For Release on Delivery

Expected at

9:30 a.m.

Tuesday,

April 3, 2001

GAO-01-585T

FINANCIAL

MANAGEMENT

Internal Control

Weaknesses Leave

Department of Education

Vulnerable to Improper

Payments

Statement of Jeffrey C. Steinhoff

Managing Director, Financial Management and Assurance

Testimony

Before the Subcommittee on Select Education,

Committee on Education and Workforce, House of

Representatives

United States General Accounting Office

GAO
Page 1 GAO-01-585T

Mr. Chairman and Members of the Subcommittee:

I am pleased to be here today to discuss our ongoing work on the

Department of Education’s payment processes, and how the existing

internal control weaknesses we have noted thus far in our review make

the Department vulnerable to improper payments. Improper payments

include errors, such as duplicate payments and calculation errors;

payments for unsupported or inadequately supported claims; payments for

services not rendered or to ineligible beneficiaries; and payments resulting

from fraud and abuse.

Since 1990, we have designated Education’s student financial assistance

programs as a high-risk area for waste, fraud, abuse, and mismanagement.1

These programs remain at high-risk primarily because Education lacks the

financial and management information needed to manage these programs

effectively and the internal controls needed to maintain the integrity of

their operations. Additionally, again this year Education was unable to

obtain an unqualified audit opinion on its financial statements because

significant financial management system and internal control weaknesses

continue to impair the Department’s ability to generate, analyze, and

present reliable financial information. Given the billions of dollars in

 1 Major Management Challenges and Program Risks: Department of Education, (GAO-01-245, January

2001) and High-Risk Series: An Update, (GAO-01-263, January 2001).
Page 2 GAO-01-585T

payments made by Education each year to recipients nationwide and

abroad, these known deficiencies in controls over financial reporting,

accounting, and information systems raise the risk that erroneous or

fraudulent payments could make their way through Education’s processes

without being prevented or detected.

Because of these risks, you requested that we audit selected accounts at

the Department that may be particularly susceptible to improper

payments. In response to your request, we have initiated a body of work

designed to (1) identify Education’s payment processes,

(2) determine what internal controls exist over these processes, (3) assess

whether the internal controls provide reasonable assurance that improper

payments will not occur or will be detected in the normal course of

business, (4) identify additional controls that should be implemented to

provide reasonable assurance that improper payments will not occur, and

(5) use various computer auditing techniques to identify potential

improper payments made by Education during the period May 1998 to

September 2000. This ongoing work, which builds upon earlier work done

by the Education Inspector General (IG), includes testing of grant and loan

payments to educational institutions and students, as well as payments to

contractors, vendors and others in support of Education’s operations

totaling over $186 billion. We plan to use an automated approach, such as

data base searches and other computer analyses, to identify unusual
Page 3 GAO-01-585T

transactions and payment patterns and provide red flags that a payment

may be improper.

My testimony today addresses the first phase of our work – assessing the

internal controls over Education payment processes, as well as

highlighting some of the findings from the fiscal year 2000 financial

statement audit that was recently completed by an independent public

accounting firm, Ernst & Young, under contract to the IG.

Let me first make a few comments on the importance of internal controls.

Internal controls are a major part of managing an organization, serving as

the first line of defense in safeguarding assets and preventing and

detecting fraud, abuse, and errors. They consist of the plans, methods, and

procedures used to meet missions, goals, and objectives. People are what

make internal controls work. Internal control is not something to be built

in at the end, but must be part of the daily fiber of management. The

responsibility for good internal controls rests with all managers. The

integrity and ethical values maintained and demonstrated by management

plays a key role in the entire organization’s ethical tone. By providing

guidance for proper behavior, removing temptations for illegal, improper,

or unethical behavior, and providing discipline when appropriate,

management portrays a positive control environment, which is essential in

achieving an agency’s objectives.
Page 4 GAO-01-585T

During our analysis of the various payment processes,2 we identified

internal control weaknesses that sharply increase Education’s

vulnerability to improper payments. We classified the weaknesses into

four broad categories, which are consistent with our Standards for

Internal Control in the Federal Government:

 3 (1) poor segregation of

duties; (2) lack of supervisory review; (3) inadequate audit trails; and

(4) inadequate computer systems’ application controls. I would like to

highlight some of the more significant weaknesses within each of these

broad categories.

