OTHER INFORMATION

FY 2016 Agency Financial Report—U.S. Department of Education 137 

Office of Inspector General’s (OIG) Management and 

Performance Challenges for Fiscal Year 2017 

Executive Summary 

The Office of Inspector General (OIG) works to promote efficiency, effectiveness, and 

integrity in the programs and operations of the U.S. Department of Education (Department). 

Through our audits, inspections, investigations, and other reviews, we continue to identify 

areas of concern within the Department’s programs and operations and recommend actions 

the Department should take to address these weaknesses. The Reports Consolidation Act 

of 2000 requires the OIG to identify and report annually on the most serious management 

challenges the Department faces. The Government Performance and Results 

Modernization Act of 2010 requires the Department to include in its agency performance 

plan information on its planned actions, including performance goals, indicators, and 

milestones, to address these challenges. 

Last year, we presented five management challenges: improper payments, information 

technology security, oversight and monitoring, data quality and reporting, and information 

technology system development and implementation. On September 22, 2016, the Office of 

the Deputy Secretary announced an initiative to review the identified management 

challenges, assigned senior managers to be accountable for each, and assembled a 

workgroup of other senior managers throughout the Department to address the noted 

challenges. The Department further noted that this effort is intended to help identifying 

systemic root causes and ensure that Department’s actions are impactful and produce 

results. We consider this initiative to be a positive step towards addressing long-standing 

management challenges and encourage the Department to continue to explore approaches 

that result in targeted focus within each of these areas. Although the Department made 

some progress in addressing these areas, each remains as a management challenge for 

fiscal year (FY) 2017. 

The FY 2017 management challenges are: 

(1) Improper Payments, 

(2) Information Technology Security, 

(3) Oversight and Monitoring, 

(4) Data Quality and Reporting, and 

(5) Information Technology System Development and Implementation. 

These challenges reflect continuing vulnerabilities and emerging issues faced by the 

Department as identified through recent OIG audit, inspection, and investigative work. A 

summary of each management challenge area follows. This FY 2017 Management 

Challenges Report is available at http://www2.ed.gov/about/offices/list/oig/ 

managementchallenges.html. 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

138 FY 2016 Agency Financial Report—U.S. Department of Education 

Management Challenge 1—Improper Payments 

Why This Is a Challenge 

The Department must be able to ensure that the billions of dollars entrusted to it are 

reaching the intended recipients. The Department identified the Federal Pell Grant and the 

William D. Ford Federal Direct Loan (Direct Loan) programs as susceptible to significant 

improper payments. In addition, the Office of Management and Budget (OMB) has 

designated these programs as high-priority programs, which are subject to greater levels of 

oversight. 

Our recent work has demonstrated that the Department remains challenged to meet 

required improper payment reduction targets and to intensify its efforts to successfully 

prevent and identify improper payments. We have identified concerns in numerous areas 

relating to improper payments, including the completeness, accuracy, and reliability of 

improper payment estimates and methodologies. 

In May 2016, we reported that the Department’s published improper payment estimates for 

both the Pell Grant and Direct Loan programs were inaccurate and unreliable because they 

used incorrect formulas in performing calculations and deviated from OMB-approved 

methodologies. We concluded that the Department did not comply with IPERA because it 

did not meet the annual reduction target for the Direct Loan program. The Department’s 

recalculated FY 2015 improper payment rate (2.63 percent) for the Direct Loan program to 

correct for formula execution errors we identified did not meet its reduction target 

(1.49 percent). 

Our semiannual reports to Congress from April 1, 2013, through March 31, 2016, included 

more than $2.3 million in questioned or unsupported costs from audit reports and more than 

$59 million in restitution payments from our investigative activity. 

Progress in Meeting the Challenge 

The Department stated that it had developed internal controls that are intended to prevent, 

detect, and recover improper payments. The Department stated that it strives to provide 

timely and accurate payments to grant recipients and students while ensuring that the 

related controls are not too costly or burdensome to fund recipients. The Department further 

noted that it also relies on controls established by fund recipients who make payments on 

behalf of the Department. 

