseudo number is merged into the SSN history, and all unnecessary
    PSSN accounts are nullified.

6.  Periodically identify all PSSN accounts in NSLDS for which Title IV,
    HEA funds have been disbursed and query the system (using the
    student's name, date of birth, or other information) to identify and
    link duplicate or multiple PSSN and/or SSN accounts to the
    borrower's valid loan account.

The Department responded to our draft report on March 1, 2006. The
Department generally concurred with our inspection results and
recommendations.

####### OBJECTIVES, SCOPE, & METHODOLOGY

The objectives of our inspection were to --

1.  Determine whether FSA has established adequate internal controls for
    PSSNs and whether those controls are being followed.

```{=html}
<!-- -->
```
1.  Determine if there are data accuracy problems associated with the
    use of PSSNs in NSLDS.

We began our primary fieldwork on July 15, 2005, and concluded it on
November 17, 2005. We focused our review on PSSNs created from the
beginning of calendar year 2000 through the end of calendar year 2004
for FFELP and Direct Loans. We held an exit conference with FSA on
January 13, 2006.

We received a summary report from FSA on July 15, 2005, that identified
176,348 PSSNs in NSLDS. We exported the report into a Microsoft Access
database for analysis. From this, we determined that the largest number
of the PSSNs were created through NSLDS. We found that data providers
including schools, the Collections Division, Direct Loan Servicing, and
GAs also assign and move loan records to PSSNs.

Using the summary report data, we extracted all PSSNs created from 2000
through 2004 into Microsoft Excel and separated the information by data
provider according to the first four digits of the PSSN. Of the 77,993
PSSNs extracted, NSLDS staff created 56,581 PSSNs and other data
providers created 21,412 PSSNs. Using this data, we narrowed the focus
of our analysis to those data providers that created the largest number
of PSSNs from 2000 through 2004. We created an Excel spreadsheet for
each data provider: NSLDS, Collections Division, five GAs, and
"Others".[^9]

We ran a query of all PSSN accounts created from 2000 through 2004 by in
NSLDS. We extracted 12,855 loan and student information records for
8,807 PSSN accounts created by data providers in Excel format. The scope
of our analysis was limited because the query only produced records for
PSSNs that had loan information associated with the account. We reviewed
records for 11 percent of the 77,993 PSSNs created between 2000 and
2004. These 11 percent were identified because they had loan
disbursements.

For our first objective, we assessed FSA's current procedures and
methods for assigning PSSNs. We used the standards in OCFO: 1-101 and
GAO's Evaluation Tool to determine if FSA's controls for PSSNs were
adequate. During our inspection, we focused primarily on control
activities.

We interviewed FSA staff and contact persons from selected external
agencies to determine their internal controls activities for PSSNs. We
interviewed FSA staff from CPS, COD, Direct Loan Servicing, NSLDS, the
Collections Division, and the State Agency Liaison. We evaluated the
guidance, procedures, and system edits for five different FSA systems.
To determine if the internal controls for PSSNs were adequate, we
reviewed the CPS/SSA Match and CPS Data Entry Edits, the COD system
edits for SSNs, the Direct Loan Servicing Quarterly Invalid SSN Reports
from October 31, 2005, and June 30, 2005, the NSLDS Appendix A-5 and the
NSLDS GA DPI, the Collections Division's Virtual Library section on
"Social Security Number Error," and the NSLDS system edits for SSNs.

For our second objective, we conducted interviews with the five selected
GAs to assess the data accuracy problems associated with the use of
PSSNs in NSLDS. Using both the GA's spreadsheet and the "Others"
spreadsheet we produced for our analysis, we also randomly selected ten
PSSN accounts created by each of the GAs. We then requested the ten PSSN
account files from each GA to determine how the five selected GAs
process and monitor SSNs. We experienced a scope limitation because one
of the five GAs did not provide us with the ten records we requested.
Upon receipt of the 40 files we did obtain, we analyzed the pseudo
accounts for data accuracy errors including unlinked accounts, unlinked
SSN histories, uncorrected SSNs, and un-nullified accounts.

Our inspection was performed in accordance with the 2005 President's
Council on Integrity and Efficiency Quality Standards for Inspections
appropriate to the scope of the inspection described above.

####### APPENDIX

![](media/image3.wmf){width="6.496527777777778in"
height="8.254166666666666in"}

![](media/image4.png){width="6.490972222222222in"
height="8.52361111111111in"}

![](media/image5.png){width="6.497222222222222in"
height="8.85763888888889in"}

[^1]: Direct Loan Servicing uses the term Invalid SSNs to apply to all
    SSNs that have not been issued by SSA, including PSSNs. Direct Loans
    Servicing does not distinguish between PSSNs and all other invalid
    SSNs.

[^2]: The Department's internal control standards are drawn from the
    *Standards for Internal Control in the Federal Government* issued by
    the Government Accountability Office in November 1999.

[^3]: Departmental Directive OCFO: 1-101: *Federal Managers' Financial
    Integrity Act/Management Reporting on Internal Controls* (September
    29, 2003).

[^4]: Direct Loan Servicing uses the term Invalid SSNs to apply to all
    SSNs that have not been issued by SSA, including PSSNs. Direct Loans
    Servicing does not distinguish between PSSNs and all other invalid
    SSNs.

[^5]: The data providers in NSLDS Appendix A-5 include GAs, schools,
    Direct Loan Servicing, and the Collections Division.

[^6]: PSSN accounts are nullified when the loan is placed into cancelled
    status and all disbursement records are removed from the account.

[^7]: We only received records from four of the five GAs selected for
    analysis and as a result we were unable to review the records for
    randomly selected PSSN accounts at the fifth GA.

[^8]: On February 21, 2006, we verified that data providers corrected
    four of the five problem accounts in NSLDS. The remaining problem
    account should be corrected.

[^9]: We labeled the "Others" spreadsheet as a different category
    because the entity that created the number did not follow the NSLDS
    Appendix A-5 instructions when it created the PSSN. The "Others"
    were not on the Guaranty Agency's primary spreadsheet because the
    "Others" PSSNs did not start with the appropriate four digits.