To reduce the risk of fraud and other improper payments, key duties and

responsibilities associated with the payment process need to be divided or

segregated among different people. This should include separating the

responsibilities for authorizing transactions, processing and recording

them, reviewing the transactions, and handling the related funds.

 2Consistent with your request to focus our audit on payment processes particularly susceptible to

improper payments, we concentrated our efforts on the following payment processes: (1) grants and

direct loans; (2) government purchase cards; (3) third party drafts; and (4) contract and purchase

order payments. Grant and direct loans are processed by the Grant Administration and Payment

System (GAPS), whereas the other payments are processed by the Financial Management System

Software (FMSS).

3Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1), which was

prepared to fulfill our statutory requirement under the Federal Managers’ Financial Integrity Act,

provides an overall framework for establishing and maintaining internal control and for identifying and

addressing major performance and management challenges and areas at greatest risk of fraud, waste,

abuse, and mismanagement.

Poor Segregation of

Duties
Page 5 GAO-01-585T

Segregation of duties is one of the most fundamental internal control

concepts.

However, we found that some individuals at Education can control the

entire payment process for certain types of transactions. For example,

some Education employees can issue hard copy checks, known as third

party drafts, without involving anyone else. Currently 49 Education

employees can request blank checks. We found that 21 of these individuals

can also access the system, generate a payment without prior obligation,

print and sign the check, and submit it to the payee. The Department is

thus vulnerable to the possibility of individuals using third party drafts to

pay for personal expenses, without any physical or system controls in

place to prevent or detect such an occurrence. These drafts can be issued

for up to $10,000 each and in fiscal year 2000, the Department reported

issuing over 19,000 third party drafts totaling approximately $23 million.

We also found inadequate segregation of duties related to the electronic

transfer of funds through the Federal Reserve Bank (FRB) network to a

payee’s bank account. Electronic fund transfers are used primarily to

disburse grants and loans to schools, states, local education agencies and

others. These payments totaled over a reported $181 billion from May 1998

to September 2000 – the period covered by our ongoing review. Although

Education has a policy that prohibits the same individual from creating,
Page 6 GAO-01-585T

certifying, and electronically transferring funds through the FRB, some

Education employees are capable of doing this without involvement from

anyone else. During a walkthrough of this payment process at the Office of

the Chief Financial Officer (OCFO), a staff member told us that one snowy

day last winter, when she was the only person in the office who works on

these electronic fund transfers, she created, certified, and transmitted the

payment files that day. There was no preventive control that limited the

employee from performing all facets of the electronic fund transfers.

Compounding this, because the Department does not have the appropriate

follow-up controls in place, such as a requirement that supervisors

document their post-review and approval of these types of transactions,

the Department may not detect unauthorized FRB transfers.

Basic control activities, such as approvals, authorizations, verifications,

reconciliations, and maintenance of documentation, are an integral part of

an agency’s accountability for government resources and achieving

effective results, including the prevention and/or detection of improper

payments. However, we found that Education has serious deficiencies in

its process for reviewing and approving purchases made with Government

credit cards – called purchase cards.

Lack of Supervisory

Review
Page 7 GAO-01-585T

As of October 30, 2000, approximately 230 Education employees had

government purchase cards in their names. According to a Departmental

directive, Education’s policy is to use government purchase cards for

authorized purchases of expendable goods and services costing $1,000 or

less, such as supplies not available from the GSA Customer Supply Center.

Generally, Education employees are limited to charging up to $10,000 per

month. Some employees have higher limits; we found that 36 individuals

can charge $25,000 or more per month, and 2 of those employees can

charge up to $300,000 in a single month. This policy also requires a person,

designated as an approving official, to perform a review of cardholders’

monthly statements prior submitting the statement for payment, to ensure

that each purchase was made for official use and in accordance with

established internal procedures. The approving official must sign the

cardholders’ monthly statements upon completion of the review process.