In response to OIG recommendations, the Department stated that it developed and 

implemented corrective actions to improve the accuracy and completeness of its 2016 

improper payment estimates. This included the establishment of a working group with OIG 

and OMB participation to review changes to the Department’s alternative improper payment 

estimation methodology to resolve identified risks. The Department also convened a senior 

level working group to identify and evaluate estimation methodology options for 2017 that 

would ensure IPERA compliance going forward. The Department added that it had revised 

its 2016 estimation methodology to decrease the volatility of the estimate and to address 

the other issues noted by the OIG. 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

FY 2016 Agency Financial Report—U.S. Department of Education 139 

The Department reported that it continues to assess and enhance its controls over student 

aid payments. The Department stated that it routinely analyzes application and payment 

data and considers other factors, such as program reviews and audit reports, to inform 

control enhancements and to devise ways to further reduce the risk of improper payments. 

The Department added that it has implemented an internal control framework intended to 

prevent or detect improper payments and has established processes to annually assess the 

design and operating effectiveness of these controls. The Department also stated that when 

weaknesses are identified, it identifies root causes and establishes corrective action plans. 

What Needs to Be Done 

The Department’s efforts to revise its estimation methodology are a good step forward to 

better identifying improper payments, so that corrective actions can be developed and 

tracked. The OIG will continue to review the Department’s efforts, with a focus on assessing 

how the new methodology is functioning to identify potential sources of improper payments. 

Ultimately, the ability of the Department to address this management challenge hinges on 

its ability to identify root causes, develop corrective actions, and demonstrate that its efforts 

have resulted in reductions in improper payments. While the Department correctly 

acknowledges that it relies on the internal controls of fund recipients who make payments 

on behalf of the Department, it is important that the Department’s efforts to reduce improper 

payments includes processes to identify high-risk recipients and ensure that those 

recipients have effective systems of internal control. 

Management Challenge 2—Information Technology Security 

Why This Is a Challenge 

The OIG has identified repeated problems in information technology (IT) security and noted 

increasing threats and vulnerabilities to Department systems and data. Department 

systems contain or protect an enormous amount of sensitive information, such as personal 

records, financial information, and other personally identifiable information. Without 

adequate management, operational, and technical security controls in place, the 

Department’s systems and information are vulnerable to attacks. Unauthorized access 

could result in losing data confidentiality and integrity, limiting system availability, and 

reducing system reliability. 

Over the last several years, IT security audits have identified controls that need 

improvement to adequately protect the Department’s systems and data. This included 

weaknesses in configuration management, identity and access management, incident 

response and reporting, risk management, remote access management, and contingency 

planning. 

Progress in Meeting the Challenge 

The Department stated that it has taken a number of steps to strengthen the cybersecurity 

posture of the Department’s networks and systems over the past fiscal year, including:

 Working to identify and protect high value information and assets that resulted in a 

better understanding of the potential impact from a cyber incident and helped to ensure 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

140 FY 2016 Agency Financial Report—U.S. Department of Education 

that physical and cybersecurity protections were in place for the Department’s high 

value assets. 

 Strengthening its capability to respond to cybersecurity incidents and identifying a plan 

for future action to establish a mature incident response capability. 

 Establishing daily integrated Security Operations Center calls to communicate events or 

requirements with all necessary stakeholders. 

 Deploying enhanced capabilities for the detection of cyber vulnerabilities and protection 

from cyber threats. 

 Strengthening its partnership with the Department of Homeland Security to accelerate 

the deployment of continuous diagnostics and mitigation capabilities. 

The Department expected that recent actions would sustain and improve the advances 

seen over the past fiscal year. The Department stated that it had completed a significant 

step toward improving overall cybersecurity by requiring all privileged users use hardwarebased Personal Identity Verification cards or alternative forms of strong authentication. The 

Department added that other significant activities included leveraging existing capabilities to 

perform independent verification and validation of contractor submitted data, reviewing 

contractual requirements and assessments for contractor abilities to provide infrastructure 

services and malware detection, continuing employee awareness training, and developing 

IT security staff skills and competencies. 

What Needs to Be Done 

The Department reported significant progress towards addressing long-standing IT security 

weaknesses in the past fiscal year. However, we continue to identify significant 

weaknesses in our annual FISMA audits despite the Department’s reported corrective 

actions to address our prior recommendations. While we commend the Department for 

placing a priority on addressing these weaknesses, it needs to continue its efforts to 

develop and implement an effective system of IT security controls. Our FISMA audits will 

continue to assess the Department’s efforts and this will remain a management challenge 

until our work corroborates that the Department’s system of controls achieves expected 

outcomes. 

