16 FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

MANAGEMENT’S DISCUSSION AND ANALYSIS

MANAGEMENT ASSURANCES

The Secretary of Education’s 2018 Statement of Assurance provided below is the final report produced by the 

Department’s annual assurance process. Although the Department has not identified any material weaknesses, 

it acknowledges that there are significant weaknesses and management challenges to be addressed that are 

identified elsewhere in this report.

STATEMENT OF ASSURANCE

FISCAL YEAR 2018

November 14, 2018

The Department of Education (the Department) management is responsible for meeting 

the objectives of the Federal Managers’ Financial Integrity Act of 1982 (FMFIA) by 

establishing, maintaining, evaluating and reporting on the Department’s internal control 

and financial systems. 

In accordance with Section 2 of FMFIA and Office of Management and Budget (OMB) 

Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal 

Control, management evaluated the effectiveness of the Department’s internal controls 

to support effective and efficient operations, reliable reporting and compliance with 

applicable laws and regulations.

Section 4 of FMFIA and the Federal Financial Management Improvement Act of 1996

(FFMIA) require management to ensure the Department’s financial management systems 

provide reliable, consistent disclosure of financial data. In accordance with Appendix D 

of OMB Circular A-123, management evaluated whether the Department’s financial 

management systems substantially complied with FFMIA requirements. The Department 

also conducted a separate assessment of the effectiveness of its internal control over 

financial reporting, including controls designed to prevent, detect and recover improper 

payments, in accordance with Appendix A of OMB Circular A-123.

The Department has not identified any material weaknesses in operations, reporting or 

compliance with applicable laws and regulations. 

Based on the results of the Department’s assessments described above, our system of 

internal controls provides Department management with reasonable assurance that the 

objectives of sections 2 and 4 of the FMFIA were achieved as of September 30, 2018.

Betsy DeVos

ANALYSIS OF SYSTEMS, CONTROLS, 

AND LEGAL COMPLIANCE
FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 17

MANAGEMENT’S DISCUSSION AND ANALYSIS

The Department maintains a comprehensive internal 

control framework and assurance process as depicted in 

the following diagram. 

INTRODUCTION

Strong risk management practices and internal control 

help an entity run its operations efficiently and effectively, 

report reliable information about its operations and 

financial position, and comply with applicable laws 

and regulations. The FMFIA requires federal agencies 

to establish internal controls that provide reasonable 

assurance that agency objectives will be achieved. 

OMB Circular A-123, Management’s Responsibility 

for Enterprise Risk Management and Internal 

Control implements FMFIA and defines management’s 

responsibilities for ERM and internal control. The 

Circular provides guidance to federal managers to 

improve accountability and effectiveness of federal 

programs, as well as mission support operations through 

implementation of ERM practices and by establishing, 

maintaining, and assessing internal control effectiveness. 

The guidance requires federal agencies to provide 

reasonable assurance that it has met the three objectives 

of internal controls:

 Operations—Effectiveness and efficiency of operations; 

 Reporting—Reliability of reporting for internal and 

external use; and 

 Compliance—Compliance with applicable laws 

and regulations. 

This section describes the Department’s internal control 

framework, an analysis of the effectiveness of its internal 

controls, and assurances provided by the Department’s 

leadership that internal controls were in place and 

working as intended during FY 2018 to meet the 

three objectives.

Control Framework

The Department’s internal control framework helps to 

ensure that the Department achieves its strategic goals 

and objectives related to delivering education services 

effectively and efficiently while complying with applicable 

laws and regulations and preparing accurate reports. This 

includes providing reasonable assurance to Department 

leadership and external stakeholders that financial data 

produced by the Department’s financial systems are 

complete, accurate, and reliable enough to support the 

preparation and fair presentation of financial statements 

that conform to federal standards, facilitate sound 

financial decision-making, and provide transparency 

about how the Department spent federal funds and 

maintains stewardship over its financial resources.

 
18 FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

MANAGEMENT’S DISCUSSION AND ANALYSIS

ANALYSIS OF CONTROLS

Overall, the Department relies on the principal office 

annual assurances, supported by risk-based internal 

control evaluations and testing, to provide reasonable 

assurance that its internal controls are well designed and 

in place and working as intended. The Department also 

considers issues identified by external auditors. During 

FY 2016, the Department revised its annual assurance 

process to conform to the new requirements contained 

in the revised U.S. Government Accountability Office 

publication, Standards for Internal Control in the Federal 

Government (commonly referred to as the “Green Book”). 

In FY 2018, the Department further revised the process 

to conform to the revised OMB Circular A-123 issued on 

July 15, 2016.