In this case, the approving officials’ review represents the principal

internal control.

In order to determine whether Education is following its established

policies, we selected 4 months of cardholder’ statements to review for

certain attributes, including approving official’s signature. Of the 676

purchase cardholders’ monthly statements that we have reviewed thus far,

141, valued at nearly $1 million, were not signed by an approving official

indicating that the purchases were approved. We also noted that several of
Page 8 GAO-01-585T

the types of purchases made by Education employees were items that

could be used either for official business or for employees’ personal needs,

including computers, software, cell phones, and internet service.

Education’s own policy specifically lists computers as an item that should

not be purchased with government purchase cards.

In June 2000, the Department of Defense (DOD) issued a Fraud Alert

indicating that government purchase card use is increasing and along with

the increase in spending levels there has been an increase in card abuse.

Specifically, the Fraud Alert noted that some cardholders have conspired

with unscrupulous vendors, while others have relied on the naïve trust of

their supervisors who may have been negligent in their review of

purchases. DOD has identified several instances involving the fraudulent

use of government purchase cards.

During fiscal year 2000, Education employees made over $8 million in

purchases using their government purchase cards. Without proper review

and approval for these expenditures, the Department provides employees

the opportunity to improperly use the government charge cards without

detection.
Page 9 GAO-01-585T

Sound internal controls also include creating and maintaining adequate

documentation providing a means to trace transactions back to their

origination – in other words, generating “audit trails.” While audit trails are

essential to auditors and system evaluators, they are also necessary for

day-to-day operation of the system because they allow for the detection

and systematic correction of errors that arise. The Joint Financial

Management Improvement Program’s4 Core Financial System

Requirements state that federal financial systems must provide certain

crucial audit trails, including trails to identify document input, change,

approval, and deletions by originator.

Education refers to some of its audit trails as “trigger logs.” For some

payments, Education has a trigger log for documenting changes made to

sensitive records, such as bank account routing numbers and payment

histories for grants and administrative payments to schools. However, the

Department lacks adequate trigger logs for other types of payments,

including payments for contracting, third party drafts, and purchase cards,

which according to Education totaled about $2 billion in fiscal year 2000.

 4JFMIP is a joint cooperative undertaking of the Office of Management and Budget, the Department of

the Treasury, the Office of Personnel Management, and the General Accounting Office working with

operating agencies to improve financial management practices through the government. Agencies

must follow JFMIP’s federal financial management systems requirements in order to meet the

requirements of the Federal Financial Management Improvement Act of 1996.

Inadequate Audit

Trails
Page 10 GAO-01-585T

For example, changing a payee’s mailing address or adding new vendors to

the list of authorized vendors are sensitive transactions that must be

closely controlled. Education officials acknowledged this weakness and

told us that they are currently developing and implementing more effective

controls.

Rapid advances in information technology have highlighted the

importance of internal controls related to modern computer systems. We

have reported information systems security as a governmentwide high-risk

area since 1997, most recently in January 2001.5 In the past, the Education

IG and Ernst & Young have reported serious information systems

weaknesses. Later in my testimony I will highlight the information

systems weaknesses Ernst & Young reported as part of the fiscal year 2000

financial statement audit. The Department places significant reliance on its

automated systems to perform basic functions, such as making payments

to grantees and maintaining budget controls. Consequently, continued

weaknesses in information systems controls increases the risk of

unauthorized access or disruption in services and make Education’s

sensitive grant and loan data vulnerable to inadvertent or deliberate

 5 Major Management Challenges and Program Risks: A Governmentwide Perspective, (GAO-01-241,

January 2001).

Inadequate

Information Systems’

Application Controls
Page 11 GAO-01-585T

misuse, fraudulent use, improper disclosure, or destruction, which could

occur without being detected.

As part of our ongoing review, we identified control weaknesses related to

the automated payment system’s computer applications. As discussed in

our Internal Control Standards, computer application controls help ensure

that transactions completed through computerized applications are valid,

properly authorized, and completely and accurately processed and

reported. Application controls include (1) programmed control techniques,

such as automated edits, and (2) manual follow-up of computer-generated

reports, such as reviews of reports identifying rejected or unusual items.

