FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 93

EXECUTIVE SUMMARY

The OIG works to promote efficiency, effectiveness, 

and integrity in the programs and operations 

of the U.S. Department of Education (the 

Department). Through our audits, inspections, 

investigations, and other reviews, we continue to 

identify areas of concern within the Department’s 

programs and operations and recommend actions the 

Department should take to address these weaknesses. 

The Reports Consolidation Act of 2000 requires the OIG 

to identify and report annually on the most serious 

management challenges the Department faces. The 

Government Performance and Results Modernization Act 

of 2010 requires the Department to include in its agency 

performance plan information on its planned actions, 

including performance goals, indicators, and milestones, 

to address these challenges.

Last year, we presented four management challenges: 

(1) improper payments,

(2) information technology security,

(3) oversight and monitoring, and

(4) data quality and reporting.

Although the Department made some progress in 

addressing these areas, each remains a management 

challenge for fiscal year (FY) 2019.

These challenges reflect continuing vulnerabilities and 

emerging issues faced by the Department as identified 

through recent OIG audit, inspection, and investigative 

work. A summary of each management challenge area 

follows. This FY 2019 Management Challenges Report 

is available at http://www2.ed.gov/about/offices/list/oig/

managementchallenges.html.

MANAGEMENT CHALLENGE 1—

IMPROPER PAYMENTS 

Why This Is a Challenge

The Department must be able to ensure that the billions 

of dollars entrusted to it are reaching the intended 

recipients. The Department identified the Federal 

Pell Grant (Pell) and the William D. Ford Federal 

Direct Loan (Direct Loan) programs as susceptible to 

significant improper payments. In addition, the Office of 

Management and Budget (OMB) has designated these 

programs as high-priority programs, which are subject to 

greater levels of oversight. 

Our recent work has demonstrated that the Department 

remains challenged to meet required improper payment 

reduction targets and needs to intensify its efforts to 

successfully prevent and identify improper payments. In 

May 2018, we issued an audit report on the Department’s 

compliance with improper payment requirements for FY 

2017. We found that the Department did not comply 

with the Improper Payments Elimination and Recovery Act 

of 2010 (IPERA) because it did not meet its reduction 

target for the Pell program. The Department reported 

a FY 2017 improper payment rate of 8.21 percent for 

the Pell program, which exceeded its reduction target 

of 7.85 percent. We found that the Department met 

the FY 2017 reduction target for the Direct Loan 

program. We reported that the Department’s improper 

payment reporting, estimates, and methodologies were 

generally accurate and complete. We also found that 

the Department adequately described the oversight and 

financial controls it has designed and implemented to 

identify and prevent improper payments. 

This was the Department’s second consecutive year of 

not meeting its reduction target for the Pell program. 

Under IPERA and OMB guidance, if an agency is not 

in compliance with IPERA for two consecutive fiscal 

years for the same program or activity, the Director of 

OMB will review the program and determine whether 

additional funding would help the agency come into 

compliance. In addition, OMB may require agencies 

that are not compliant with IPERA (for one, two, or 

three years in a row) to complete additional requirements 

beyond the measures listed in the guidance. For example, 

if a program is not compliant with IPERA, OMB may 

determine that the agency must reevaluate or reprioritize 

its corrective actions, intensify and expand existing 

corrective action plans, or implement or pilot new tools 

and methods to prevent improper payments. OMB will 

notify agencies of additional required actions as needed.

OFFICE OF INSPECTOR GENERAL’S (OIG) MANAGEMENT 

AND PERFORMANCE CHALLENGES FOR FISCAL YEAR 

2019 EXECUTIVE SUMMARY
94

OTHER INFORMATION | OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

Overall, our semiannual reports to Congress from April 

1, 2015, through March 31, 2018, included more than 

$715 million in questioned or unsupported costs from 

audit reports, which may be determined to be improper 

payments, and more than $45 million in restitution 

payments from our investigative activity.

