STUDENT AND 

EXCHANGE VISITOR 

PROGRAM

DHS Needs to Take Actions 

to Strengthen Monitoring of 

Schools 

Statement of Rebecca Gambler, Acting Director 

Homeland Security and Justice

Testimony 

Before the Subcommittee on Immigration, 

Refugees, and Border Security, Committee 

on the Judiciary, U.S. Senate

For Release on Delivery 

Expected at 10:00 a.m. EST

Tuesday, July 24, 2012

GAO-12-895T

United States Government Accountability Office

GAO
 

Page 1 GAO-12-895T 

Chairman Schumer, Ranking Member Cornyn, and Members of the 

Subcommittee:

I am pleased to be here today to discuss the findings from our June 2012 

report assessing U.S. Immigration and Customs Enforcement’s (ICE) 

oversight of the Student and Exchange Visitor Program (SEVP).1 ICE, 

within the Department of Homeland Security (DHS), is responsible for 

managing SEVP, including ensuring that foreign students studying in the 

United States comply with the terms of their admission into the country. 

ICE also certifies schools as authorized to accept foreign students in 

academic and vocational programs. As of January 2012, more than 

850,000 active foreign students were enrolled at over 10,000 certified 

schools in the United States. In addition, ICE manages the Student and 

Exchange Visitor Information System (SEVIS), which assists the agency 

in tracking and monitoring certified schools, as well as approved students. 

We reported in April 2011 on the need for close monitoring and oversight 

of foreign students, and that some schools have attempted to exploit the 

immigration system by knowingly reporting that foreign students were 

fulfilling their visa requirements when they were not attending school or 

attending intermittently.2

Schools interested in accepting foreign students on F and M visas must 

petition for SEVP certification by submitting a Form I-17 to ICE.3 Once 

this certification is achieved, schools issue Forms I-20 for students, which 

enable them to apply for nonimmigrant student status. The Border 

Security Act requires DHS to confirm, every 2 years, SEVP-certified 

schools’ continued eligibility and compliance with the program’s 

requirements.4

 

1

GAO, Student and Exchange Visitor Program: DHS Needs to Assess Risks and 

Strengthen Oversight Functions, 

During the initial petition and recertification processes, a 

school must provide ICE with evidence of its legitimacy and its eligibility, 

GAO-12-572 (Washington, D.C.: June 18, 2012).

2

GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and 

Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs, GAO-11-411

(Washington, D.C.: Apr. 15, 2011).

3

F visas are for academic study at 2- and 4-year colleges and universities and other 

academic institutions. M visas are for nonacademic study at institutions, such as 

vocational and technical schools. As of March 2012, schools applying for initial 

certification were required to pay DHS $1,700, as well as a $655 site visit fee per campus.

4

8 U.S.C. § 1762.

 
 

Page 2 GAO-12-895T 

such as designated school officials’ attestation statements that both the 

school and officials intend to comply with program rules and regulations.

My testimony today summarizes the key findings of our report on ICE’s 

management of SEVP, which was publicly released last week.5

In summary, we reported that ICE does not have a process to identify and 

assess risks posed by schools in SEVP. Specifically, SEVP (1) does not 

evaluate program data on prior and suspected instances of school fraud 

and noncompliance, and (2) does not obtain and assess information from 

CTCEU and ICE field office school investigations and outreach events. 

Moreover, weaknesses in ICE’s monitoring and oversight of SEVPcertified schools contribute to security and fraud vulnerabilities. For 

example, ICE has not consistently implemented internal control 

procedures for SEVP in the initial verification of evidence submitted in lieu 

of accreditation. In addition, ICE has not consistently followed the 

standard operating procedures that govern the communication and 

coordination process among SEVP, CTCEU, and ICE field offices. We 

recommended that ICE, among other things, identify and assess program 

Like that 

report, my statement will address ICE’s efforts to (1) identify and assess 

risks in SEVP, and (2) develop and implement procedures to prevent and 

detect fraud during the initial certification process and once schools begin 

accepting foreign students. To conduct our work, we interviewed officials 

from each of SEVP’s seven branches and criminal investigators from the 

Counterterrorism and Criminal Exploitation Unit (CTCEU), as well as eight 

ICE field offices, which allowed us to obtain their perspective on the 

magnitude and risks associated with school fraud. We reviewed publicly 

available information on 12 cases of school fraud dating from 2006 to 

2011, which allowed us to better understand SEVP program risks. 

Additionally, we reviewed standard operating procedures and tested 

internal controls designed to ensure school oversight. To test SEVP’s 

internal controls, we selected a nongeneralizable, stratified random 

sample of 50 SEVP-certified schools and reviewed their case files to 

verify that evidence required for certification existed, such as designated 

school officials’ proof of citizenship or lawful permanent residency. We 

conducted this work in accordance with generally accepted government 

auditing standards. More detailed information on the scope and 

methodology of our published report can be found therein.

 

5

GAO-12-572. 
 

Page 3 GAO-12-895T 

risks; consistently implement procedures for ensuring schools’ eligibility; 

and, revise its standard operating procedure to specify which information 

to share among stakeholders during criminal investigations. ICE 

concurred with all the recommendations we made to address these 

challenges and has actions planned or under way to address them.

ICE has not developed and implemented a process to identify and 

analyze program risks since assuming responsibility for SEVP in 2003, 

making it difficult for ICE to determine the potential security and fraud 

risks across the more than 10,000 SEVP-certified schools and to identify 

actions that could help mitigate these risks. SEVP and CTCEU officials 

expressed concerns about the security and fraud risks posed by schools 

that do not comply with program requirements. Furthermore, various 

cases of school fraud have demonstrated vulnerabilities in the 

management and oversight of SEVP-certified schools. We reported that 

SEVP faces two primary challenges to identifying and assessing risks 

posed by schools: (1) it does not evaluate program data on prior and 

suspected instances of school fraud and noncompliance, and (2) it does 

not obtain and assess information from CTCEU and ICE field office 

school investigations and outreach events.

Evaluating SEVP information on prior and suspected cases of 

school noncompliance and fraud. SEVP does not have a process to 

evaluate prior and suspected cases of school fraud and noncompliance to 

identify lessons learned from such cases, which could help it better 

identify and assess program risks. SEVP has maintained a compliance 

case log since 2005—a list of approximately 172 schools (as of 

December 2011) that officials have determined to be potentially 

noncompliant with program requirements. The compliance case log 

represents those schools that SEVP, on the basis of leads and out-ofcycle reviews, is monitoring for potential noncompliance. According to 

SEVP officials, it has not used this list to identify and evaluate possible 

trends in schools’ noncompliance, although this list could provide useful 

insights to SEVP to assess programwide risks. Further, SEVP officials 

said that they have not looked across previous cases of school fraud and 

school withdrawals to identify lessons learned on program vulnerabilities 

and opportunities to strengthen internal controls. Our analysis indicates 

that there are patterns in the noncompliant schools, such as the type of 

school. For example, of the 172 postsecondary institutions on SEVP’s 

December 2011 compliance case log, about 83 percent (or 142) offer 

language, religious, or flight studies, with language schools representing 

the highest proportion. Without an evaluation of prior and suspected 

ICE Does Not Have a 

Process to Identify 

and Assess Risks 

Posed by Schools in 

SEVP
 

Page 4 GAO-12-895T 

cases of school fraud and noncompliance, ICE is not well positioned to 

identify and apply lessons learned from prior school fraud cases, which 

could help it identify and mitigate program risks going forward.