One such application control in Education’s system is an edit indicating

that an invoice number had already been entered into the system, which is

designed to avoid duplicate payments. However, our review of one of

Education’s procedure manuals disclosed that the Department has created

a procedure that allows employees to circumvent this control. This manual

instructs Education employees to add a suffix to the invoice/voucher

number when the system indicates that an invoice number has already

been used. For example, if invoice number 123 has already been entered

into the system, an employee can add the letter “a” to this invoice number

and issue another third party draft or other payment mechanism related to

the invoice.
Page 12 GAO-01-585T

During our work, we found that it is common practice for Education

employees to use multiple third party drafts to pay for purchases in excess

of the $10,000 limit imprinted on the blank drafts. Education officials told

us that they use multiple third party drafts to pay invoices greater than

$10,000 primarily as a matter of convenience. For example, when it is

necessary to research a transaction, Education officials told us that it is

more convenient to have their own check numbers and copies of the

checks on hand rather than having to review records of payments from

Treasury. This process of circumventing a key control, combined with the

lack of segregation of duties I described earlier, further exacerbates

Education’s vulnerability to making improper payments. In addition, this

negates the control of limiting third party drafts to $10,000.

Another example of an application control weakness at Education is the

Department’s failure to use computer generated management reports that

are currently available. For instance, Bank of America, Education’s

contractor for government purchase cards, provides several management

reports for monitoring the card’s usage. One report that we reviewed

showed the Merchant Category Codes 6 (MCC) used by each cardholder.

Approving officials could use this report to identify unusual or

 6The Merchant Category Code relates to the types of supplies or services that a vendor provides. The

MCC for the Government Purchase Card consists of 11 retail categories. Agencies have the ability to

prohibit cardholders from purchasing certain supplies or services by blocking specific MCCs.
Page 13 GAO-01-585T

unauthorized purchases. For instance, if a cardholder used his or her

government purchase card to obtain a cash advance, which is prohibited

by Education’s policies, the MCC for this type of transaction would appear

on the report next to the cardholder’s name. Further, Bank of America can

block specific MCCs to prohibit certain types of charges that are clearly

not business related such as purchases from amusement parks and movie

theaters. However, Education officials told us that they do not use this

control because the Department relies on Approving Official’s review of

the cardholder’s purchases.

The fact that Education does not review MCCs as a check on cardholder

transactions or block certain MCCs, is particularly significant given the

inconsistent supervisory review and the inherent risk of fraud and abuse

associated with of credit card purchases. Together, they mean that

Education is not using preventive measures at its disposal – through the

review of MCC codes or the blocking of certain purchases – or detective

measures – the review and approval of purchases. Thus, the risk of

improper payments is substantially increased.
Page 14 GAO-01-585T

Education’s fiscal year 2000 audited financial statements were issued on

January 26, 2001, before the March 1, 2001, deadline, and Ernst & Young’s

opinion on the financial statements improved over that of fiscal year 1999.

Ernst & Young issued a qualified opinion7 on all five of the fiscal year 2000

required financial statements. For fiscal year 1999, Ernst & Young issued

qualified opinions on four of Education’s financial statements and a

disclaimer8 on the Statement of Financing. Ernst & Young also reported

that Education continued to have serious internal control and financial

management systems weaknesses. Ernst & Young reported the following

reasons for the qualification of its audit opinion:

• During fiscal year 2000, significant financial management weaknesses

continued to impair Education’s ability to accumulate, analyze, and

present reliable financial information. Extensive manual adjustments

enabled Education to partially compensate for, but did not correct, certain

aspects of the material weaknesses in its financial reporting process.

• Education was unable to provide adequate documentation to support

certain amounts reported in net position included in the consolidated

 7Such an opinion is expressed when (1) there is a lack of sufficient competent evidential matter or

there are restrictions on the scope of the audit that have led the auditor to conclude that he or she

cannot express an unqualified opinion and he or she has concluded not to disclaim an opinion or

(2) the auditor believes, on the basis of his or her audit, that the financial statements contain a

departure from generally accepted accounting principles, the effect of which is material, and he or she

has concluded not to express an adverse opinion.