Management Challenge 3—Oversight and Monitoring 

Effective oversight and monitoring of the Department’s programs and operations are critical 

to ensure that funds are used for the purposes intended and programs are achieving goals 

and objectives. This is a significant responsibility for the Department given the numbers of 

different entities and programs requiring monitoring and oversight, the amount of funding 

that flows through the Department, and the impact that ineffective monitoring could have on 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

FY 2016 Agency Financial Report—U.S. Department of Education 141 

stakeholders. Two subareas are included in this management challenge—Student Financial 

Assistance (SFA) program participants and grantees.1

Oversight and Monitoring—SFA Program Participants 

Why This Is a Challenge 

The Department must provide effective oversight and monitoring of participants in the SFA 

programs under Title IV of the Higher Education Act of 1965, as amended, to ensure that 

the programs are not subject to fraud, waste, and abuse. The Department’s FY 2017 

budget request includes 139.7 billion in new grants, loans, and work study assistance to 

help an estimated 12.1 million students and their families pay for college. 

The growth of distance education has added to the complexity of the Department’s 

oversight of SFA program participants. The management of distance education programs 

presents challenges to the Department and school officials because little or no in-person 

interaction between the school officials and the student presents difficulties in verifying the 

student’s identity and academic attendance. The overall growth and oversight challenges 

associated with distance learning increases the risk of school noncompliance with the 

federal student aid laws and regulations and creates new opportunities for fraud, abuse, 

and waste in the SFA programs. Our investigative work has identified numerous instances 

of fraud involving the exploitation of vulnerabilities in distance education programs to obtain 

federal student aid. 

Our audits and inspections, along with work conducted by the Government Accountability 

Office continue to identify weaknesses in FSA’s oversight and monitoring of SFA program 

participants. Our audits of individual SFA program participants frequently identified 

noncompliance and waste and abuse of SFA program funds. 

Progress in Meeting the Challenge 

Overall, the Department reported that FSA remains committed to use more innovative and 

efficient methods to bolster its oversight and compliance efforts. This included efforts 

intended to expand the Department’s ability to perform these activities in a more proactive 

and preemptive fashion. The Department reported that it focused on three priority areas in 

its efforts to improve the oversight and monitoring of SFA program participants during 

FY 2016; (1) bolstering capacity to provide adequate Title IV enforcement; (2) enhancing 

oversight of contracts, loan servicing activities, and schools; and (3) expanding Clery Act

and borrower defense work. 

As part of this effort, the Department created the Enforcement Office within FSA to respond 

more quickly and efficiently to allegations of illegal actions by higher education institutions. 

 

1

 This area includes two changes from our previous Management Challenges report. In FY 2016 we 

included Distance Education as a distinct management challenge; however it is included as an 

element of Oversight and Monitoring – SFA Program Participants in this report. The change was 

made after consideration of the Department’s feedback to our prior report. Our FY 2016 report also 

included Oversight and Monitoring – Contractors as a subpart to this section. That element was 

removed because our current body work does not support its continued reporting as a challenge to 

the Department. 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

142 FY 2016 Agency Financial Report—U.S. Department of Education 

FSA also noted accomplishments in enhancing its oversight activities made by its 

multiregional review team, Program Compliance unit, and Clery team. 

With respect to the challenges presented by distance education, the Department stated that 

FSA’s Program Compliance unit enhanced the Recipient Data Sheet that is used to 

determine which students are receiving a portion or all of their education via distance 

education. The Department added that in FY 2016, Program Compliance developed and 

delivered a training program for program reviewers on the process to evaluate distance 

education. The training program included three components: a lecture on distance 

education requirements, case studies, and a question-answer session. In addition, a 

recommended work tool was created to assist reviewers in evaluating distance education 

courses. The Department believed that enhanced outcomes were evidenced in subsequent 

reviews of distance education programs. FSA plans to conduct continuous training to 

current and new reviewers to reinforce distance education review requirements and plans 

to monitor program reviews for distance education outcomes. The Program Compliance 

team also plans to work with other parts of FSA to offer training to institutions on distance 

education requirements through conference sessions, webinars, and other trainings. 

What Needs to Be Done 

The Department identified several important accomplishments that are intended to 

collectively improve its ability to provide effective oversight. We recognize the progress 

being made and the need to balance controls with both cost and the ability to provide 

necessary services effectively. However, our audits and investigations involving FSA 

programs continue to identify numerous instances of noncompliance and fraud. 

Overall, the Department needs to ensure that the activities of its Program Compliance office 

result in effective processes to monitor FSA program participants and reduce risk. It also 

should work to ensure that its program review processes are designed and implemented to 

effectively verify that high-risk schools meet requirements for institutional eligibility, financial 

responsibility, and administrative capability. The Department further needs to ensure that 

development and implementation of its Enforcement Office effectively provides the intended 

additional protections to students and taxpayers. Finally, the Department could enhance its 

oversight of FSA programs by developing and implementing improved methods to prevent 

and detect fraud. This includes methods to limit the effectiveness of organized activities 

involving distance fraud rings. 

Oversight and Monitoring—Grantees 

Why This Is a Challenge 

Effective monitoring and oversight are essential for ensuring that grantees meet grant 

requirements and achieve program goals and objectives. The Department’s early learning, 

elementary, and secondary education programs annually serve nearly 18,200 public school 

districts and 50 million students attending more than 98,000 public schools and 

32,000 private schools. Key programs administered by the Department include Title I of the 

Elementary and Secondary Education Act, which under the President’s 2017 request would 

deliver $15.4 billion to help more than 24 million students in high-poverty schools make 

progress toward State academic standards. Another key program is the Individuals with

Disabilities Education Act, Part B Grants to States, which would provide about $11.9 billion 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

FY 2016 Agency Financial Report—U.S. Department of Education 143 

to help States and school districts meet the special educational needs of 6.7 million 

students with disabilities. 

OIG work has identified a number of weaknesses in grantee oversight and monitoring. 

These involve local educational agency (LEA) fiscal control issues, State educational 

agency (SEA) control issues, fraud perpetrated by LEA and charter school officials, and 

internal control weaknesses in the Department’s oversight processes. 

Progress in Meeting the Challenge 

To further improve monitoring and promote effective grant oversight, the Department has 

issued guidance to offices that manage formula and discretionary grant programs, provided 

training for staff, and engaged in technical assistance to both staff and external 

stakeholders to enhance business operations in the area of grant award monitoring and 

oversight. In addition, some program offices have piloted new processes to improve 

coverage, efficiency, and consistency in fiscal monitoring across programs. 

What Needs to Be Done 

The Department’s issuance of new grant management guidance to its program offices 

should provide an improved basis for their monitoring activities. However, the Department 

still needs to ensure that its program offices are consistently providing effective risk-based 

oversight of grant recipients across applicable federal education programs. We 

acknowledge that the Department has worked to enhance the knowledge and capabilities 

of its existing employees. However, given the Department’s generally limited staffing in 

relation to the amount of federal funding it oversees, it is important for the Department to 

explore ways to more effectively leverage the resources of other entities that have roles in 

grantee oversight. This could include methods to use the single audit process and updates 

to the OMB 2 CFR 200, Subpart F—Compliance Supplement as ways to improve its 

monitoring efforts and help mitigate fraud and abuse in its programs. 

Management Challenge 4—Data Quality and Reporting 

Why This Is a Challenge 

The Department, its grantees, and its subrecipients must have effective controls to ensure 

that reported data are accurate and reliable. The Department uses data to make certain 

funding decisions, evaluate program performance, and support a number of management 

decisions. Our work has identified a variety of weaknesses in the quality of reported data 

and recommended improvements at the Department, SEA, and LEA level. This included 

weaknesses in controls over the accuracy and reliability of program performance and 

academic assessment data. 

Progress in Meeting the Challenge 

The Department stated that it continues to work to promote SEA controls over data, 

improve its own controls over data submitted by grantees, and ensure the transparency of 

data quality. The Department’s efforts to improve the data that it collects, publishes, and 

uses to inform grant management are coordinated by senior officials who are members of 

the Department’s Data Strategy Team and the EDFacts Governing Board. The Department 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

144 FY 2016 Agency Financial Report—U.S. Department of Education 

also reported that in the past year it had taken steps to promote grantee awareness of data 

quality issues and strengthen its review of grantee data. 

The Department further stated that it has multiple initiatives underway to improve data 

quality and help strengthen the accuracy and reliability of data reported by the Department. 

These included (1) strengthening the procedures for tracking issues with grantee data, 

(2) communicating the importance of grantee internal controls over data quality in 

monitoring, (3) strengthening the language in the certifications that grantees sign when 

submitting data to the Department, (4) improving the process for following up and resolving 

questions about grantee data submitted to EDFacts, and (5) supporting State agencies in 

improving their own data quality procedures. 

The Department added that it continues to include information about data limitations when 

reporting data in the Annual Performance Report and other publications and was 

implementing a corrective action plan in response to the OIG’s recommendation that the 

Department improve its data quality through monitoring efforts. 

