> September 16, 2004

CONTROL NUMBER

[ED-OIG/A19-E0002]{.underline}

Theresa S. Shaw

Chief Operating Officer

Federal Student Aid

## U.S. Department of Education

Union Center Plaza, Room 112G1

830 First Street, N.E.

## Washington, DC 20202 

Dear Ms. Shaw:

This **Final** **Audit Report,** (Control Number ED-OIG/A19-E0002),
presents the results of our audit of the audit followup process for
external audits in Federal Student Aid (FSA)***.*** This audit was part
of a review of the audit followup process for Office of Inspector
General (OIG) external audits being performed in several principal
offices. A summary report will be provided to the Chief Financial
Officer, the Department of Education (Department) audit followup
official, upon completion of the audits in individual principal offices.

**BACKGROUND**

Office of Management and Budget (OMB) Circular A-50, entitled "Audit
Followup," provides the requirements for establishing systems to assure
prompt and proper resolution and implementation of audit
recommendations. The Circular states,

> Audit followup is an integral part of good management, and is a shared
> responsibility of agency management officials and auditors. Corrective
> action taken by management on resolved findings and recommendations is
> essential to improving the effectiveness and efficiency of Government
> operations.

The Department established a *Post Audit User Guide* (Guide) to provide
policy and procedures for the audit resolution and followup process.[^1]
The Guide states,

> Each Assistant Secretary (or equivalent office head) with cooperative
> audit resolution or related responsibilities must ensure that the
> overall cooperative audit resolution process operates efficiently and
> consistently.

The Guide also provides that as an Action Official (AO), the Chief
Operating Officer's responsibilities include,

-   Determining the action to be taken and the financial adjustments to
    be made in resolving findings in audit reports concerning respective
    program areas of responsibility,

-   Monitoring auditee actions in order to ensure implementation of
    recommendations sustained in program determinations, and

-   Maintaining formal, documented systems of cooperative audit
    resolution and followup.

#### **AUDIT RESULTS**

######### 

FSA's audit followup process was not always effective. We found that FSA
inappropriately relied on subsequent single or compliance audits for
assurance that issues noted in some OIG audits were corrected. In
addition, FSA did not always obtain or maintain documentation to provide
assurance that corrective actions were taken. As a result, FSA did not
have assurance that corrective actions were implemented, and the risk
remains that related programs are not effectively managed.

We also noted that corrective actions were still in process for five
audits that were reported as "closed" in the audit resolution system.
This issue is addressed in the OTHER MATTERS section of this draft
report.

FSA responded to our draft report, concurring with the results and
supporting the recommendation provided. FSA described specific
corrective actions it has taken and intends to take to address the
issues noted. FSA also responded that it had corrected the status of the
audits discussed in OTHER MATTERS. The full text of the FSA response is
included as Attachment 3 to this audit report.

######### Finding 1 Federal Student Aid Audit Followup Process Was Not Always Effective

FSA's audit followup process was not always effective. We reviewed audit
followup activities for 27 OIG audits of FSA programs that included a
total of 136 external recommendations. We found FSA inappropriately
relied on subsequent single or compliance audits for assurance that
issues noted in OIG audits were corrected for 7 of the 27 audits
reviewed (26 percent). We also found FSA did not obtain or maintain
documentation to provide assurance that corrective actions were taken
for an additional 5 of the 27 audits reviewed (19 percent). In total, we
found that FSA did not have assurance that requested corrective actions
were completed for 31 of the 136 recommendations (23 percent) in 12 of
the 27 audits reviewed (44 percent).

[Audit Followup Requirements:]{.underline}

OMB Circular A-50 states,

> Each agency shall establish systems to assure the prompt and proper
> resolution and implementation of audit recommendations. These systems
> shall provide for a complete record of action taken on both monetary
> and non-monetary findings and recommendations.

The Department's *Post Audit User Guide,* Section III, Chapter 5, Part
B, states:

> Primary responsibility for following up on nonmonetary determinations
> rests with AOs, who must have systems in place to ensure that
> recommended corrective actions are implemented by auditees.

Part B of the Guide further states, "Accurate records must be kept of
all audit followup activities including all correspondence,
documentation and analysis of documentation."