8A disclaimer of opinion is expressed when the auditor is unable to obtain satisfaction that the

financial statement is fairly presented and does not express an opinion.

Fiscal Year 2000

Financial Statement

Audit
Page 15 GAO-01-585T

balance sheet, and Ernst & Young was unable to perform other audit

procedures to satisfy themselves that the net position amount was correct.

• Education inconsistently processed certain transactions related to prior

years as fiscal year 2000 activity and was unable to provide Ernst & Young

with adequate documentation that these manual transactions were

properly reflected in the appropriate period.

In addition, Ernst & Young’s report on internal controls for fiscal year 2000

included three material internal control weaknesses9—all long-standing

from prior years. For the purposes of financial statement preparation,

internal controls are to provide reasonable assurance that the financial

results reported are reliable, the agency is in compliance with laws and

regulations, and performance reporting is reliable. When the design of

internal controls is weak, errors, fraud, or noncompliance with laws and

regulations may occur that elevate the weakness to a material internal

control weakness.

The specific material internal control weaknesses cited by Ernst & Young

for fiscal year 2000 were (1) weaknesses in the financial reporting process,

(2) inadequate reconciliations of financial accounting records, and

 9A material internal control weakness is used to describe a condition where an agency’s internal

controls do not reduce to a relatively low level the risk that errors, fraud, or noncompliance involving

significant amounts may occur and may not be detected within a timely period by employees in the

normal course of performing their assigned functions.
Page 16 GAO-01-585T

(3) inadequate controls over information systems. Specifically, Ernst &

Young reported that:

• Education did not have adequate internal controls over its financial

reporting process. Its general ledger system was not able to directly

produce consolidated financial statements as would normally be expected

from such systems. Because of this weakness, Education once again had

to resort to a costly, labor-intensive, and time- consuming process

involving manual and automated procedures to prepare financial

statements for fiscal year 2000 as it had in previous years.

• Again, similar to previous years, Education did not properly or promptly

reconcile its financial accounting records throughout fiscal year 2000 and

could not provide sufficient documentation to support some of its

financial transactions, specifically entries to correct prior year errors. In

some instances, Education adjusted its general ledger to reflect the

balance in its subsidiary records, without sufficiently researching the

cause for differences.

• Furthermore, Education was not able to identify and resolve differences

between its accounting records and cash transactions reported by the

Treasury for the past several years. Reconciling agencies’ accounting

records with relevant Treasury records is required by Treasury policy and

is analogous to individuals reconciling their checkbooks to monthly bank
Page 17 GAO-01-585T

statements. Because most assets, liabilities, revenues, and expenses stem

from or result in cash transactions, errors in the receipt or payment data

affect the accuracy of the individual agency financial reports and various

U.S. government financial reports, including data provided by agencies for

inclusion in the President’s Budget concerning fiscal year outlays. Further,

the lack of effective reconciliations increases the risk of fraud, waste,

abuse, and mismanagement of government funds.

• Ernst & Young’s report discussed the seriousness of Education’s computer

systems weaknesses. Ernst & Young found that Education had not

completed its corrective action plan to ensure that all mission critical

systems had adequate security plans and that corrective actions were

taken to mitigate known exposures. Additionally, Education had

information systems control deficiencies in (1) monitoring and reviewing

access to sensitive computer resources, (2) implementing a system

software change management process, and (3) developing and testing a

comprehensive disaster recovery plan to ensure the continuity of critical

system operations in the event of disaster.

As a result, it took a lot of hard work by Education staff and costs for

contractor assistance to develop the information needed for financial

statements that were issued 4 months after the end of the fiscal year;

information that should be but is not routinely available. Education needs
Page 18 GAO-01-585T

to be able to generate reliable, useful, and timely information on an

ongoing basis to ensure adequate accountability to taxpayers, manage for

results, and help program and congressional decisionmakers make timely,

well-informed judgements for day-to-day management and oversight. This

is what the Congress was seeking when it enacted the Chief Financial

Officers Act of 1990 and other financial reform legislation. While an

unqualified audit opinion is an important milestone, it is not the end goal.