What Needs to Be Done 

The Department continues to complete significant work that is intended to improve the 

overall quality of data that it collects and reports. This work should remain a priority, as data 

quality contributes to effective program management and helps ensure the credibility of 

information published by the Department. While the Department has made progress in 

strengthening both grantees’ data quality processes and its own internal reviews of grantee 

data, this area is an ongoing challenge. 

Our recent audits have found weaknesses in grantees’ internal controls over the accuracy 

and reliability of program performance data and student testing data. Overall, the 

Department needs to ensure that it is providing effective oversight and monitoring to 

grantees regarding their controls over data quality. Of note, the Department’s efforts to 

strengthen its procedures for tracking issues with grantee data could serve as a basis for 

sharing information across its program offices and identify entities for enhanced monitoring 

and support. The Department should also continue its efforts to provide appropriate 

technical assistance to grantees as necessary. Overall, the Department must continue to 

work to implement effective controls at all applicable levels to of the data collection and 

review processes to ensure that accurate and reliable data are reported. 

Management Challenge 5—Information Technology System 

Development and Implementation 

Why This Is a Challenge 

The President’s budget for FY 2017 stated that ensuring the efficiency, effectiveness, and 

security of federal IT has never been more central to how Americans are served by their 

government. It further notes that the current administration has focused on driving 

efficiencies in the way the government buys, builds, and delivers IT solutions to provide 

improved services to citizens. It adds that with the ongoing evolution of technology, the 

federal government has an unprecedented opportunity to accelerate the quality and 

timeliness of services delivered to the American people. 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

FY 2016 Agency Financial Report—U.S. Department of Education 145 

The Department faces an ongoing challenge of efficiently providing services to growing 

numbers of program participants and managing additional administrative requirements with 

declining staffing levels. The Department reported that it has the smallest staff but the thirdlargest discretionary budget among the 15 Cabinet agencies. The Department further 

reported that between 2005 and 2015 it experienced a 6 percent decrease in full-time 

equivalent usage. This makes effective information systems development and 

implementation and the greater efficiencies such investments can provide critical to the 

success of the Department’s activities and the achievement of its mission.

The Department’s current IT investments include systems that support business processes

such as student application processing and eligibility determination for federal student 

financial assistance; grant and loan award processing; procurement and acquisition; and 

the collection, storage, and reporting on Title IV aid disbursements and aid recipients. 

According to data from the Federal IT Dashboard, the Department’s total IT spending for 

FY 2015 was $689 million, with FSA’s IT spending accounting for more than $458 million of 

the total. 

Our recent work has identified weaknesses in the Department’s processes to oversee and 

monitor systems development that have negatively impacted operations and may have 

resulted in improper payments. 

Progress in Meeting the Challenge 

The Department reported that it had made progress in the overall program management 

and oversight of IT systems. This included developing a Lifecycle Management 

Methodology at FSA, conducting Independent Validation and Verification of a high risk 

system, and establishing a formal contract monitoring plan. The Department stated that it 

planned to continue its progress within this area by further educating project owners of 

lifecycle processes, enhancing program management oversight capabilities, and providing 

additional guidance to new IT system contracts. 

In addition, the Department stated that it continues to execute its Federal Information 

Technology Acquisition Reform Act (FITARA) implementation plan and at the time of this 

report was on track to meet internal CIO and external OMB commitments in the FITARA 

areas of budget formulation and planning, acquisition planning, acquisition execution, and 

organization and workforce. The Department reported that of the 44 baseline tasks, 

33 have been completed and 11 are in progress and scheduled for completion by 

December 31, 2016. Finally the Department stated that its FITARA working group continues 

to meet and address challenges that include improving planning and execution processes. 

What Needs to Be Done 

The Department needs to continue to monitor contractor performance to ensure that system 

deficiencies are corrected and that system performance fully supports the Department’s 

financial reporting and operations. The Department further needs to enhance its 

management and oversight of system modifications and enhancements and ensure that 

appropriate expertise to manage system contracts is in place. While Lifecycle Management 

Methodology was established in FSA, management needs to ensure it is implemented and 

followed. 
OTHER INFORMATION

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2017

146 FY 2016 Agency Financial Report—U.S. Department of Education 

Looking forward, the Department also needs to continue implementing the requirements of 

the Federal Information Technology Acquisition Reform Act and the revised OMB Circular 

A-130, “Managing Information as a Strategic Resource.”