Obtaining information from CTCEU and ICE field offices’ 

investigations and outreach efforts. Based on our interviews with 

SEVP’s Director and other senior officials, we reported that SEVP had not 

established a process to obtain lessons learned information from 

CTCEU’s criminal investigators. Investigators may have valuable 

knowledge from working cases of school fraud in identifying and 

assessing program risks, including information such as characteristics of 

schools that commit fraud, how school officials exploited weaknesses in 

the school certification process, and what actions ICE could take to 

strengthen internal controls. For example, according to investigators in 

one ICE field office, CTCEU was hampered in pursuing a criminal 

investigation because SEVP officials did not obtain a signed attestation 

statement within the I-17 application from a school official stating that the 

official agreed to comply with rules and regulations. Another risk area we 

reported on is designated school officials’ access to SEVIS. In 2011, 

CTCEU provided SEVP officials with a position paper expressing 

concerns that designated school officials, who are not required to 

undergo security background checks, are responsible for maintaining 

updated information on foreign students in SEVIS. Investigators at three 

of the eight field offices we interviewed said that SEVP allowed 

designated school officials to maintain SEVIS access and the ability to 

modify records in the system while being the subject of an ongoing 

criminal investigation, despite requests from CTCEU to terminate SEVIS 

access for these officials. In addition, CTCEU collects data on its 

outreach efforts with schools through its Campus Sentinel program; 

however, the SEVP Director stated that his office had not obtained and 

analyzed reports on the results of these visits. CTCEU initiated Campus 

Sentinel in 2011, which ICE operates across all of its field offices 

nationwide.6

 

6

Funded with SEVP fee collections, the program aims to foster relationships between ICE 

law enforcement officials and schools through on-site visits and information sessions at 

conferences and to make school officials more aware of recent investigations of school 

fraud.

From October 1, 2011, through March 6, 2012, CTCEU 

conducted 314 outreach visits to schools. According to CTCEU 

investigators, these visits provide an opportunity to identify potential risks, 

including whether schools have the capacity and resources to support 
 

Page 5 GAO-12-895T 

programs for foreign students. Obtaining information on lessons learned 

from CTCEU investigators could help provide SEVP with additional 

insights on such issues as characteristics of schools that have committed 

fraud and the nature of those schools’ fraudulent activities.

To address these issues, we recommended that ICE develop and 

implement a process to identify and assess risks in SEVP, including 

evaluating prior and suspected cases of school noncompliance and fraud 

to identify potential trends, and obtaining and assessing information from 

CTCEU and ICE field office investigative and outreach efforts. DHS 

concurred and stated that ICE will develop and implement such a process 

by later this year.

ICE has not consistently implemented existing internal control procedures 

for SEVP in four areas: (1) initial verification of evidence submitted in lieu 

of accreditation, (2) recordkeeping to ensure schools’ continued eligibility, 

(3) ongoing compliance monitoring of school licensing and accreditation 

status, and (4) certification of schools offering flight training. Regulations 

require schools to establish that they are legitimate and meet other 

eligibility criteria for their programs to obtain certification from ICE.7

Initial verification of evidence submitted in lieu of accreditation. ICE 

requires schools to present evidence demonstrating that the school is 

legitimate and is an established institution of learning or other recognized 

place of study, among other things. Non-accredited, post-secondary 

schools, in particular, must provide “in lieu of” letters, which are evidence 

provided by petitioning schools in lieu of accreditation by a Department of 

Education-recognized accrediting agency. ICE policy and guidance 

require that SEVP adjudicators render an approval or denial of schools’ 

petitions based on such evidence and supporting documentation. This 

includes verifying that schools’ claims in the Form I-17, such as 

accreditation status and “in lieu of” letters, are accurate. However, SEVP 

In 

addition, weaknesses in managing and sharing key information with 

CTCEU impede SEVP’s prevention and detection of school fraud. The 

following summarizes these key findings and recommendations we made 

to address these issues.

 

7

8 C.F.R. § 214.3(a)(3) states that a school, to be eligible for certification, must establish

that it is bona fide. For the purposes of this report, we use the term “legitimate” 

synonymously with the term “bona fide.” 

Weaknesses in ICE’s 

Monitoring and 

Oversight of SEVPCertified Schools 

Contribute to Security 

and Fraud 

Vulnerabilities 
 

Page 6 GAO-12-895T 

adjudicators have not verified all “in lieu of” letters submitted to ICE by the 

approximately 1,250 non-accredited, post-secondary schools, as required 

by ICE’s policy. Rather, adjudicators decide whether to verify a letter’s 

source and the signatory authority of the signee based on any suspicions 

of the letters’ validity. Investigators at one of the eight ICE field offices we 

interviewed stated SEVP officials certified at least one illegitimate 

school—Tri-Valley University in California—because the program had not 

verified the evidence provided in the initial petition. In March 2012, 

CTCEU officials stated that several of their ongoing investigations involve 

schools that provided fraudulent evidence of accreditation or evidence in 

lieu of accreditation to ICE. Consistent verification of these letters could 

help ICE ensure that schools are legitimate and detect potential fraud 

early in the certification process. We recommended that ICE consistently 

implement procedures for ensuring schools’ eligibility, including 

consistently verifying “in lieu of” letters. DHS agreed and stated that 

SEVP personnel have initiated mandatory verification of all “in lieu of” 

letters.

Recordkeeping to ensure continued eligibility of schools. ICE’s 

standard operating procedures for recordkeeping require SEVP officials

to maintain records to document ongoing compliance. We reported that 

ICE had not consistently maintained certain evidence of selected schools’ 

eligibility for the program. According to our review of a stratified random 

sample of 50 SEVP-certified school case files, 30 files did not contain at 

least one piece of evidence required by the program’s policies and 

procedures. In addition, ICE was unable to produce two schools’ case 

files that we requested as part of our randomly selected sample.8 Without 

the schools’ information and evidence contained in these case files, 

including attestation statements and site visit reports, ICE does not have 

an institutional record to provide reasonable assurance that these schools 

were initially and continue to be legitimate and eligible for certification. 

According to ICE officials, the school recertification process would help 

address issues with incomplete and missing school files because schools 

are required to resubmit all evidence required by regulation when going 

through recertification. The Border Security Act required recertification for 

all SEVP-certified schools by May 2004 and every 2 years thereafter.9

 

8

Since ICE was unable to produce two schools’ case files, our results include the 48 files 

that we were able to analyze.

9

See 8 U.S.C. § 1762. The statute requires the review of institutions and other entities 

authorized to enroll or sponsor certain nonimmigrants. 
 

Page 7 GAO-12-895T 

However, ICE began the first recertification cycle in May 2010 and did not 

recertify all schools during this 2-year cycle, which ended in May 2012. As 

of March 31, 2012, ICE reported to have recertified 1,870 schools 

(approximately 19 percent of SEVP-certified schools). Given the delays in 

completing recertification, ICE is not positioned to address gaps in 

SEVP’s case files and cannot provide reasonable assurance that schools 

that were initially certified to accept foreign students are still compliant 

with SEVP regulations. Thus, we recommended that ICE establish a 

process to identify and address all missing school case files, including 

obtaining required documentation for schools whose case files are 

missing evidence. DHS concurred and stated that SEVP plans to work 

with ICE Records Management to develop protocols and actions to 

strengthen records management.

Ongoing compliance monitoring of school licensing and 

accreditation status. ICE does not have a process to monitor the 

ongoing eligibility of licensed and accredited, non-language schools 

enrolling foreign students. ICE regulations require all certified schools to 

maintain state licensing (or exemption) and provide various forms of 

evidence to ICE supporting schools’ legitimacy and eligibility. If a school 

loses its state license, the school would be unable to operate legally as a 

school within that state. However, ICE does not have controls to ensure 

that SEVP compliance unit officials would be aware of this issue; 

therefore, a school without a proper business license may remain certified 

to enroll foreign students and its designated school officials may continue 

to access SEVIS. We recommended that ICE develop and implement a 

process to monitor state licensing and accreditation status of all SEVPcertified schools. DHS concurred and stated that SEVP personnel are 

developing procedures to ensure frequent validation of license or 

accreditation information.

Certification of schools offering flight training. ICE’s policies and 

procedures require flight schools to have Federal Aviation Administration 

(FAA) Part 141 or 142 certification to be eligible for SEVP certification; 

however, ICE has certified schools offering flight training without such 

FAA certifications. As the federal agency responsible for regulating safety 

of civil aviation in the United States, FAA administers pilot certification 

(licensing) and conducts safety oversight of pilot training. FAA’s 

regulations for pilot training and certification are found in three parts—
 

Page 8 GAO-12-895T 

Parts 61, 141, and 142.10 ICE established a policy that requires Part 141 

and 142 for eligibility in SEVP because FAA directly oversees these flight 

schools and training centers on an ongoing basis.11 We reported 

identifying 434 SEVP-certified schools that, as of December 2011, offer 

flight training to foreign students.12

Coordination among SEVP, CTCEU, and ICE field offices. ICE has not 

consistently followed the standard operating procedures that govern the 

communication and coordination process among SEVP, CTCEU, and ICE 

However, 167 (38 percent) of these 

flight training providers do not have FAA Part 141 or 142 certification. 

SEVP senior officials acknowledged that all SEVP-certified schools 

offering flight training do not have FAA Part 141 or 142 certification even 

though the program requires it. ICE indicated that in most of the cases, it 

may have initially certified flight schools with Part 141 or 142 certification 

but the schools allowed their FAA certification to expire, and ICE did not 

identify or take compliance action against them. ICE is taking actions to 

address noncompliant flight schools as of May 2012, including notifying 

all SEVP-certified schools that do not have the required FAA certification 

that they must re-obtain the certification. Moreover, SEVP officials stated 

that they plan to coordinate with FAA to determine which schools have 

not met the requirements and will take withdrawal actions against them. 

While these are positive steps, we reported that SEVP had not yet 

established target time frames for implementing and completing these 

planned actions. Because ICE has certified or maintained certification of 

schools that provide flight training without the required FAA certification 

and oversight, the program is vulnerable to security and fraud risks. Thus, 

we recommended that ICE establish target time frames for notifying 

SEVP-certified flight schools that do not have the required FAA 

certification that they must re-obtain FAA certification. DHS concurred 

and stated that SEVP is consulting with FAA to develop target time 

frames.

 

10Federal aviation regulations are found under title 14 of the United States Code of 

Federal Regulations (14 C.F.R. pts. 61, 141, and 142).

11Part 61 relates to individual providers/instructors that are not subject to direct FAA 

oversight beyond the initial certification and subsequent renewal of each flight instructor’s 

certificate. Parts 141 and 142 outline requirements for flight schools and training centers. 

FAA oversees these Part 141 and 142 flight schools and training centers with annual 

inspections and by reviewing and approving the schools’ facilities and programs.

12This is a relatively small percentage of providers nationwide that offer flight training.
 

Page 9 GAO-12-895T 

field offices. Specifically, these procedures delineate roles and 

responsibilities for criminal investigations and establish protocols for 

SEVP taking administrative actions against schools during and following a 

criminal investigation. In some instances, SEVP management has not 

followed CTCEU requests to take or cease administrative actions and has 

not referred potentially criminal cases to CTCEU in accordance with ICE’s 

procedures. By strengthening coordination and communication between 

SEVP and CTCEU, ICE could better ensure that SEVP, CTCEU, and ICE 

field offices understand which information to share regarding whether to 

take administrative actions during criminal investigations and that clear 

criteria exist for referring cases from CTCEU based upon potentially 

criminal behavior. Thus, we recommended that ICE revise its standard 

operating procedure to specify which information to share among 

stakeholders during criminal investigations. DHS concurred and stated 

that SEVP will work with CTCEU and ICE field personnel to make the 

necessary revisions. We also recommended that ICE establish criteria for 

referring cases of a potentially criminal nature from SEVP to CTCEU. ICE 

agreed and stated that SEVP will work with CTCEU to improve this 

process.

Chairman Schumer, Ranking Member Cornyn, and members of the 

subcommittee, this concludes my prepared statement. I would be pleased 

to answer any questions that you may have at this time.

For further information regarding this testimony, please contact Rebecca 

Gambler at (202) 512-8777, or gamblerr@gao.gov. In addition, contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this statement. Individuals who made key 

contributions to this testimony are Kathryn Bernet, Assistant Director; 

Frances Cook; Elizabeth Dunn; Anthony C. Fernandez; David Greyer; 

and, Lara Miklozek.

Contacts and 

Acknowledgments 

(441091)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.