Obtaining an unqualified audit opinion must be combined with sustained

efforts to improve underlying financial management systems and controls.

As the Comptroller General testified on March 30, 2001,10 if agencies (such

as Education) continue year after year to rely on significant, costly and

time-intensive manual efforts to achieve or maintain unqualified opinions

without such improvements, it can serve to mislead the Congress and the

public as to the true status of agencies’ financial management capabilities.

In such a case, an unqualified opinion would become an accomplishment

without much substance. As we look ahead, it will be essential for

Education to strengthen its financial reporting to make more meaningful

information available to the Congress, other policymakers, and the

American public.

 10 U.S. Government Financial Statements: FY 2000 Reporting Underscores the Need to Accelerate

Federal Financial Management Reform (GAO-01-570T, March 30, 2001).
Page 19 GAO-01-585T

To summarize, internal control and financial management weaknesses at

Education are not new. Last year we testified three times about the

financial management challenges faced by Education and the need to

eliminate internal control weaknesses to reduce the potential for fraud,

waste, and abuse at the Department11 and Ernst & Young and the IG have

reported serious internal control problems. Our ongoing work is showing

that Education in several cases is not taking advantage of available means

to use or improve its controls over the review, approval, issuance and

recording of payments. In addition, the most recent financial statement

audit disclosed continuing serious weaknesses over (1) the financial

reporting process, (2) inadequate reconciliations of financial accounting

records, and (3) inadequate controls over information systems. Until

Education is able to correct its serious internal control and system

deficiencies, it will be hindered in its ability to achieve lasting financial

management improvements. As a result, it will continue to face an

increased risk of improper payments.

In the next phase of our work, we will be employing various computerized

techniques, referred to as “forensic auditing” techniques, to identify data
Page 20 GAO-01-585T

anomalies that may be indicative of improper payments. These techniques

include data base searches, file comparisons and computer matches, and

other analyses to identify unusual transactions and unusual payment

patterns. Using this approach we can identify questionable payments – for

example payments to closed schools or to individuals with invalid social

security numbers. We will research and, as needed, investigate any

questionable payments to determine whether they represent simple data

errors or are in fact improper payments or even fraud. We will be in a

position to report to you on the results of this work sometime this

summer.

In closing, Mr. Chairman, I want to underscore the importance of

Education’s top management giving priority to (1) addressing the

problems preventing the auditors from being able to express an

unqualified opinion on Education’s financial statements, (2) having

effective internal control, and (3) modernizing financial management

systems.

Finally, I want to reiterate the value of sustained Congressional interest in

these issues, as demonstrated by this hearing and those you have held in

the past to oversee financial management reform at Education. Your work

 11Financial Management: Education Faces Challenges in Achieving Financial Management Reform

(GAO/T-AIMD-00-106, March 1, 2000), Financial Management: Education’s Financial Management

Problems Persist (GAO/T-AIMD-00-180, May 24, 2000), and Financial Management: Financial

Management Challenges Remain at the Department of Education (GAO/T-00-AIMD-00-323,

September 19, 2000).
Page 21 GAO-01-585T

and that of the Committee over the past years to facilitate management

improvements at Education have been a catalyst to the progress we have

seen to date and will be critical to ultimately solving the Department’s

serious long-standing internal control and financial management systems

weaknesses.

Mr. Chairman, this concludes my statement. I would be happy to answer

any questions you or other Members of the Subcommittee may have.

For information about this statement, please contact Linda Calbom,

Director, Financial Management and Assurance, at (202) 512-9508 or at

calboml@gao.gov. Individuals making key contributions to this statement

include Dan Blair, Anh Dang, Bonnie Derby, Cheryl Driscoll, Cary Frye,

Kelly Lehr, Bonnie McEwan, Diane Morris, Brooke Whittaker, Doris

Yanger, and Maria Zacharias.

(190011)

Contact and

Acknowledgment
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs