Telecommunications: FCC Should Assess the Design of the E-rate Program's Internal Control Structure
Published: 2010-09-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since 1998, the Federal Communications Commission's (FCC) Schools and Libraries Universal Service Support Mechanism--commonly known as the "E-rate" program--has been a significant federal source of technology funding for schools and libraries. FCC designated the Universal Service Administrative Company (USAC) to administer the program. As requested, GAO examined the system of internal controls in place to safeguard E-rate program resources. This report discusses (1) the internal controls FCC and USAC have established and (2) whether the design of E-rate's internal control structure appropriately considers program risks. GAO reviewed the program's key internal controls, risk assessments, and policies and procedures; assessed the design of the internal control structure against federal standards for internal control; and interviewed FCC and USAC officials.
section_title: What GAO Found
paragraphs: FCC and USAC have established many internal controls for the E-rate program's core processes: (1) processing applications and making funding commitment decisions, (2) processing invoices requesting reimbursement, and (3) monitoring the effectiveness of internal controls though audits of schools and libraries that receive E-rate funding (beneficiaries). E-rate's internal control structure centers around USAC's complex, multilayered application review process. USAC has expanded the program's internal control structure over time to address the program's complexity and to address risks as they became apparent. In addition, USAC has contracted with independent public accountants to audit beneficiaries to identify and report beneficiary noncompliance with program rules. The design of E-rate's internal control structure may not appropriately consider program risks. GAO found, for example, that USAC's application review process incorporates a number of different types and levels of reviews, but that it was not clear whether this design was effectively and efficiently targeting resources to risks. Similarly, GAO found no controls in place to periodically check the accuracy of USAC's automated invoice review process, again making it unclear whether resources are appropriately aligned with risks. While USAC has expanded and adjusted its internal control procedures, it has never conducted a robust risk assessment of the E-rate program's core processes, although it has conducted risk assessments for other purposes, such as financial reporting. A risk assessment involving a critical examination of the entire E-rate program could help determine whether modifications to business practices and the internal control structure are needed to appropriately address the risks identified and better align program resources to risks. The internal control structure--once assessed and possibly adjusted on the basis of the results of a robust risk assessment--should then be periodically monitored to ensure that the control structure does not evolve in a way that fails to appropriately align resources to risks. The results of beneficiary audits are used to identify and report on E-rate compliance issues, but GAO found that the information gathered from the audits has not been effectively used to assess and modify the E-rate program's internal controls. As a result, the same rule violations have been repeated each year for which beneficiary audits have been completed. For example, of 64 beneficiaries that had been audited more than once over a 3-year period, GAO found that 36 had repeat audit findings of the same rule violation. GAO found that the current beneficiary audit process lacks documented and approved policies and procedures. Without such policies and procedures, management may not have the assurance that control activities are appropriate and properly applied. Documented and approved policies and procedures could contribute positively to a systematic process for considering beneficiary audit findings when assessing the E-rate program's internal controls and in identifying opportunities to modify existing controls.
section_title: What GAO Recommends
paragraphs: GAO recommends that FCC conduct a robust risk assessment of the E-rate program, conduct a thorough examination of the overall design of E-rate's internal control structure, implement a systematic process to assess internal controls that appropriately considers beneficiary audit findings, and establish procedures to periodically monitor controls. FCC agreed with GAO's recommendations.

section_title: Letter
paragraphs: Since 1998, the Federal Communications Commission’s (FCC) Schools and  Libraries Universal Service Support Mechanism—commonly known as the  “E-rate” program—has been a significant federal source of technology  funding for schools and libraries across the nation. Specifically, the E-rate  program provides about $2 billion each year toward telecommunications  services, Internet access, and data transmission wiring and components  used for educational purposes. Schools and libraries apply each year for E- rate funding. Once an application is approved, the program reimburses a  discounted portion of the cost of services or equipment. FCC designated  the Universal Service Administrative Company (USAC), a not-for-profit  corporation, to administer the E-rate program. USAC uses a  subcontractor, Solix, Inc., a for-profit company, to carry out certain key  aspects of the program, such as reviewing and approving funding  applications and invoices.
In the 13 years since FCC established the E-rate program, some instances  of waste, fraud, and abuse on the part of program participants have come  to light as a result of whistleblowers, audits, and criminal investigations,  and a small number of E-rate participants have been convicted of  defrauding the program. Historically, requests for E-rate discounts have  exceeded the amount of funding available; thus, any excess payments to  participants due to error, waste, fraud, or abuse represent funds that  would otherwise have gone to eligible entities seeking support. Internal  controls—that is, the plans, methods, and procedures that an entity puts in  place to reduce the risk that a program will not achieve its goals and  objectives—serve as the first line of defense in safeguarding program  resources. In this context, you asked us to examine the system of internal  controls in place for the E-rate program. This report addresses the  following questions: (1) What actions have FCC and USAC taken to  establish internal controls in the E-rate program? (2) Does the design of  the E-rate program’s internal control structure appropriately consider  program risks?
To answer these questions, we reviewed previous reports and studies of  the E-rate program, including GAO reports and FCC Inspector General  reports. We also reviewed legislation, regulations, FCC orders, and  guidance pertaining to the E-rate program. We reviewed documentation of  the program’s key internal controls and risk assessments, and related  policies and procedures. Specifically, we reviewed the design of the  program’s key internal controls for (1) processing applications and making  funding commitment decisions, (2) processing invoices requesting  reimbursement, and (3) monitoring the effectiveness of internal controls  through audits of schools and libraries. We assessed the design of these  internal controls against GAO’s Standards for Internal Control in the  Federal Government. We spoke with FCC, USAC, and Solix officials  about program risks, the design and functioning of internal controls, and  how internal controls are monitored and assessed. We also spoke with  FCC and USAC officials about their audit processes and about audits of  schools and libraries performed from 2006 to 2010. We obtained data from  USAC on the results of its application and invoice review processes and  audits. We met with experts at USAC and Solix to update our prior assessments of the data systems and determined that the data obtained from USAC were sufficiently reliable for the purposes of our review. Se e  appendix I for additional information on our scope and methodology.
We conducted this performance audit from August 2009 to September 2010  in accordance with generally accepted government auditing standards.  These standards require that we plan and perform the audit to obtain  sufficient appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The E-rate program provides eligible schools, school districts, libraries,  and consortia with discounts on telecommunications services, Internet  access, and data transmission wiring and components used for  educational purposes. The program is funded through statutorily  mandated payments into the Universal Service Fund by companies that  provide interstate and international telecommunications services. Many  ir  of these companies, in turn, pass on their contribution costs to the subscribers through a line item on subscribers’ telephone bills. FCC  capped funding for E-rate at $2.25 billion per year, and program funds are  used to cover the program’s administrative costs, including the  administrative services performed by USAC and Solix. Eligible schools  and libraries may apply annually for program support and will qualify for a  discount of 20 to 90 percent on the cost of eligible services, based on  indicators of need. Based on the broad direction in the  Telecommunications Act of 1996, FCC defined two general types of  services that are eligible for E-rate discounts:    Priority 1 services include telecommunications services, such as local,  long-distance, and wireless (e.g., cellular) telephone services, as well as  data links (e.g., T-1 lines) and Internet access services, such as Web  hosting and e-mail services—all of which receive first priority for the  available funds under FCC’s rules.
Priority 2 services include the cabling, components, routers, switches, and  network servers that are necessary to transport information to individual  classrooms, public rooms in a library, or eligible administrative areas, as  well as basic maintenance of internal connections, such as the repair and  upkeep of eligible hardware and basic technical support.
USAC annually updates a list of specific, eligible products and services  and the conditions under which they are eligible. The list is finalized by  FCC after a public comment period and posted on USAC’s Web site.  Items ineligible for E-rate discounts include, among other things, end-user  products and services, such as Internet content; Web-site content  maintenance fees; end-user personal computers; and end-user software.
FCC delegated to USAC the day-to-day administration of the E-rate  program, subject to FCC rules and under FCC oversight. USAC has, in  turn, subcontracted certain key aspects of E-rate program operations to  Solix. The primary responsibilities of Solix staff include reviewing  applications and processing invoices for reimbursement. About 20,000  schools and libraries applied for E-rate support in 2009, although Solix  processes about 40,000 applications per funding year because schools and  libraries can submit multiple applications in a single funding year (e.g., an  applicant can submit separate applications for Priority 1 and Priority 2  services). The process for participating in the E-rate program, which is  lengthy and complicated, is summarized in the following four main steps:  1.  The applicant submits to USAC a description of the services for which  the applicant is requesting a discount so that service providers (i.e.,  telecommunications companies or equipment providers) can bid  through open competition. The applicant must also confirm that it has  developed an approved technology plan that provides details on how it  intends to integrate technology into its educational goals and curricula,  as well as how it will pay for the costs of acquiring and maintaining the  technology. 2.  Once the service description has been available to potential bidders for  28 days, the applicant selects the most cost-effective service provider  from the bids received and submits a Form 471 (Description of  Services Ordered and Certification) application for the discounted  service, which is processed by Solix. The applicant then calculates its  discount level, certifies that it is an eligible entity, and certifies that it  will abide by applicable laws and regulations. 3.  Solix reviews the application and issues a funding commitment  decision letter to the applicant and selected service provider. The  decision letter indicates whether the application has been approved or  denied.  4.  If approved, the applicant—now a beneficiary—must confirm that  services have started or have been delivered. After the service provider  has submitted a bill, either the beneficiary or the service provider  submits a reimbursement request form for Solix to process. The  beneficiary or service provider can then be compensated from the  Universal Service Fund for the discounted portion of the services.
See appendix II for an overview of the E-rate program application, invoice,  and reimbursement processes.
A memorandum of understanding (MOU) between FCC and USAC assigns  USAC the responsibility for implementing effective internal controls over  the operation of the E-rate program. Through the MOU, FCC directed  USAC to implement an internal control structure for the E-rate program  that is consistent with the standards and guidance contained in the Office  of Management and Budget’s (OMB) Circular No. A-123, Management’s  Responsibility for Internal Control, including a methodology for  assessing, documenting, and reporting on internal controls. In February  2008, USAC engaged an independent public accounting firm to assist in  establishing a formal internal control review program. USAC placed  responsibility for implementing this program under the direction of a  senior manager of internal controls, a position it created in late 2008.  USAC also created a Senior Management Council to support the  implementation of the program. Under the MOU, USAC is also  responsible for periodically reporting on its internal control activities to  FCC’s Office of Managing Director and Office of Inspector General.
FCC also directed USAC to implement a comprehensive audit program to  (1) ensure that Universal Service Fund monies are used for their intended  purposes; (2) ensure that all Universal Service Fund contributors make the  appropriate contributions in accordance with FCC rules; and (3) detect  and deter potential waste, fraud, and abuse. To ensure compliance with  FCC rules, USAC has periodically selected beneficiaries to audit. USAC  also has conducted audits that were used to develop statistical estimates  of error rates under the Improper Payments Information Act of 2002  (IPIA). From 2001 through 2006, USAC and other auditors conducted  approximately 350 audits of E-rate program beneficiaries as part of the  oversight of the E-rate program. Since 2006, USAC has conducted  approximately 760 audits for both oversight and IPIA purposes. USAC is  responsible for responding to the results of findings from audits of  program beneficiaries, including recommendations to recover funds that  may have been improperly disbursed to beneficiaries.
We have produced a number of E-rate reports since the program was  implemented in 1998, some of which addressed internal controls. In 2000,  we reported that the application and invoice review procedures needed  strengthening and made recommendations to improve internal control  processes. In response to our recommendations and the findings of other  parties that have reviewed USAC’s processes, such as the FCC Inspector  General, USAC has implemented a number of internal controls. In 2005,  we reported that FCC had been slow to address problems raised by audit  findings and had not made full use of the audit findings as a means to  understand and resolve problems within the program. During the course  of our work, in 2004, FCC concluded that a standardized, uniform process  for resolving audit findings was necessary and directed USAC to submit to  FCC a proposal for resolving all audit findings and recommendations. FCC  also instructed USAC to specify deadlines in its proposals “to ensure audit  findings are resolved in a timely manner.” USAC submitted its Proposed  Audit Resolution Plan to FCC in October 2004. Although FCC has not  formally approved the plan, since 2004 it has periodically issued directives  and guidance to USAC to clarify aspects of the plan’s design and  implementation. A number of our reports have also found that the E-rate  program lacks performance goals and measures, and we have  recommended that FCC define annual, outcome-oriented performance  goals for the program that are linked to its overarching goal of providing  services to schools and libraries. While FCC has undertaken various  efforts to address this recommendation, it has not yet established  meaningful goals and performance measures for the E-rate program.
In our 2009 E-rate report, we found that some nonparticipating schools  and libraries elected not to apply to the program because they considered  the process to be too burdensome (e.g., too complex, time-consuming, or  resource-intensive). We also found that a substantial amount of funding  was denied because applicants did not correctly carry out application  procedures. In March 2010, an FCC task force released a National  Broadband Plan that acknowledges the complexity inherent in the E-rate  program and recommends, among other things, that FCC streamline the  application process. For example, the National Broadband Plan notes  that E-rate’s procedural complexities can sometimes result in applicant  mistakes and unnecessary administrative costs as well as deter eligible  entities from applying. In the National Broadband Plan, the task force  suggests that FCC can ease the burden on applicants for Priority 1 services  that enter into multiyear contracts, and that applications for small  amounts could be streamlined with a simplified application similar to the  “1040EZ” form the Internal Revenue Service makes available to qualifying  taxpayers. In May 2010, as part of its efforts to begin implementing the  vision of the National Broadband Plan, FCC released a Notice of Proposed  Rulemaking (NPRM) to solicit comments about potential changes to the   E-rate program. FCC stated in the NPRM that it is time to reexamine  what is working well in the current program and what can be improved On September 23, 2010, FCC adopted an order (the order had not yet been  released at the time our report was issued) in response to the May 2010  NPRM. According to FCC’s press release, the order improves the ability of  schools and libraries to connect to the Internet in the most cost-effective  way, allows schools to provide Internet access to the local community  after school hours, indexes the E-rate funding cap to inflation, and  streamlines the E-rate application process.   .
section_title: FCC and USAC Have Put Many Internal Controls in Place for the E-rate Program
paragraphs: According to GAO’s standards for internal control, “control activities” are  an integral part of an entity’s planning, implementing, reviewing, and  accountability for stewardship of government resources and achieving  effective results. Control activities are the policies, procedures,  techniques, and mechanisms that enforce management’s directives and  help ensure that actions are taken to reasonably address program risks.  For our review of the design of E-rate’s internal control structure, we  classified the control activities into three broad areas: (1) processing  applications for discounted service and making funding commitment  decisions, (2) processing invoices requesting reimbursement, and (3)  monitoring the effectiveness of internal controls through audits of schools  and libraries. We found that FCC and USAC have established a number of  internal controls in each of these three areas.
subsections: section_title: Processing Applications and Making Funding Commitment Decisions
paragraphs: E-rate’s internal control structure centers around USAC’s complex,  multilayered, Program Integrity Assurance (PIA) application review  process. This process entails the specific internal controls that are applied  to applications as they undergo the initial review for eligibility as well as a  layered review process to ensure that the initial review was conducted  appropriately and that the correct funding decision was reached. As  applicants submit their Form 471 applications for discounted service,  Solix assigns each applicant to a PIA reviewer who examines the form.  USAC’s funding year 2009 PIA Form 471 Review Procedures manual  contains approximately 700 pages of detailed instructions and flowcharts  for Solix’s PIA reviewers to follow in addressing the various parts of the  Form 471. The procedures are meant to ensure that the applicant, service  provider, and requested services are eligible under the program, and that  the applicant is in compliance with all of the E-rate rules. For example:    To verify that an applicant is eligible for the program, the manual directs  the PIA reviewer through a potential 39-step process that involves  confirming information about the applicant either through USAC- approved, third-party sources or by contacting the applicant directly for  documentation to support eligibility. To verify that the service provider is  eligible to provide telecommunications services for the program, the  reviewer is to determine that FCC has registered the service provider as an  approved telecommunications provider.
As a part of verifying that an applicant’s requested discount rate is  accurate, the automated application system will trigger an “exception” if  the discount rate on the application meets certain conditions. The manual  provides instructions to the reviewer on what procedures to follow to  verify that the discount rate is appropriate.
To verify that the requested services are eligible for E-rate funding, the  reviewer is to determine whether products and services requested in an  application for discount qualify for support. This determination can be  based on the categorization and information in FCC’s annual Eligible  Services List, a more detailed list of specific equipment that USAC  maintains, or consultation with a team of Solix technical experts.
In addition to the specific internal control procedures that are part of the  initial PIA review, USAC maintains a multilevel application review process  as part of its internal control structure. Figure 1 illustrates the E-rate  application review process.
Over time, USAC has expanded its application review process by adding  more types of reviews—such as “cost-effectiveness” and “special  compliance” reviews—to address specific risks. The PIA initial and final  reviews, selective reviews, and quality assurance reviews were  components of the original application review process and are still part of  the current internal control structure. Solix staff perform these reviews.  USAC staff then follow up with an independent quality assurance review  process for each of the other types of reviews.
Regular PIA Review: As part of the multilevel process, all applications  undergo an initial review and a separate final review. The PIA process is  partially automated but involves a significant amount of manual review as  well. Issues that are identified as potential errors or violations of program  rules, either in the automated system or by manual review, trigger  exceptions that are addressed by the Solix initial reviewer. The PIA  process can trigger dozens of different types of exceptions, each  representing a potential type of error or issue within an application that  must be resolved before reaching a funding decision. After the initial  review is completed, a final review is conducted by a more experienced  reviewer. If the final reviewer finds an error by the initial reviewer, the  application is returned to the initial reviewer for further work. As part of  the regular PIA review process, after final reviews, a portion of the  applications that are ready for commitment is then sampled by the Solix  Quality Assurance Team. If the Solix quality assurance reviewer finds an  error or issue during the review, the reviewer returns the application to  the initial reviewer to address the issue. Finally, USAC conducts  independent quality assurance reviews. For these reviews, USAC staff  select a sample of applications for review, including some that were  selected for Solix’s quality assurance review, to determine the accuracy of  the application review process. Like the Solix quality assurance reviewer,  USAC staff return the application back to the appropriate reviewer for  further review if they discover an issue or error.
Selective Review: High-risk applications, identified through either  automated aspects of the PIA system or by a PIA reviewer, undergo an  additional, more detailed review from Solix’s selective review team. The  selective review team obtains additional information from the applicant  and uses that information to help determine eligibility for E-rate funding.  Applications meeting certain criteria may also go through other reviews by  the selective review team. For example, the selective review team reviews  applications from consortia of schools and libraries to determine whether  members of the consortia are aware of their financial obligations to  participate in the program, or examines applications from private schools  to ensure that they do not have endowments exceeding $50 million, which  would make them ineligible for E-rate funding under the statute.  Applications that undergo selective reviews are also subject to final  reviews and may be selected for Solix and USAC quality assurance  reviews.
Since the PIA review process was implemented, USAC has expanded the  process in response to internal control concerns. In addition to selective  reviews, USAC has implemented “special compliance” and “cost- effectiveness” reviews. Special compliance reviews, established in 1999,  are tailored to address specific issues and allegations, many of which  originate outside of the PIA application review process, such as from the  Whistleblower Hotline, FCC Office of Inspector General audits, law  enforcement investigations, and press reports. These reviews are  performed by a separate team, similar to the selective review team, and  constitute the additional heightened scrutiny review process that  supplements the regular PIA review process. USAC created the cost- effectiveness review team in 2005 as a separate team within the PIA review  team in response to an FCC order directing USAC to reduce fraud, waste,  and abuse. In the order, FCC also sought comments on the benefits of  establishing benchmarks to determine whether a service requested under  the E-rate program is cost-effective, as defined by program requirements.  In response, USAC developed cost benchmarks for eligible products and  services. The cost-effectiveness team reviews applications that have been  flagged by the PIA review process as exceeding these cost benchmarks.  Some applications are reviewed by more than one of these teams. For  example, the special compliance team may determine that a review by the  cost-effectiveness team or the selective review team will best address  specific issues of concern in an application.
section_title: Processing Invoices Requesting Reimbursement
paragraphs: Much of the E-rate invoice review process is automated and incorporates  steps to help ensure accuracy. The invoice forms that beneficiaries and  service providers file contain general information about the funding  request, such as the application and funding request number for which  they are seeking reimbursement, the billing frequency and billing date, the  date of service delivery, and the discounted amount billed to USAC. Both  the beneficiary and the service provider must certify on their forms that  the information they are providing is accurate. When an invoice is filed,  Solix runs nightly systemic checks of the individual lines on the invoice  using an automated validation process that compares the information in  the invoice line with the information in the system for the associated  funding request. The automated process triggered an average of 166 edit  checks from calendar years 2006 through 2009 that served to approve an  invoice line for full or partial payment, reject the invoice line, or send the  invoice line for a manual review. Similar to the PIA application review  process, the manual review process for an invoice line includes an initial  and final review from Solix staff, and can be selected for a Solix quality  assurance review and a USAC quality check before a final payment  decision. A completed invoice line—an invoice line for which Solix has  either approved or denied payment—is forwarded to USAC for final  approval. Once the line item is approved, USAC generates a payment to  the service provider. Figure 2 illustrates the E-rate invoicing process.
See appendix IV for more information about the USAC and Solix staffing  resources dedicated to E-rate application and invoice reviews.
section_title: Monitoring the Effectiveness of Internal Controls through Audits of Schools and Libraries
paragraphs: USAC contracted with independent public accountants from 2006 to 2009  to perform audits used to estimate, under IPIA, the amount of improper  payments that are made to program beneficiaries. These audits also were  used to test compliance with program eligibility requirements and program  rules. The beneficiary audit process has four phases—audit performance,  audit resolution, audit response, and audit follow-up (see fig. 3).
During the audit response and audit follow-up phases, USAC provides  periodic reports to its Board of Directors, FCC, and the FCC Inspector  General on the status of audit findings and corrective and recovery  actions. For example, USAC prepares a monthly report on the status of all  monetary and nonmonetary audit findings and a semiannual report on the  status of all audit recoveries. According to USAC officials, USAC created a  Performance Assessment and Reporting unit in January 2009 that has,  among other things, developed an audit process that uses the results of  beneficiary audits to evaluate and report on whether schools and libraries  have complied with E-rate program requirements and to estimate the  amount of improper payments.
section_title: Design of E-rate’s Internal Control Structure May Not Appropriately Consider Program Risks
paragraphs: The overall design of the E-rate program is complex, and FCC’s changes to  the program over time through orders and guidance have made it more so.  This increasing complexity, in turn, has led USAC to expand the E-rate  program’s internal control structure over time to address program  complexity and to address risks to the program as they became apparent.  Although USAC has performed financial reporting and fraud risk  assessments, USAC has not conducted a robust risk assessment of the E- rate program and, consequently, may not be efficiently using its resources  to reasonably target program risks.
subsections: section_title: E-rate Program Lacks Meaningful Goals and a Robust Risk Assessment
paragraphs: In July 1998, we testified before the Senate Committee on Commerce,  Science, and Transportation about the implementation of the E-rate  program and recommended that FCC develop goals, measures, and  performance targets for E-rate. We have continued to note FCC’s lack of  goals and adequate performance measures for E-rate for more than a  decade. Most recently, we recommended in our March 2009 report that  FCC review the purpose and structure of the E-rate program and prepare a  report to the appropriate congressional committees identifying FCC’s  strategic vision for the program. As we have previously mentioned, FCC  released an NPRM in May 2010 seeking comment on several proposed  reforms of the E-rate program but has not addressed our  recommendations regarding goals and performance measures or  identifying a strategic vision for the program. FCC’s lack of goals and  performance measures affects the internal control structure of the  program because, as set forth in GAO’s Standards for Internal Control in  the Federal Government, a precondition to risk assessment is the  establishment of clear, consistent agency objectives. When clear program  objectives are established up front, the internal control structure can then  be designed around the fundamental risk that program objectives will not  be met.
When we testified before the committee in 1998, we stated that USAC had  not finalized all of the necessary procedures and related internal controls  for E-rate, even though USAC was close to issuing the first funding  commitment letters. FCC had worked to quickly establish the E-rate  program so that schools and libraries could begin benefiting from the  program. However, this effort resulted in FCC establishing the program  without clear objectives and quickly designing an internal control  structure to help prevent and detect fraud, waste, and abuse. This internal  control structure, however, was not designed on the basis of a robust risk  assessment of the E-rate program.
To date, FCC has not conducted a robust risk assessment of the E-rate  program that is based on the program’s core processes and business  practices. Although USAC has undertaken several efforts to assess risk,  these efforts have been in relation to assessing risk for other purposes,  such as Universal Service Fund financial reporting, and not to assess risk  specifically in the E-rate program. Most recently, in February 2008, USAC  hired an independent public accounting firm to conduct an assessment of  USAC’s internal controls under OMB Circular No. A-123. However, the  2008 internal control review focused primarily on the Universal Service  Fund and on USAC’s internal controls regarding financial reporting, not  programmatic activities. The accounting firm that performed the review  made recommendations to USAC that included overall changes to USAC’s  administration of the Universal Service Fund and the other universal  service programs. Some of the accounting firm’s recommendations  specifically addressed the E-rate program. For example, the review  discussed the challenge that USAC encounters in overseeing Solix from a  remote location and made recommendations to enhance USAC’s  oversight of Solix’s operations. Although USAC took actions to address  the recommendations in the 2008 review, the review had not focused on  the overall internal control structure of the E-rate program. USAC officials  told us that its own internal controls team again assessed USAC’s controls  beginning in the fourth quarter of 2009. However, USAC officials noted  that the scope of the testing was similar to that conducted by the public  accounting firm in 2008. Consequently, USAC’s assessment, like that of the  public accounting firm, was performed in relation to Universal Service  Fund financial reporting—not to the overall internal control structure of  the E-rate program.