OMB Circular A-133, "Audits of States, Local Governments, and Non-Profit
Organizations," provides standards for audits of non-Federal entities
expending Federal awards (single audits). Follow up on prior audits is
addressed in several sections of the circular. However, the auditor is
only required to follow up on prior single audits, not on other audits
performed by OIG or other entities.

Single auditors are also required to follow generally accepted
government auditing standards. The 1994 revision to *Government Auditing
Standards* (GAS) required that auditors follow up on known material
findings and recommendations from previous audits that could affect the
financial statement audit. In the 2003 revision to GAS, the definition
of previous audits includes financial audits, attestation engagements,
performance audits, or other studies. However, the auditor is only
required to follow up on significant findings and recommendations that
directly relate to the objectives of the audit being undertaken.

[Reliance on Subsequent Single or Compliance Audits Did Not Always
Provide Assurance that Corrective Actions Were Completed]{.underline}

We noted that audit resolution staff inappropriately relied on
subsequent single audits or compliance audits for assurance that
corrective actions from OIG audits were completed. We identified two
major categories where this occurred:

1.  Audit resolution staff requested the institution to ensure that
    their independent auditors review and comment on the completion of
    certain corrective actions in subsequent single or compliance audit
    reports. In these cases, resolution documents issued to the external
    entities requested corrective actions similar to the following:

> The auditor during the next regularly scheduled audit must review and
> comment on this area of program operations to ensure that Dowling
> College is performing monthly reconciliations of school and servicer
> data.[^2]
>
> However, we found that the independent auditors did not include the
> requested review or comment as requested in the subsequent audit
> reports.

2.  Audit resolution staff stated in some cases they relied on single
    audits for assurance that corrective actions were completed. They
    considered the problem corrected if the subsequent single audits did
    not contain findings similar to those reported by OIG. However, we
    found that the subsequent single audit reports did not always
    contain statements that showed the independent auditor considered
    the findings reported by OIG or the completion of the corrective
    actions requested by FSA in conducting their audit. Single audit
    requirements do not ensure that follow up on prior OIG audits is
    performed. Prior OIG audits may not be determined to be "material"
    or "significant" by the auditor, or may not affect or directly
    relate to the objectives of the single audit, and as such followup
    procedures may not be performed.

> For example, an audit resolution document required an institution to
> implement a monitoring system to detect students who enroll but do not
> attend school. The document stated that a review of the school's
> independent auditor report showed no major program violations.
> However, we reviewed three subsequent independent auditor reports and
> determined there was no specific mention as to whether or not the
> auditors considered the implementation of the requested monitoring
> system in conducting their audit.[^3]

Overall, we determined that FSA's reliance on subsequent single or
compliance audit reports to document the completion of corrective
actions was not adequate for 22 of the 136 recommendations (16 percent)
in 7 of the 27 audits reviewed (26 percent). In these cases, the
subsequent single or compliance audits did not mention the area involved
in the OIG audits, or whether follow up was performed on the OIG audit
findings.

Although FSA relied on the completion of subsequent single or compliance
audits to document the completion of corrective actions, there was no
documentation that showed the results of the audits were reviewed and
reconciled to the outstanding corrective action requests. As such, FSA
did not identify instances where the reports did not specifically
address these areas.

[Interim Audit Memorandum Issued:]{.underline}

An interim audit memorandum entitled, "Use of Single Audits for Followup
on OIG Audits," was issued to FSA on March 18, 2004. In its response,
FSA agreed to review and revise its procedures to ensure schools
implement corrective actions on external OIG audit findings. FSA stated,

> FSA will no longer use single audits to ensure that schools take
> appropriate corrective actions on OIG audits. FSA will develop and
> implement procedures for its audit resolution staff to request
> documentation directly from the auditees to support actions were
> completed.

On April 9, 2004, in response to the memorandum, FSA issued interim
guidelines relating to followup on OIG external audits. In these
guidelines FSA stated:

> \[W\]e will no longer rely on the prior audit section of subsequent
> audits for documentation that corrective actions have been taken.
> Instead we will require the institutions to submit documentation of
> the completion of corrective action to the audit resolution staff
> prior to closing the audit.

The guidelines also provide preliminary procedures for audit resolution
and closure.

[Documentation of Corrective Actions Was Not Always
Obtained/Maintained.]{.underline}

FSA was not always able to provide evidence that showed requested
corrective actions were completed. We found that FSA was not able to
provide documentation in a timely manner,

initial documentation provided was not complete, and ultimately,
documentation was not available to support the completion of corrective
actions for 9 of the 136 recommendations (7 percent) in 5 of the 27
audits (19 percent) reviewed.

## 

## During our audit, FSA's Schools Channel staff did not always provide all documentation for audit resolution and followup activities in an effective manner.[^4] This occurred with respect to initial requests for resolution documentation and subsequent requests for documentation supporting the completion of corrective actions. FSA did not have hard copy audit resolution files, but maintained information on an electronic system. However, this system did not effectively lend itself to retrieving all related data for a particular audit. FSA staff encountered difficulties identifying and providing requested data in a timely manner.

## To illustrate, in response to our initial request for audit resolution documentation, FSA provided information for 25 of the 35 audits in our universe (71 percent), but not until seven weeks after the request was made. FSA indicated that the documentation for the remaining 10 audits would be provided the following week, but they did not provide this documentation. FSA indicated that the delay in providing documentation was due to staff availability to access the data, and because they wanted to provide documentation supporting both resolution and the completion of corrective actions. However, the information FSA eventually provided did not include documentation that showed the completion of corrective actions. The data initially provided included only audit resolution documents.

FSA later provided information in response to our request for all
documentation related to audit followup activity for our sample of
audits. This information for 23 selected audits was provided another
seven weeks after our request. We reviewed the documentation and
submitted referrals to FSA relating to potential areas of concern. In
response, FSA provided additional clarification or information not
previously identified for 10 of the 23 audits (43 percent).

Subsequent to the resolution of the audits we reviewed, the Department
established additional guidelines that expand upon the documentation
requirements for audit resolution files. The Department's "Guidelines
for Establishing File Folders and Maintaining Documentation For External
Audits," were effective as of September 1, 2002, and state that audit
resolution files should contain "All documentation pertaining to audit
follow-up activities, e.g., documentation from the auditee
substantiating the corrective action taken...." These guidelines are
provided as Attachment 2 to this report.

[Alert Memorandum Issued:]{.underline}

A related issue on audit resolution documentation was reported to FSA in
an alert memorandum issued on May 4, 2004. In its response, FSA stated,

> Procedures will be established to ensure that appropriate audit
> resolution files are maintained and document all actions taken to
> resolve findings of external OIG audits. Such procedures will take
> into consideration established OMB and Department guidelines\....

In instances where FSA relied on subsequent single or compliance audits,
they did not have assurance that the auditors reviewed areas in the OIG
audits, or that the issues noted in the OIG audit were corrected. When
FSA did not obtain or maintain appropriate documentation to show
requested corrective actions were completed, it did not have assurance
that identified deficiencies were corrected. As such, the risk remains
that related programs are not effectively managed.

###### 

###### Recommendations

We recommend that the Chief Operating Officer for Federal Student Aid:

1.  Develop and implement procedures to ensure that OIG audit areas and
    related corrective actions are reviewed and commented on in
    subsequent single or compliance audit reports, if these reports are
    used by audit resolution staff to gain assurance that corrective
    actions were completed.

```{=html}
<!-- -->
```
1.  Ensure that all future recommended corrective actions are fully
    implemented and adequate documentation is obtained and maintained to
    support the completion of all corrective actions, in accordance with
    the Department's external audit documentation and file requirements.

```{=html}
<!-- -->
```
1.  Ensure that recordkeeping relating to audit followup activities, in
    compliance with guidance established by OMB and the Department, is
    included in the procedures FSA will be establishing for audit
    resolution files.