Progress in Meeting the Challenge

The Department stated that it is committed to 

maintaining the integrity of payments to ensure that 

the billions entrusted to it reach intended recipients 

in the right amount and for the right purpose. The 

Department stated that it sustains payment integrity by 

establishing policies, business processes, and controls 

over key payment activities, to include those pertaining 

to payment data quality, cash management, banking 

information, and financial reports. Payment integrity 

includes robust controls designed to prevent, detect, and 

recover improper payments. The Department added that 

in designing such controls, it strives to strike the right 

balance between making timely and accurate payments to 

recipients, while at the same time ensuring the controls 

are not too costly or overly burdensome. The Department 

noted that it must rely in part on controls established by 

the recipients of Federal funds, including State, local, and 

private organizations that further distribute those funds 

on behalf of the Department. The Department stated 

that because these third-party controls are outside of the 

Department’s operational authority, they present a higher 

risk than the payments made directly by the Department, 

as evidenced by the OIG work and the Department’s root 

cause analyses.

The Department stated that its current nonstatistical 

estimation methodology for improper payments in 

student aid programs limits the ability to establish 

accurate out-year reduction targets. The Department 

noted that it coordinated with OMB and other 

stakeholders in 2018 to develop a statistically valid 

methodology that will be implemented in 2019 to 

estimate improper payments for the Pell Grant and Direct 

Loan programs. The Department believed that this new 

methodology will improve the accuracy of the estimates 

and the Department’s ability to meet reduction targets. 

In addition, the Department stated that it is pursuing 

legislation that would authorize the Internal Revenue 

Service to disclose tax return information directly to the 

Department for the purpose of administering programs 

authorized by Title IV of the Higher Education Act of 

1965, through which the Department awarded more 

than $120 billion in FY 2017. The Department expects 

the exemption would allow for significant simplification 

of and improvement to the administration of Title IV 

programs, including reduction in improper payments. 

The Department stated that it is also developing 

an updated portfolio of risks through its Enterprise 

Risk Management program that is intended to help 

ensure that the risk of improper payments across the 

Department is managed strategically. The Department 

further stated that it is working to integrate its 

Enterprise Risk Management framework with its 

internal control program to help prevent and detect 

improper payments. The Department’s internal control 

framework over payment integrity includes over 500 

controls designed to help prevent, detect, and recover 

improper payments. These controls are included in 

the universe of internal controls the Department 

tests annually to assess their design and operating 

effectiveness. When the Department detects control 

deficiencies, it identifies the root causes, develops 

corrective action plans, and tracks the completion of the 

corrective action through resolution.

What Needs to Be Done 

The Department needs to continue to take action to 

improve its payment integrity. The Department should 

continue its work to develop a methodology to accurately 

estimate improper payments, identify root causes, 

meet reduction targets, develop corrective action plans, 

and complete these plans to ensure programs comply 

with IPERA. The Department should also review and 

improve its business processes and controls over key 

payment activities to explore additional opportunities for 

preventing improper payments. 

The Department needs to develop and implement 

processes to more effectively and efficiently monitor 

institutions participating in the student financial 

assistance programs, State education agencies, and 

local educational agencies to ensure they properly 

spend and account for Federal education funds. This 

area will remain a management challenge until the 

Department fully meets the expectations of IPERA 

and its monitoring systems provide greater assurance 

that Federal funds are both properly distributed and 

appropriately used by recipients. 
95

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018 | OTHER INFORMATION

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

MANAGEMENT CHALLENGE 2—

INFORMATION TECHNOLOGY SECURITY 

Why This Is a Challenge

Department systems contain or protect an enormous 

amount of sensitive information, such as personal 

records, financial information, and other personally 

identifiable information. Without adequate management, 

operational, and technical security controls, the 

Department’s systems and information are vulnerable 

to attacks. Unauthorized access could result in lost data 

confidentiality and integrity, limited system availability, 

and reduced system reliability.

The OIG’s work related to information technology 

continues to identify control weaknesses and ineffective 

security management programs that the Department 

needs to address to adequately protect its systems 

and data. For example, our most recent report on the 

Department’s compliance with the Federal Information 

Security Modernization Act of 2014 (FISMA) noted 

that the Department and Federal Student Aid (FSA) 

made progress in strengthening their information 

security programs; however, we found weaknesses in the 

Department’s and FSA’s information systems and those 

systems continued to be vulnerable to security threats. 

As guided by the maturity model used in the FY 2017 

Inspector General FISMA Metrics, we found that the 

Department and FSA were not effective in all five security 

functions—Identify, Protect, Detect, Respond, and 

Recover. We also identified findings in all seven metric 

domains: (1) Risk Management, (2) Configuration 

Management, (3) Identity and Access Management, 

(4) Security Training, (5) Information Security 

Continuous Monitoring, (6) Incident Response, and 

(7) Contingency Planning. We made recommendations 

to assist the Department and FSA with increasing the 

effectiveness of their information security program so that 

they fully comply with all applicable requirements.

Progress in Meeting the Challenge

The Department stated that it has made significant 

progress managing risk associated with information 

technology security. In particular, the Department noted 

that it has focused on addressing information technology 

control issues that were identified in prior-year OIG 

FISMA audits. The Department stated that it has 

continued to implement a comprehensive set of solutions 

that strengthen the overall cybersecurity of its networks, 

systems, and data. 

The Department stated that it had taken actions to 

improve cybersecurity across the five security functions. 

Examples of actions identified by the Department within 

each area include the following.

 Identify. The Department stated that it implemented 

the use of a risk scorecard as a risk management 

tool and established a quantitative methodology 

for identifying, analyzing, and managing systemlevel cybersecurity risks. The Department stated 

that the risk scorecards are used to perform regular 

framework-based risk assessments to identify security 

gaps and opportunities to enhance the Department’s 

cybersecurity capabilities and better protect its 

network assets and data.

 Protect. The Department stated that it had provided 

three cybersecurity training courses and had also 

executed six simulated phishing exercises in FY 

2018. The Department believed that these exercises 

strengthened its ability to reduce risks to systems and 

information through modified user behavior and 

improved resilience to spear phishing, malware, and 

drive-by attacks.

 Detect. The Department stated that it completed 

acquisitions that included a database scanning tool 

and a Security Information Event Management 

solution. The Department also stated that it adjusted 

the network access control solution to further limit 

opportunities for potential malicious activity to 

occur and continued its work with the Department 

of Homeland Security to implement Continuous 

Diagnostics and Mitigation tools within its primary 

network infrastructure.

 Respond. The Department stated that it had 

increased forensics and vulnerability management 

capabilities and had reduced the turnaround time 

for security analysis through the acquisition and 

implementation of additional tools and hardware. 

The Department stated that multiple improvements 

in security reporting were also implemented to 

provide a quick view of activity statuses and security 

posture, including an improved Chief Information 

Officer weekly report.

 Recover. The Department stated that it implemented 

a new enterprise cybersecurity offering to system 

stakeholders that focused on testing system 

contingency plans and the incident response processes.
96

OTHER INFORMATION | OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

What Needs to Be Done

The Department reported significant progress towards 

addressing longstanding information technology security 

weaknesses. However, we continue to identify significant 

weaknesses in our annual FISMA audits—despite the 

Department’s reported corrective actions to address our 

prior recommendations. 

While we commend the Department for placing a 

priority on addressing these weaknesses, it needs to 

continue its efforts to develop and implement an effective 

system of information technology security controls, 

particularly in the areas of configuration management, 

identity and access management, and information 

security continuous monitoring. 