In addition to these activities, in 2009, USAC completed a fraud risk  assessment for FCC. The purpose of this assessment was to help USAC  managers and staff assess the adequacy of existing controls and determine  whether additional fraud countermeasures were required. As with the 2008  internal control review, the fraud risk assessment focused on the  Universal Service Fund as a whole, not on the E-rate program specifically,  although part of the review did examine E-rate program administration.  The review examined 24 control measures that were in place for the  program. The review determined that 4 of those control measures  addressed risks that were “moderate,” while 12 addressed risks that were  “low” and 8 that were “very low.” In addition, USAC’s Internal Audit  Division produced a risk register for the E-rate program that identified  risks; applied a “gross risk analysis”; noted the mitigating controls; and  then calculated the “residual risk,” given the mitigating controls.  According to documentation, the risk register was based on Internal Audit  Division interviews with USAC staff in 2008.
These various efforts to assess risk—that is, the 2008 review of internal  controls, USAC’s update of that review, and the fraud risk assessment— illustrate that FCC and USAC management are conscientious about having  an internal control structure in place that safeguards program funding and  resources. However, these prior efforts have not risen to the level of the  risk assessment that is intended under the GAO standards for internal  control. Ideally, under those standards, FCC would first establish clear  objectives for the E-rate program, and management would then  comprehensively identify risks to meeting those objectives. The  assessments undertaken to date, while important to proper stewardship of  government funds, have focused primarily on financial reporting  requirements and the specific internal controls that were already in place,  which have developed and evolved over time around the rules that govern  the program. To date, FCC has not directed USAC to undertake a robust  risk assessment that would involve a critical examination of the entire E- rate program to determine whether modifications to business practices  and internal controls are necessary to cost-effectively address  programmatic risks.
section_title: Internal Controls Have Grown Over Time, and Multiple Layers of Application Reviews May Not Effectively Target Risk
paragraphs: Lacking a robust risk assessment, USAC has responded to risks largely by  expanding the PIA process. The processes within these review levels have  grown increasingly complex, and it is unclear whether these reviews  appropriately target risk. For example, subjecting every application to  multiple layers of review may not be the most efficient or effective method  to address programmatic risks. As we have previously described, all  applications are subject to at least two reviews, the initial and final PIA  reviews. USAC implemented the final reviews, as well as the two levels of  quality assurance reviews, to find potential errors in the initial reviews and  assess the integrity of the PIA review process. However, we found large  discrepancies in the number of returns triggered by the final reviewer’s  evaluation of the initial reviewer’s actions in response to each exception.  One type of exception triggered final reviewers to return 4,722  applications to the initial reviewer during funding years 2006 through 2009.  This exception, which related to determining the eligibility of  telecommunications service, comprised 62 percent of all final review  returns during the period. At the same time, errors related to 13 other  exceptions were the source of either zero or 1 return by a final reviewer.  These data suggest that the design of the internal controls could be  inefficiently using resources. It may be possible to target the internal  controls toward applications that trigger exceptions that are more likely to  be returned by final reviewers and those that are more likely to trigger an  adjustment to an application’s eligibility or funding commitment.
The PIA review process has also become more complex in response to  USAC’s efforts to ensure that the applicant has complied with FCC rules as  they have changed and evolved. For example, each year, USAC or Solix  may propose to eliminate exceptions targeting issues that are no longer of  concern or add exceptions to the PIA review process to address new areas  of concern. However, from funding years 2006 through 2009, the total  number of exceptions in the PIA process grew from 67 to 84 (about a 25  percent increase). The increasing complexity of the review process is also  illustrated by the procedures involved in determining service and  equipment eligibility. USAC maintains a list of approved services and  equipment that are eligible for an E-rate discount. This list is based on  broader guidance that USAC posts annually for applicants. It has grown  from approximately 6,000 to 8,000 eligible items—about a 32 percent  increase from funding years 2006 through 2009. In addition, USAC has  developed a complex process to determine whether the services and  equipment requested in applications are eligible, conditionally eligible, or  partially eligible. For example, if a school with a 75 percent discount rate  applies for a piece of equipment that will only be used for eligible  purposes 60 percent of the time, then, under FCC rules, only 60 percent of  the cost of the equipment is eligible for a 75 percent discount. In  determining service and equipment eligibility, PIA reviewers rely on a  detailed list that includes guidance on the specific makes and models of  thousands of products. Solix has hired a small number of staff with  technical backgrounds to further assist PIA reviewers in resolving  technical questions about the eligibility of services or equipment.
This approach of adding controls to address risks as they become  apparent, or to address rule changes coming from FCC, leads to an  accretion of internal controls that affects the overall internal control  structure over time. While it is appropriate to respond to findings of risk  and add internal controls as the program progresses, FCC and USAC have  not done enough to proactively address internal controls or to step back  and examine how the internal control structure has evolved. Without  assessing risk and the internal control structure, USAC cannot be sure  whether it is appropriately allocating resources to reasonably target risks.
section_title: Automated Invoice Review Process May Not Appropriately Target Risk
paragraphs: The internal control structure around the E-rate invoicing process is more  limited than the structure around the application review process, but it is  again not clear that the controls in place appropriately target risks. For  example, there is no further review of the 91 percent of invoice lines—and  almost 60 percent of dollars requested—that pass through the automated  review process without further manual review (see table 1). According to  GAO’s internal control standards, control activities should be regularly  monitored to ensure that they are working as intended. However, there is  no process or procedure for confirming that Solix’s automated validation  process accurately reimburses providers and beneficiaries because USAC  does not have a process for conducting random accuracy checks of  completed invoice lines that have not been manually reviewed. These  payments are not compared with an actual bill of service, unless such a  comparison is done as part of a beneficiary audit. USAC officials  indicated that on occasion, they pull some automated final payment  determinations to verify their accuracy. However, USAC has no official  procedure or process in place requiring it to verify these data or to track  the results. Also, USAC officials could not determine how often or how  many invoices they pull for verification. Neither USAC nor Solix regularly  conducts random quality assurance checks of sample invoice lines that the  automated validation process has approved or rejected to help verify the  accuracy of the automated process. Therefore, there is no verification that  the items or services for which service providers or beneficiaries are  seeking reimbursement were actually included in the list of the items or  services Solix approved and committed to fund.
The invoice review process provides another opportunity, in addition to  the application review process, to identify whether the beneficiary has  requested reimbursement for eligible equipment and services. However,  the invoice review process closely examines only a limited number of  invoices to determine what services are being funded. Specifically, about 9  percent of invoice lines undergo a manual review; although, to USAC’s  credit, the manual reviews do appear to target risk by representing about  42 percent of dollars requested (see table 1). Invoice lines are generally  chosen for a special manual review because they are considered to be  “high risk.” A reviewer may determine that the manually reviewed invoice  lines be fully paid, partially paid, denied, or placed “on hold.” An invoice  is put on hold during a manual review either as a result of the procedures  for a specific type of review or as a result of instructions by the USAC or  Solix group requesting special review. Most of the edits that trigger an  invoice for manual review require that the reviewer obtain a copy of the  actual bill of service. All invoice lines that receive a manual review also  receive a secondary, final review. In addition, Solix and USAC sample  manually reviewed invoice lines for a quality assurance review prior to  payment. In response to our work, USAC stated in its comments on our  draft report that it has begun to develop a process to randomly sample  invoices that are only reviewed through the automated process. USAC  stated that it expects this process to supplement its new Payment Quality  Assurance program that was put in place in August 2010, which will  randomly test the accuracy of E-rate disbursements for the purpose of  estimating rates of improper payments.
We also found that USAC does not have a single document or procedures  manual that documents the invoice review process. Policies and  procedures are forms of controls that help to ensure that management’s  directives to mitigate risks are carried out. Control activities are essential  for proper stewardship and accountability for government resources and  for achieving effective and efficient program results. We requested an  invoice review procedures manual from USAC. USAC officials provided a  collection of stand-alone documents that each cover various parts of the  process and procedures. The numerous individual documents that USAC  officials provided in response to our request included descriptions of the  procedures a reviewer would follow to manually review an invoice line as  well as the procedures for a second or final review. We also obtained  descriptions of the automatic validation process and the Solix and USAC  quality assurance review procedures. USAC officials noted that the various  documents are housed electronically in a central location. However, the  documents being housed electronically in a central location differs from  the lengthy and detailed PIA procedures manual, which provides, in a  single document, an overview of the application review process as well as  detailed descriptions of activities a reviewer must follow to address a  specific exception. The procedures manual also goes on to explain the  multiple layers of the application review process. In response to our work,  USAC has stated that it plans to create a single manual that documents the  entire invoice review process.
section_title: Audit Findings Are Not Effectively Considered in Assessing Internal Controls of the E-rate Program
paragraphs: Although FCC and USAC use the results of beneficiary audits to identify  and report beneficiary noncompliance, they have not effectively used the  information gained from audits to assess and modify the E-rate program’s  internal controls. A systematic approach to considering the results of  beneficiary audits could help identify opportunities for improving internal  controls. Lessons learned from an analysis of audit results could, for  example, lead to modifications of the application and invoice approval  processes as well as modifications to the nature, extent, or scope of the  beneficiary audits. Furthermore, the audit process that USAC currently  uses is not governed by a set of documented and approved policies and  procedures. The process used is a combination of the procedures  contained in an audit resolution plan drafted in 2004 and other procedures  developed and implemented since 2004. GAO’s standards for internal  control provide that when identifying and assessing risks, management  should consider the findings from audits, the history of improper  payments, and the complexity of the program. These standards also state  that management should consider audit findings when assessing the  effectiveness of internal controls, including determining the extent to  which internal controls are being monitored, assessing whether  appropriate policies and procedures exist, and assessing whether they are  properly maintained and periodically updated.