In FY 2018, the Department identified no material 

control weaknesses related to effective, efficient program 

operations and no areas of noncompliance with laws 

and regulations other than those noted in the Internal 

Control Exceptions section below. Although no material 

weaknesses were identified, the Department realizes that 

it has areas of control that need further strengthening, 

such as those disclosed in this report, the Independent 

Auditors’ Report, and the major challenges identified by 

the Department’s OIG in its OIG FY 2019 Management 

Challenges report. The Department continues to 

demonstrate its commitment to addressing, mitigating, 

or resolving its identified management challenges.

In accordance with OMB Circular A-123, the 

Department also conducted an additional assessment of 

the effectiveness of the Department’s internal controls 

over financial reporting and compliance with key financial 

management laws and regulations as described below. 

Internal Control over Financial Reporting 

The Department maintains strong internal controls 

to identify, document, and assess internal control over 

financial reporting, which includes: 

 comprehensive process documentation for the 

Department’s significant business processes 

and subprocesses,

 maintenance of a control catalogue comprised of 

3,934 key financial, operational, and Information 

Technology (IT) controls that align to the business 

processes (the Department documented 398 key 

controls and FSA documented 3,536 key controls 

[1,541 Business Process and Entity-Level controls and 

1,995 IT controls]), 

The Office of the Chief Financial Officer (OCFO) 

manages the assurance process on behalf of Department 

leadership. The Department established governance 

over the process, consisting of a Senior Management 

Council, a Senior Assessment Team (SAT), and a Core 

Assessment Team (CAT). The Senior Management 

Council is comprised of senior leaders from across the 

Department. It is the primary governance structure 

for ensuring overall management and efficiency of 

Department activities, especially with respect to process, 

procedures, and administrative structures, including 

providing strategic direction for the implementation 

of the internal control program. The SAT and CAT 

include representatives from OCFO, the Office of 

the Chief Information Officer (OCIO), student loan 

and grant-making program offices, Risk Management 

Service, and other operational support offices (including 

the Office of Management). The SAT and CAT provide 

greater oversight and monitoring of activities related to 

internal control assessments. 

The annual assurance process is the primary mechanism 

by which the Department implements FMFIA and 

OMB requirements pertaining to internal control. It 

requires the head of each principal office to evaluate 

its respective internal controls and to assert, in a letter 

to the Chief Financial Officer, that it has reasonable 

assurance that key internal controls are in place and 

working as intended or to provide a detailed description 

of significant deficiencies, material weaknesses, and 

other matters of nonconformance. In making this 

assessment, the head of the principal office considers 

information such as office managers’ personal knowledge 

of operations, external audit results, internal assessments, 

and other related material. 

OCFO staff work with the principal offices to help 

them identify potential control deficiencies and 

consult with the SAT to determine whether they 

represent significant deficiencies or potential material 

weaknesses. Any principal office that identifies a 

significant deficiency or material weakness must prepare 

a Corrective Action Plan to address the issue. These 

Corrective Action Plans, in addition to daily operational 

oversight and management-initiated evaluations, 

facilitate the correction and monitoring of controls. 

If potential material weaknesses are identified, they 

are evaluated by the Senior Management Council 

to determine if they should be reported on the 

Department’s Statement of Assurance.
FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 19

MANAGEMENT’S DISCUSSION AND ANALYSIS

 Grants Management System (G5),

 E2 Travel System, and

 Hyperion Budget Planning.

The Department designated the FMSS as a missioncritical system that provides core financial management 

services, and focused its system strategy on the following 

areas during FY 2018: 

 Managing and implementing cross-validation 

rules throughout the fiscal year to prevent invalid 

accounting transactions from being processed,

 Transmitting the Department’s spending data related 

to contracts, grants, loans, and other financial 

assistance awards for the USASpending.gov initiative 

as part of the Federal Funding Accountability and 

Transparency Act of 2006,

 Transmitting the entire Department’s payments through 

the Department of Treasury Secure Payment System,

 Transmitting the Department’s spending data related to 

contracts, grants, loans, and other financial assistance 

awards for the DATA Act implementation, and

 Initiating the upgrade of the FMSS Oracle E-Business 

Suite application to Oracle R12, to ensure continued 

vendor support, improved security, improved 

infrastructure, and enhanced functionality.

In FY 2019, EDCAPS will continue to provide customer 

service and improve security of its systems by completing 

the Department’s implementation of Oracle E-Business 

Suite R12. In doing so, the Department will be current 

and ready to provide a more secure and better integrated 

financial management application.

The Department’s financial management systems are 

designed to support effective internal control and 

produce accurate, reliable, and timely financial data 

and information. Based on self-assessments, systemlevel general controls tests, and the results of internal 

and external audits, the Department has not identified 

any material weaknesses in controls over systems. The 

Department has also determined that its financial 

management systems substantially comply with FFMIA 

requirements. However, as noted below in the Internal 

Control Exceptions section, the Department continues to 

address issues and improve its controls over systems.

 technical assistance provided to principal offices to help 

them understand and assess key financial controls,

 a risk-based testing strategy, and

 a process to develop corrective action plans when 

control deficiencies are found and to track progress 

against those plans.

During FY 2018, the Department assessed the design 

and operating effectiveness of 2,767 key financial, 

operational, and IT process controls (the Department 

assessed 119 key controls and FSA assessed 2,648 key 

controls [1,287 Business Process and Entity-Level 

controls and 1,361 IT controls]).

Although some control deficiencies were detected, the 

Department did not identify any significant deficiencies 

or material weaknesses. Corrective actions have been 

initiated for the deficiencies identified. As a function of 

this assessment, the Department tested the key financial 

controls over the Digital Accountability and Transparency 

Act of 2014 (DATA Act) reporting and concluded that 

the controls are designed and operating effectively.

INTERNAL CONTROL OVER FINANCIAL 

MANAGEMENT SYSTEMS

The FFMIA requires management to ensure that the 

Department’s financial management systems consistently 

provide reliable data that comply with federal financial 

management system requirements, applicable federal 

accounting standards, and the U.S. Standard General 

Ledger at the transaction level. Appendix D to OMB 

Circular A-123, Compliance with the Federal Financial 

Management Improvement Act of 1996, and OMB Circular 

A-130, Managing Federal Information as a Strategic 

Resource, provide specific guidance to agency managers 

when assessing conformance to FFMIA requirements. 

The Department’s core financial systems are under the 

umbrella of the Education Central Automated Processing 

System (EDCAPS), serving approximately 8,500 

Departmental internal users in Washington, D.C., and 

10 regional offices throughout the United States, as well 

as 39,600 external users. In FY 2018, the Department 

conducted an annual risk assessment of EDCAPS and 

tested 92 IT security controls, out of a baseline of 630 

IT security controls. EDCAPS is composed of five main 

linked components: 

 Financial Management Support System (FMSS),

 Contracts and Purchasing Support System (CPSS),
20 FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

MANAGEMENT’S DISCUSSION AND ANALYSIS

 100 percent of Department users completed the 

annual computer security and privacy awareness 

training course in FY 2018. The Department 

strictly enforced compliance with annual security 

and privacy awareness training requirements, and 

disabled network accounts for noncompliant users. In 

addition, the Department won the Security Awareness 

Training Scenario category in the Federal Information 

Systems Security Educators Association’s Annual 

Security Awareness, Training, and Education Contest. 

 In January of 2018, OCIO undertook an effort to 

reshape the Department’s cybersecurity policy and 

guidance. A new information security instruction and 

standards framework was developed to allow for 

the following:

 Flexibility

 Alignment with the Framework for Improving 

Critical Infrastructure Cybersecurity in 

coordination with M-17-25

 Alignment with the current budgeting and risk 

reporting structures

 Support for outcomes sensitive to the 

OCIO objectives

 Responsiveness to the risk environment

 Reduction in review and approval timelines

 Workflow automation

ANALYSIS OF LEGAL COMPLIANCE

The Department identified two instances of 

noncompliance with laws and regulations in FY 2018. 

Additionally, reviews and assessments conducted pursuant 

to information technology-related laws and regulations 

identified challenges still facing the Department. 

Federal Information Security Modernization 

Act of 2014

The Federal Information Security Modernization Act of 

2014 (FISMA) requires federal agencies to develop, 

document, and implement an agency-wide program to 

provide security for the information and information 

systems that support the operations and assets of the 

agency and ensure the confidentiality, integrity, and 

availability of system-related information.

The Department’s and FSA’s information security 

programs completed a number of significant activities 

in FY 2017 and FY 2018 to improve cybersecurity 

capabilities and functions, some of which included:

 In August of 2017, OCIO began publishing 

monthly ED Cyber Security Framework (CSF) Risk 

Scorecards. The CSF Risk Scorecard is published 

as part of ED’s Information Security Continuous 

Monitoring (ISCM) efforts to identify cybersecurity 

risks, issues, and opportunities for improvements 

in our cybersecurity protections. The ED CSF Risk 

Scorecard is a detailed analysis tool for Authorizing 

Officials, Information System Owners, and 

Information System Security Officers to:

 Describe the current cybersecurity posture; 

 Describe a target state for cybersecurity; 

 Identify and prioritize opportunities for 

improvement within the context of a continuous 

and repeatable process; 

 Assess progress toward the target state; and

 Communicate among internal and external 

stakeholders about cybersecurity opportunities 

and risks.

 The Department has also continued to 

strengthen its partnership with the Department 

of Homeland Security to deploy Continuous 

Diagnostics and Mitigation capabilities and 

strengthen the Department’s ISCM program.
FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 21

MANAGEMENT’S DISCUSSION AND ANALYSIS

101, 128 Stat. 1146, amended Section 3716(c)(6) of the 

DCIA to require referral of delinquent debt to Treasury’s 

Offset Program within 120 days. 

Due to unique program requirements of the Higher 

Education Act of 1965 (HEA), the Department requested 

guidance from Treasury’s Bureau of Fiscal Service, Office 

of General Counsel for the application of this revised 

DCIA requirement to Title IV debt. Treasury provided 

its interpretation of this requirement for Title IV debt 

in July 2015. Per Treasury’s interpretation, compliance 

for Title IV debt requires that the Title IV debt be: 1) 

in technical default (i.e., 271 days delinquent per Title 

IV aging) and 2) a receivable of the federal government. 

Therefore, the DCIA Treasury Offset Program referral 

requirement for Title IV debt owned by FSA at the time 

of delinquency is 271 days delinquent and for debt 

acquired via a FFEL guarantee default claim or default 

Perkins Loan assignment is 120 days delinquent (per 

DCIA aging which begins upon acceptance of a defaulted 

debt). As of September 30, 2018, the Department and 

FSA were not in compliance with the DCIA Treasury 

Offset Program referral requirement for Title IV debt as 

interpreted by Treasury because FSA had not yet revised 

its loan servicing systems, procedures, and internal 

processes in response to this interpretation. During FY 

2018, FSA continued to implement changes to its default 

loan servicing system and business process for referring 

eligible debts to the Treasury Offset Program sooner. 

In addition, FSA provided guidance to the Guaranty 

Agencies that will facilitate sending debts to Treasury 

sooner. FSA anticipates this first round of changes will 

be implemented during FY 2019. Afterwards, FSA will 

a) revise its compliance reporting procedures to enable 

FSA to establish a new DCIA compliance baseline and 

b) analyze the remaining compliance gap to determine 

next steps. This area of noncompliance is noted in the 

independent auditors’ report, exhibit C.

This determination of noncompliance with the 

DCIA does not represent a material weakness in the 

Department’s internal controls.

Improper Payments Information Act of 2002

The Improper Payments Information Act of 2002 (IPIA), 

Pub. L. 107-300, 116 Stat. 2350, as amended by 

the Improper Payments Elimination and Recovery Act 

of 2010 (IPERA), Pub. L. 111-204, 124 Stat. 2224, 

and the Improper Payments Elimination and Recovery 

Improvement Act of 2012 (IPERIA), Pub. L. 112-248, 

126 Stat. 2390, requires federal agencies to report 

improper payments annually for programs that are 

deemed susceptible to significant improper payments. 

IPERA also requires each agency’s OIG to review the 

agency’s improper payment reporting in its AFR and 

accompanying materials, and to determine whether the 

agency has met six compliance requirements.

In its annual improper payment compliance audit for 

FY 2017, the OIG concluded that the Department was 

not compliant with IPERA because it did not meet one 

of IPERA’s six compliance requirements for the Pell 

Grant (Pell) program. The Department reported an 

improper payment rate for the Pell program that did 

not meet the prior year published reduction target. The 

Department met all six IPERA compliance requirements 

for the Direct Loan program. For FY 2018, the improper 

payment rates for the Pell and Direct Loan programs met 

the prior-year published reduction targets.

This determination of noncompliance with IPERA does 

not represent a material weakness in the Department’s 

internal controls. The Department’s current nonstatistical 

estimation methodology limits the ability to establish 

accurate out-year reduction targets. To address this 

issue, the Department coordinated with OMB and 

other stakeholders in 2018 to develop a statisticallyvalid methodology that will be implemented in 2019 

to estimate improper payments for the Pell Grant and 

Direct Loan programs. This new methodology will 

improve the accuracy of the Department’s improper 

payment estimates and the Department’s ability to set 

and meet reduction targets. 

Debt Collection Improvement Act of 1996

The Debt Collection Improvement Act of 1996 (DCIA), 

Pub. L. 104-134, 110 Stat. 1321-358, was enacted into 

law as part of the Omnibus Consolidated Rescissions and 

Appropriations Act of 1996, Pub. L. 104-134, 110 Stat. 

1321. The primary purpose of the DCIA is to increase 

the collection of nontax debts owed to the federal 

government. Additionally, the DATA Act, Pub. L. 113-