Our FISMA audits will continue to assess the 

Department’s efforts, and this will remain a management 

challenge until our work corroborates that the 

Department’s system of controls achieves expected 

outcomes. To that end, the Department needs to 

effectively address information technology security 

deficiencies, continue to provide mitigating controls for 

vulnerabilities, and implement planned actions to correct 

system weaknesses.

MANAGEMENT CHALLENGE 3—

OVERSIGHT AND MONITORING

Effective oversight and monitoring of the Department’s 

programs and operations are critical to ensure that 

funds are used for the purposes intended and programs 

are achieving goals and objectives. This is a significant 

responsibility for the Department given the numbers of 

different entities and programs requiring monitoring and 

oversight, the amount of funding that flows through the 

Department, and the impact that ineffective monitoring 

could have on stakeholders. Two subareas are included in 

this management challenge: student financial assistance 

program participants and grantees. 

OVERSIGHT AND MONITORING—

STUDENT FINANCIAL ASSISTANCE 

PROGRAM PARTICIPANTS 

Why This Is a Challenge

The Department must provide effective oversight and 

monitoring of participants in the student financial 

assistance programs under Title IV of the Higher 

Education Act of 1965, as amended, to ensure that the 

programs are not subject to fraud, waste, and abuse. 

In FY 2019, FSA expects to provide $129.5 billion in 

new Federal student aid grants and loans (excluding 

Direct Consolidation Loans) to almost 11.4 million 

postsecondary students and their families. 

The growth of distance education has added to the 

complexity of the Department’s oversight of student 

financial assistance program participants. The 

management of distance education programs presents 

challenges to the Department and school officials 

because little or no in-person interaction between the 

school officials and the student presents difficulties in 

verifying the student’s identity and academic attendance. 

The overall growth and oversight challenges associated 

with distance learning increases the risk of school 

noncompliance with the Federal student aid laws and 

regulations and creates new opportunities for fraud, 

abuse, and waste in the student financial assistance 

programs. Our investigative work has identified 

numerous instances of fraud involving the exploitation of 

vulnerabilities in distance education programs to obtain 

Federal student aid.

Our audits and work conducted by the Government 

Accountability Office continue to identify weaknesses 

in FSA’s oversight and monitoring of student financial 

assistance program participants. 

Progress in Meeting the Challenge

The Department stated that it has implemented robust 

oversight and monitoring processes for schools, lenders, 

servicers, guaranty agencies, and accrediting agencies. 

The Department further stated that FSA’s process for 

oversight and monitoring includes performing program 

reviews, reviewing and resolving annual compliance 

audits and financial statements submitted by program 

participants to ensure that these participants are 

administratively capable and financially responsible, and 

conducting certification activities to ensure that program 

participants continue to be eligible to participate in the 

student aid programs. 

The Department stated that the Next Generation 

Federal Student Aid transformation will bring significant 

improvements to FSA’s capabilities to monitor the 

performance of servicing and collections vendors 

in addition to monitoring servicing and collections 

performance generally. As part of this initiative, FSA will 

implement a business intelligence platform designed to 

capture and report on performance metrics, which will 

include vendor contract performance metrics and data. 
97

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018 | OTHER INFORMATION

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

What Needs to Be Done

While the Department stated that it has implemented 

robust oversight and monitoring processes, our 

audits and investigations involving student financial 

assistance programs continue to identify instances of 

noncompliance and fraud, as well as opportunities for 

FSA to further improve its processes. The Department 

should enhance its oversight of student financial 

assistance programs by developing and implementing 

improved methods to prevent and detect fraud. This 

includes methods to limit the effectiveness of organized 

activities involving distance fraud rings. 

Overall, the Department needs to ensure that its 

efforts to better coordinate oversight result in effective 

processes to monitor student financial assistance 

program participants and reduce risk. It should work 

to ensure that its program review and compliance audit 

processes are designed and implemented to effectively 

verify that high-risk schools meet requirements for 

institutional eligibility, financial responsibility, and 

administrative capability. The Department further 

needs to ensure its oversight functions work together to 

effectively provide the intended additional protections 

to students and taxpayers. 

Our audits and investigations of student financial 

assistance program participants and audits of the 

Department’s related oversight and monitoring processes 

will continue to assess a wide variety of effectiveness and 

compliance elements. This area remains a management 

challenge given our continued findings in this area. 

OVERSIGHT AND MONITORING—GRANTEES

Why This Is a Challenge

Effective monitoring and oversight are essential for 

ensuring that grantees meet grant requirements and 

achieve program goals and objectives. The Department’s 

early learning, elementary, and secondary education 

programs annually serve more than 18,300 public school 

districts and 55 million students attending more than 

98,000 public schools and 34,000 private schools. Key 

programs administered by the Department include the 

Title I program, which under the Department’s FY 

2019 budget appropriation would deliver more than 

$15.8 billion for local programs that provide extra 

academic support to help nearly 25 million students in 

high-poverty schools meet challenging State academic 

standards. Another key program is the Individuals with 

Disabilities Education Act, Part B Grants to States, which 

would provide more than $12.3 billion to help States and 

school districts meet the special educational needs of 6.9 

million students with disabilities. 

OIG work has identified a number of weaknesses in 

grantee oversight and monitoring. These involve local 

educational agency and State educational agency control 

issues, fraud relating to education programs, fraud 

perpetrated by State and local education agency and 

charter school officials, and internal control weaknesses in 

the Department’s oversight processes. 

Progress in Meeting the Challenge

The Department stated that is it working to maximize the 

value of grant funding by applying a risk-based, datadriven framework that balances compliance requirements 

with demonstrating successful results for the American 

taxpayer. The Department noted that there is significant 

inherent risk that State educational agencies, local 

educational agencies, and grant recipients may not always 

comply with financial or programmatic requirements, 

thereby negatively impacting program outcomes. The 

Department stated that it continues to take a number of 

actions to manage this risk and support State and local 

efforts, as well as postsecondary agencies and institutions, 

to improve outcomes. The Department’s new Strategic 

Plan includes key objectives and strategies focused on 

providing greater support to grantees through a number 

of ways, including flexibility, technical assistance, 

partnership, and dissemination of evidence.

The Department also stated that it continues to develop 

improved strategies to oversee and monitor grant 

recipients. According to the Department, one of these 

strategies is increasing the expertise of program staff 

to provide effective monitoring and oversight. The 

Department stated that its Risk Management Service 

developed and offered multiple courses covering basic to 

advanced strategies and resources to monitor formula and 

discretionary grantees. The Department has also focused 

on improving its technical support processes. 

The Department reported accomplishments in grantee 

oversight and monitoring across multiple offices. As 

examples, the Department reported the following.

 The Office of State Support implemented a 

performance review system designed to provide 

effective performance management and support 

to State educational agencies in administering and 

leveraging grant programs that include Title I, Part A; 

Title II, Part A; and Title III. 
98

OTHER INFORMATION | OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

 The Office of Elementary and Secondary Education 

increased the number of engagements in its fiscal 

monitoring pilot, which is in its second year, and 

successfully increased focus on improving grantee 

financial management. 

 The Office of Special Education and Rehabilitative 

Services and the Office of Elementary and Secondary 

Education collaboratively planned and hosted two 

major public events to provide States with technical 

assistance on assessment topics and implementing the 

Every Student Succeeds Act.

 Multiple offices also routinely collaborate in 

monitoring activities, focusing on areas such as 

assessments, accountability, and data reporting. 

What Needs to Be Done

The Department continued to report progress in 

enhancing its grantee oversight processes, citing 

numerous actions it had taken to address risks and 

improve outcomes across multiple program offices. The 

Department should periodically assess the results of these 

efforts, identify the most promising approaches, and 

determine whether these best practices can be effectively 

applied in other program offices. 

The Department should also continue its efforts to offer 

common training, encourage effective collaboration 

and communication across program offices, and take 

steps to ensure that its program offices are consistently 

providing effective risk-based oversight of grant recipients 

across applicable Federal education programs. Given 

the flexibilities offered by the Every Student Succeeds Act, 

the Department needs to ensure that its monitoring 

approaches support State and local efforts while providing 

effective oversight of financial stewardship and ensuring 

progress towards positive program outcomes. 

Given the Department’s generally limited staffing in 

relation to the amount of Federal funding it oversees, it 

is important for the Department to continue to explore 

ways to more effectively leverage the resources of other 

entities that have roles in grantee oversight.

The Department’s oversight and monitoring of grantees 

remains a management challenge given our continued 

findings in this area. 

MANAGEMENT CHALLENGE 4—DATA QUALITY 

AND REPORTING 

Why This Is a Challenge

The Department, its grantees, and its subrecipients 

must have effective controls to ensure that reported 

data are accurate and reliable. The Department relies 

on program data to evaluate program performance and 

inform management decisions. Our work has identified 

a variety of weaknesses in the quality of reported data 

and recommended improvements at the Department and 

at State and local educational agencies. This included 

weaknesses in controls over the accuracy and reliability of 

program performance and graduation rate information 

provided to the Department.

Progress in Meeting the Challenge

The Department acknowledged that there is significant 

inherent risk associated with the quality of data reported 

to the Department by grant recipients. However, the 

Department reported that it is committed to a number 

of actions to strengthen the quality, accessibility, and 

use of education data. The Department believes that 

its efforts to strengthen its data life cycle management, 

governance, and quality framework will help ensure 

that data the Department uses for decision-making are 

accurate and reliable. 

The Department stated that it developed a tool to track 

data quality concerns and State responses to datarelated questions that contributed to the School Year 

2015–16 Assessment, Adjusted Cohort Graduation 

Rate, and Consolidated State Performance Report data 

quality follow-up efforts. The Department tracks data 

quality findings through multiple review cycles with 

input from States and data stewards. The Department 

further reported that the Office of Elementary and 

Secondary Education implemented a process to 

track Consolidated State Performance Report data 

quality follow-up and streamlined the process to load 

Consolidated State Performance Report data quality 

findings into a main repository. 

The Department reported that it continues to work 

in other areas to improve the data management and 

verification process and better mitigate the risk that the 

Department might unknowingly accept or use inaccurate 

data. Notably, the Department plans to leverage single 
99

OFFICE OF INSPECTOR GENERAL’S MANAGEMENT CHALLENGES FOR FY 2018 | OTHER INFORMATION

FY 2018 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

audits to help assess grant recipient data quality. The 

Department is working with OMB on language for the 

compliance supplement that would add focus to the 

review of grant recipients’ internal controls that support 

the quality of performance data submitted to the 

Department. The Department believed that this would 

better ensure that data reported by States are accurate 

and reliable.

What Needs to Be Done

The Department’s efforts to improve the overall quality 

of data that it collects and reports remain important 

to its program management and reporting. While 

the Department has made progress in strengthening 

both grantees’ data quality processes and its own 

internal reviews of grantee data, this area is an 

ongoing challenge. Our recent audits continue to 

find weaknesses in grantees’ internal controls over the 

accuracy and reliability of program performance and 

graduation rate information. 

The Department’s effort to promote common strong 

practices across its program offices is an important 

step to improving data quality. In addition, efforts to 

strengthen data certification statements and to perform 

outreach to States and other entities that report data 

to the Department are important steps to reinforce 

the importance of good data quality practices. The 

Department should continue to monitor the quality of 

the data it receives, work to implement effective controls 

to address known weaknesses, and take steps to ensure 

that strong data management practices are implemented 

across the Department as well as by entities that submit 

data to the Department. The Department should follow 

through on its plans to leverage single audits to help 

assess grant recipient data quality.