**OTHER MATTER**

**Corrective Actions Are Still Underway for Five FSA Audits**

At the time of our review, 5 of the 27 audits (19 percent) of FSA
programs were reported as closed in the Department's audit tracking
system, although resolution or followup activity was still ongoing. In
total, 23 of the 136 recommendations (17 percent) we reviewed were
associated with audits inappropriately reported as closed in the
Department's current audit tracking system. The five audits are detailed
below:

-   Audit Control Number (ACN) A09-80023, "Academy Pacific Business and
    Travel College Eligibility to Participate in Title IV Programs,"
    issued December 21, 1998**.** The audit was closed in the prior
    audit tracking system as of August 31, 2001. Corrective actions to
    address two recommendations had not been finalized. The Department
    withdrew a request for a compromise and stated they would
    redetermine the audit liability.

```{=html}
<!-- -->
```
-   ACN A06-80008, "Audit of Capital City Trade and Technical School,
    Inc. Compliance with the 85 Percent Rule," issued February 15, 2000.
    The audit was reported as closed in the prior audit tracking system
    as of December 31, 2000. Corrective actions to address two
    recommendations had not been finalized. FSA stated that the audit
    was being reexamined to determine whether a fine action might be
    appropriate rather than seeking a repayment liability for an 85/15
    violation.

-   ACN A06-80013, "Hallmark Institute of Aeronautics' Compliance With
    The 85 Percent Rule," issued March 6, 2000**.** The audit was
    reported as closed in the prior audit tracking system as of March
    29, 2002. Corrective actions to address two recommendations had not
    been finalized. FSA stated that the audit was being reexamined to
    determine whether a fine action might be appropriate rather than
    seeking a repayment liability for an 85/15 violation.

-   ACN A06-B0011, "Livingstone College's Compliance with the Title IV,
    Student Financial Assistance, Verification Requirements," issued
    March 29, 2002. The audit was reported as closed in the prior audit
    tracking system as of September 30, 2002. At the time of this
    review, corrective actions to address three recommendations were not
    completed because the audit determination remained under appeal.

-   ACN A05-A0028, "The Illinois Student Assistance Commission's
    Administration of the Federal Family Education Loan Program Federal
    and Operating Funds," issued March 30, 2001. The audit was reported
    as closed in the prior audit tracking system as of January 31, 2002.
    At the time of our review, corrective actions to address 12
    recommendations were not completed because the audit determination
    remained under appeal. The Department had not defined corrective
    actions for two additional recommendations pending policy
    development and issuance.

Although the separate reporting of audits as resolved or closed was
limited under the Department's prior tracking system, the current system
does allow audits to be separately reported as resolved or closed.

OCFO staff are implementing enhancements to the Audit Accountability and
Resolution Tracking System (AARTS) that will allow a change in the
status of an audit after it is closed. If corrective actions for these
audits are still ongoing once these enhancements are complete, we
suggest FSA reopen the audits in AARTS to correctly reflect the status
as resolved, but not closed. Until the enhancements are completed, FSA
should keep OCFO apprised of the status of corrective actions for the
audits so that the audits may be appropriately reported as resolved, but
with corrective action still in process, in Department management
reports and in the *Semiannual Reports to Congress*.

### OBJECTIVE, SCOPE, AND METHODOLOGY

The objective of our audit was to evaluate the effectiveness of the
Department's process to ensure that external auditees implement
corrective action. To accomplish our objective, we reviewed applicable
laws and regulations, and Department policies and procedures. We
conducted interviews with FSA staff responsible for resolving and
following up on corrective actions for the audits selected. We also
reviewed documentation provided by FSA staff to support the corrective
actions taken for the recommendations included in our review.

The scope of our audit included OIG audits of FSA programs at external
entities issued during the period October 1, 1997, through September 30,
2002. The audits in the scope were reported by the Department's audit
resolution system as having been "closed" on or prior to September 30,
2002. We excluded certain audits from our scope including those relating
to year 2000 initiatives, and alternative products. A total of 38 FSA
audits, representing 181 recommendations, met the scope of our audit.

To select FSA audits for review, we evaluated the status of the
recommendations and corrective actions required by the Department. We
judgmentally selected all FSA audits that included monetary findings for
this review. We excluded any internal and non-sustained recommendations
included in these audits from our review. Overall, we selected 27 audits
and 136 recommendations for review. The selected audits are listed on
Attachment 1.

We relied on computer-processed data initially obtained from OIG's Audit
Tracking System to identify OIG audits issued during the scope period.
We reconciled this data to the Department's Common Audit Resolution
System (CARS), and to audits reported in OIG's *Semiannual Reports to
Congress* to ensure that we had captured all audits issued during the
period. We also reviewed copies of the audit reports to ensure the
audits met the scope period under review. We confirmed data in the audit
reports to data in the Department's AARTS, which replaced CARS in July
2003. Based on these tests and assessments, we determined that the
computer-processed data was reliable for meeting our audit objective.

FSA utilized an electronic system to maintain audit resolution and
followup documentation for 23 of the 27 OIG audits. We did not perform
an analysis to assess the contents and controls relating to the system.
Instead, we requested that FSA provide all relevant documentation from
this system during our review for the audits selected. We subsequently
reviewed this documentation to assess the adequacy of audit followup.

We conducted fieldwork at Department offices in Washington, DC, during
the period November 2003 through June 2004. We held an exit conference
with FSA staff on June 15, 2004. Our audit was performed in accordance
with government auditing standards appropriate to the scope of the
review described above.

## **STATEMENT ON MANAGEMENT CONTROLS**

As part of our review, we assessed the system of management controls,
policies, procedures, and practices applicable to the audit followup
process for OIG external audits of FSA programs. Our assessment was
performed to review the level of control risk. Because of inherent
limitations, a study and evaluation made for the limited purpose
described above would not necessarily disclose all material weaknesses
in the management controls. However, our assessment disclosed management
control weaknesses that adversely affected FSA's ability to ensure
corrective actions were taken by external entities in response to audits
of FSA programs. These weaknesses and their effects are fully discussed
in the AUDIT RESULTS section of this report.

**ADMINISTRATIVE MATTERS**

Corrective actions proposed (resolution phase) and implemented (closure
phase) by your office will be monitored and tracked through the
Department's Audit Accountability and Resolution Tracking System
(AARTS). Department policy requires that you develop a final corrective
action plan (CAP) for our review in the automated system within 30 days
of the issuance of this report. The CAP should set forth the specific
action items, and targeted completion dates, necessary to implement
final corrective actions on the finding and recommendation contained in
this final audit report. ***OIG Standard Language, OIG Policy Manual,
page 2560-16***

In accordance with the Inspector General Act of 1978, as amended, the
Office of Inspector General is required to report to Congress twice a
year on the audits that remain unresolved after six months from the date
of issuance.

Statements that managerial practices need improvements, as well as other
conclusions and recommendations in this report represent the opinions of
the Office of the Inspector General. Determinations of corrective action
to be taken will be made by the appropriate Department of Education
officials.

In accordance with the Freedom of Information Act (5 U.S.C. § 552),
reports issued by the Office of Inspector General are available to
members of the press and general public to the extent information
contained therein is not subject to exemptions in the Act.

We appreciate the cooperation provided to us during this review. Should
you have any questions concerning this report, please call Michele
Weaver-Dugan at (202) 245-6941. Please refer to the control number in
all correspondence related to the report.

> Sincerely,
>
> Helen Lew /s/\
> Assistant Inspector General for Audit Services

Attachments

####### FSA Audits Included in This Review

+------+----------+----------------------------------+----------------+
| **   | **Audit  | **Report Title**                 | **Report Issue |
| Numb | Control  |                                  | Date**         |
| er** | Number** |                                  |                |
+======+==========+==================================+================+
| 1    | A        | > Audit of the Direct Loan       | > October 6,   |
|      | 02-70001 | > Program Administered by        | > 1997         |
|      |          | > Dowling College                |                |
+------+----------+----------------------------------+----------------+
| 2    | A        | > Academy Pacific Business and   | > December 21, |
|      | 09-80023 | > Travel College Eligibility to  | > 1998         |
|      |          | > Participate in Title IV        |                |
|      |          | > Programs                       |                |
+------+----------+----------------------------------+----------------+
| 3    | A        | > Antonelli College's            | > February 19, |
|      | 05-80008 | > Administration of Student      | > 1999         |
|      |          | > Financial Assistance Programs  |                |
+------+----------+----------------------------------+----------------+
| 4    | A        | > East-West University's         | > May 18, 1999 |
|      | 05-90009 | > Administration of the Student  |                |
|      |          | > Financial Assistance Programs  |                |
+------+----------+----------------------------------+----------------+
| 5    | A        | > Pacific Travel Trade School    | > June 11,     |
|      | 09-80029 | > Eligibility to Participate in  | > 1999         |
|      |          | > Title IV Programs              |                |
+------+----------+----------------------------------+----------------+
| 6    | A        | > City Colleges of Chicago's     | > July 23,     |
|      | 05-80016 | > Administration of the Federal  | > 1999         |
|      |          | > Pell Grant Program             |                |
+------+----------+----------------------------------+----------------+
| 7    | 06-80011 | > Audit of Texas Careers'        | > August 6,    |
|      |          | > Compliance With the 85 Percent | > 1999         |
|      |          | > Rule                           |                |
+------+----------+----------------------------------+----------------+
| 8    | 06-80012 | > Audit of Collegiate Systems    | > August 9,    |
|      |          | > Inc Compliance With the 85     | > 1999         |
|      |          | > Percent Rule                   |                |
+------+----------+----------------------------------+----------------+
| 9    | A        | > The Illinois Student           | > December 29, |
|      | 05-90002 | > Assistance Commission's        | > 1999         |
|      |          | > Administration of the Federal  |                |
|      |          | > Family Education Loan Program  |                |
|      |          | > Federal and Operating Funds    |                |
+------+----------+----------------------------------+----------------+
| 10   | A        | > Audit of Capital City Trade    | > February 15, |
|      | 06-80008 | > and Technical School Inc       | > 2000         |
|      |          | > Compliance with the 85 Percent |                |
|      |          | > Rule                           |                |
+------+----------+----------------------------------+----------------+
| 11   | A        | > Platt College - San Francisco  | > February 28, |
|      | 09-90011 | > Administration of Title IV     | > 2000         |
|      |          | > Programs                       |                |
+------+----------+----------------------------------+----------------+
| 12   | A        | > Hallmark Institute of          | > March 6,     |
|      | 06-80013 | > Aeronautics' Compliance With   | > 2000         |
|      |          | > The 85 Percent Rule            |                |
+------+----------+----------------------------------+----------------+
| 13   | A        | > St Augustine College's         | > March 8,     |
|      | 05-90053 | > Administration of the Federal  | > 2000         |
|      |          | > Student Financial Assistance   |                |
|      |          | > Programs for the 1998-99 award |                |
|      |          | > year                           |                |
+------+----------+----------------------------------+----------------+
| 14   | A        | > University of Phoenix's        | > March 31,    |
|      | 09-70022 | > Management of Student          | > 2000         |
|      |          | > Financial Assistance Programs  |                |
+------+----------+----------------------------------+----------------+
| 15   | A        | > Review of Student Financial    | > August 7,    |
|      | 06-90004 | > Aid Compliance at Success      | > 2000         |
|      |          | > Institute of Business          |                |
+------+----------+----------------------------------+----------------+
| 16   | A        | > Review of Student Financial    | > August 8,    |
|      | 06-90012 | > Aid Compliance at the          | > 2000         |
|      |          | > International Institute of     |                |
|      |          | > Chinese Medicine               |                |
+------+----------+----------------------------------+----------------+
| 17   | A        | > Mount Senario College's        | > September    |
|      | 05-90052 | > Administration of the Title IV | > 14, 2000     |
|      |          | > HEA Programs for the Period    |                |
|      |          | > July 1, 1998 through June 30,  |                |
|      |          | > 1999                           |                |
+------+----------+----------------------------------+----------------+
| 18   | A        | > Audit of the Title IV Higher   | > September    |
|      | 05-90054 | > Education Act Programs         | > 28, 2000     |
|      |          | > Administered by Cleveland      |                |
|      |          | > State University Cleveland,    |                |
|      |          | > Ohio                           |                |
+------+----------+----------------------------------+----------------+
| 19   | A        | > Audit of Great Lakes Higher    | > March 30,    |
|      | 05-A0002 | > Education Corporation's        | > 2001         |
|      |          | > Federal Family Education Loan  |                |
|      |          | > Programs                       |                |
+------+----------+----------------------------------+----------------+
| 20   | A        | > The Illinois Student           | > March 30,    |
|      | 05-A0028 | > Assistance Commission's        | > 2001         |
|      |          | > Administration of the Federal  |                |
|      |          | > Family Education Loan Program  |                |
|      |          | > Federal and Operating Funds    |                |
+------+----------+----------------------------------+----------------+
| 21   | A        | > Audit of the Michigan Guaranty | > September    |
|      | 05-B0007 | > Agency's Administration of the | > 25, 2001     |
|      |          | > Federal Family Education Loan  |                |
|      |          | > Program Federal and Operating  |                |
|      |          | > Funds                          |                |
+------+----------+----------------------------------+----------------+
| 22   | A        | > University of Arkansas at      | > September    |
|      | 06-B0013 | > Little Rock's Compliance with  | > 28, 2001     |
|      |          | > the Title IV Student Financial |                |
|      |          | > Assistance Verification        |                |
|      |          | > Requirements                   |                |
+------+----------+----------------------------------+----------------+
| 23   | A        | > Southwest Texas State          | > September    |
|      | 06-B0009 | > University Compliance with the | > 28, 2001     |
|      |          | > Title IV Student Financial     |                |
|      |          | > Assistance Verification        |                |
|      |          | > Requirements                   |                |
+------+----------+----------------------------------+----------------+
| 24   | A        | > Audit of Drake College of      | > March 5,     |
|      | 02-B0006 | > Business's Compliance with the | > 2002         |
|      |          | > Title IV Higher Education Act  |                |
|      |          | > Program Requirements           |                |
+------+----------+----------------------------------+----------------+
| 25   | A        | > Audit of Glendale Career       | > March 18,    |
|      | 09-B0017 | > College\'s Administration of   | > 2002         |
|      |          | > the Higher Education Act Title |                |
|      |          | > IV Programs                    |                |
+------+----------+----------------------------------+----------------+
| 26   | A        | > South Texas Vocational         | > March 20,    |
|      | 06-B0026 | > Technical Institute --         | > 2002         |
|      |          | > Brownsville's Administration   |                |
|      |          | > of the Title IV Student        |                |
|      |          | > Financial Assistance Programs  |                |
+------+----------+----------------------------------+----------------+
| 27   | A        | > Livingstone College's          | > March 29,    |
|      | 06-B0011 | > Compliance with the Title IV   | > 2002         |
|      |          | > Student Financial Assistance   |                |
|      |          | > Verification Requirements      |                |
+------+----------+----------------------------------+----------------+

**Guidelines for Establishing File Folders & Maintaining Documentation**

**For External Audits**

**(Effective September 1, 2002)**

**The following procedures are set forth as *guidelines* for
establishing file folders and maintaining accurate and complete
documentation on all actions taken to resolve findings of [external
audits]{.underline} of ED programs.**

1.  An official audit resolution file folder should be established for
    each audit report.

2.  Each file folder should contain, at a minimum, the following
    documents:

    -   The Federal Audit Clearinghouse's audit cover sheet titled
        "Audit Description Data"

    -   Copy of the CARS generated "Summary of Findings Requiring
        Resolution"

    -   Copy of the audit report or pages of the audit report that
        provide relevant information to the resolution of the audit
        findings, including the findings, the auditee's corrective
        action plan or response to the findings, the section on the
        status of prior year findings, and the ED portion of the
        Schedule of Expenditures of Federal Awards

    -   A listing of the triage decisions for each audit finding

    -   Documentation of all correspondence and communication with the
        auditee, the auditor, and other appropriate individuals,
        including corrective action plans and necessary work papers

    -   Copy of the PDL \[Program Determination Letter\]

    -   Copy of the Audit Clearance Document (ACD)

    -   All documentation pertaining to audit follow-up activities,
        e.g., documentation from the auditee substantiating the
        corrective action taken, results of any monitoring visits,
        relevant information from the next year's audit that reports
        whether appropriate corrective action was taken on a prior year
        finding.

    -   Documented evaluations or conclusions of the PO \[Principal
        Office\] that support the adequacy of the corrective actions
        taken by the auditee, if not included in the PDL and/or
        occurring after the PDL is issued

3.  Each official file folder should also contain, as appropriate, the
    following documents:

    -   Documented evidence of technical assistance provided

    -   OGC \[Office of General Counsel\] and ED-OIG comments

    -   ED-OIG concurrence/non-concurrence of PDLs for all audits issued
        by ED-OIG or in which the audit has questioned costs of
        \$500,000 or more

    -   In the event an Administrative Stay has been requested and
        approved, all documents pertaining to the request for an
        Administrative Stay, e.g., the request and approval memoranda

    -   In the event an auditee requests a grantback, all documentation
        pertaining to the grantback

Ms. Michele Weaver-Dugan, Director

Operations Internal Audit Team

U.S. Department of Education

Office of Inspector General

400 Maryland Avenue, SW

Washington, DC 20202-1510

Dear Ms. Weaver-Dugan:

Thank you for the opportunity to review and comment on the draft audit
report entitled, *Audit Follow-up---FSA External Audits*,
ED-OIG/A19-E0002, issued on July 9, 2004.

Federal Student Aid (FSA) recognizes the importance of the audit
function to program integrity and continually seeks to improve the
effectiveness of the audit resolution process. Follow-up on the
implementation of appropriate and effective corrective actions is an
important part of FSA's ongoing commitment to program integrity.
Therefore, we are pleased that your report acknowledges FSA's
responsiveness to your interim report findings.

As you know, we agreed with you that FSA's internal controls on external
OIG audits could be enhanced to ensure that corrective action is taken,
and we moved quickly to change our procedures and improve controls over
our follow-up activities for OIG audits in April of this year. In July,
we also implemented new procedures to ensure our processes for
requesting Administrative Stays on OIG audits were in compliance with
the Department's procedures.

Recommendation 1.1 in this draft report has already been addressed: FSA
developed and implemented new procedures on April 9 to ensure corrective
actions are completed. Recommendations 1.2 and 1.3 will be addressed by
the end of September.

The enclosure provides our response to each recommendation. Again, we
appreciate the opportunity to review and comment on the draft report.

Sincerely,

Theresa S. Shaw /s/

Enclosure

cc: Pat Howard

Response to Draft Audit Report---*Audit Follow-up---FSA External
Audits,* ED-OIG/A19-E0002

[Recommendation 1.1]{.underline}: Develop and implement procedures to
ensure that OIG audit areas and related corrective actions are reviewed
and commented on in subsequent single or compliance audit reports, if
these reports are used by audit resolution staff to gain assurance that
corrective actions were completed.

Response: Effective April 9, FSA no longer uses single audits to ensure
that schools take appropriate corrective actions on OIG audits. FSA
developed and implemented new procedures that require audit resolution
staff to request documentation directly from the auditee to support that
corrective actions have been completed.

[Recommendation 1.2]{.underline}: Ensure that all future recommended
corrective actions are fully implemented and adequate documentation is
obtained and maintained to support the completion of all corrective
actions, in accordance with the Department's external audit
documentation and file requirements.

Response: We are implementing audit follow-up procedures for OIG audits
that require FSA audit resolution staff to obtain and maintain adequate
documentation to support the completion of corrective actions in OIG
audits in accordance with the Department's external audit documentation
and file requirements.

[Recommendation 1.3:]{.underline} Ensure that recordkeeping relating to
follow-up activities, in compliance with guidance established by OMB and
the Department, is included in the procedures FSA will be establishing
for audit resolution files.

[Response]{.underline}: We are implementing audit follow-up procedures
for OIG audits that include procedures for establishing audit resolution
files. These recordkeeping requirements will be in compliance with
guidance established by OMB and the Department.

[Other Matters]{.underline}: Corrective actions are still underway for
five FSA audits. We suggest that FSA reopen the audits in AARTS to
correctly reflect the status as resolved, but not closed.

[Response]{.underline}: The status of the five audits is being corrected
in the Audit Accountability and Resolution Tracking System (AARTS) to
reflect that they have been resolved. Further, Academy Pacific Business
and Travel College's audit has since been closed. Therefore, the system
will be updated to reflect that the current status of that audit is
closed.

[^1]: The *Post Audit User Guide*, draft version dated January 2, 2001,
    was in effect during the scope of our audit. The Guide was updated
    and reissued March 31, 2003. The statements quoted are also included
    in the current version of the Guide.

[^2]: Final Audit Determination letter dated December 15, 1997, for
    Audit Control Number A02-70001, "Audit of the Direct Loan Program
    Administered by Dowling College," issued October 6, 1997.

[^3]: Final Audit Determination Letter dated September 6, 2002, for
    Audit Control Number A02-B0006, "Audit of Drake College of
    Business's Compliance with the Title IV, Higher Education Act
    Program Requirements," issued March 5, 2002.

[^4]: The Financial Partners Channel staff within FSA provided files
    relating to four other audits in a timely manner.