We obtained information from USAC management on audits that had been  completed to identify how and to what extent the results of beneficiary  audits were considered in assessing internal controls for the E-rate  program. USAC officials provided us with management reports on the  results of E-rate beneficiary audits completed in 2006, 2007, and 2008.  These reports identified the nature and extent of beneficiary  noncompliance with E-rate requirements. However, the information did  not demonstrate whether USAC had identified and assessed the specific E- rate program risks and core causes of beneficiary noncompliance. USAC  officials also provided us with a list of suggested actions that could be  taken to prevent and reduce improper payments across all of the Universal  Service Fund programs, along with estimates of the resources that would  be required to implement these actions. The list, which USAC initially  provided to FCC in response to its request, included a suggested action to  perform assessments of USAC’s internal controls in accordance with  applicable OMB guidance. However, the information provided to us did  not explain how the suggested actions would address specific program  risks. Moreover, assessment of internal controls with identification of  risks and vulnerabilities should occur before specific, targeted actions can  be identified. USAC officials told us that they performed assessments of  internal controls for 2008 and 2009. However, as we describe in this report,  these assessments primarily focused on USAC’s controls over financial  reporting and were not designed to identify and address specific E-rate  program risks and vulnerabilities.
We found that, although FCC and USAC have taken actions to address  audit findings, the same rule violations, such as reimbursements for  ineligible services or for services at higher rates than authorized, were  repeated in each funding year for which beneficiary audits were  completed. Furthermore, we found that FCC and USAC have not  analyzed the findings from beneficiary audits to determine whether  corrective actions implemented by beneficiaries in response to previous  audits were effective. We analyzed the audit findings from 3 years’ worth  of audits to identify the extent of repeat findings. Of the 655 beneficiaries  that were audited from 2006 through February 2010, 64 were audited more  than once. Of those 64 beneficiaries, 36 had repeat audit findings of the  same program rule violation, such as those that we previously mentioned,  in each of the audited years. Instances of repeat audit findings and the  likelihood that they would be identified in successive audits are examples  of the risks and vulnerabilities that, once identified and assessed, could  inform the E-rate program’s internal controls, including providing data  about where modifications to the nature, extent, or scope of beneficiary  audits are most needed. Moreover, goals and metrics for reducing the rate  of program rule violations by beneficiaries and service providers are  important elements to provide incentives and focus on properly identifying  and assessing the E-rate program’s internal controls and monitoring the  effect that implemented control strategies have on beneficiary compliance.
However, according to FCC officials, they have not developed specific  goals and do not have metrics to measure progress made.
Timely resolution of audit findings and approval of beneficiary audit  reports are important components of a systematic process for assessing  and continuously modifying internal controls for the E-rate program. We  found that the beneficiary audit process did not result in the timely  resolution of audit findings and approval of audit reports. For example, the  average time between when USAC received a draft audit report and when  the USAC board’s Schools & Libraries Committee approved the final audit  report was approximately 224 days. As of April 2010, nearly 20 percent of  these audits had not been approved by the committee. According to USAC  officials, internal reviews of all audit findings, as well as quality assurance  reviews and other internal processes, can take several months. However,  this means that the results of 1 year’s audits are not available to be used in  assessing internal controls until after the following year. According to  USAC officials, the increases in the number and timing of IPIA beneficiary  audits have adversely affected their ability to effectively complete audit  follow-up work in a timely manner. To begin to address this issue, FCC  and USAC officials met with OMB staff to discuss the approach used to  develop estimates of improper payments and modifications to the  methodology used that would also address workload issues. FCC and  USAC officials stated that beginning in fiscal year 2011, the improper  payments estimate for the program will be based on tests of a sample of  monthly disbursements using the USAC-designed Payment Quality  Assurance program. Also according to these officials, beginning in fiscal  year 2011, beneficiary audits will be performed using a USAC-designed  compliance audit program.
We also found that FCC and USAC do not have documented and approved  policies and procedures for the beneficiary audit process. Without  documented and approved policies and procedures, management may lack  assurance that control activities are appropriate, actually applied, and  applied properly. Policies and procedures could also contribute positively  to a systematic process for considering audit results when assessing the  program’s internal controls and in identifying opportunities for  modifications to existing controls.
We determined that FCC and USAC’s audit process currently used for the  E-rate program is essentially a combination of procedures contained in the  2004 draft audit resolution plan, periodic directives from FCC to USAC,  and procedures that USAC management have implemented (either  formally or informally) over the last 6 years. As of August 2010, FCC had  not approved the draft audit resolution plan. According to USAC officials,  USAC has implemented most aspects of the plan and refined and revised it  over time. However, our work showed that the procedures set forth in the  various documents are not consistent with one another or with USAC’s  current practices for addressing audit findings. For example, the draft  audit resolution plan states that a response to audit findings will be  developed within 60 days of receipt of a final audit report, yet the deadline  is 30 days according to the Schools & Libraries Division’s audit response  procedures. Also, the audit resolution plan states that USAC’s Audit  Committee will review and approve the final beneficiary audit reports and  USAC’s proposed response. However, in April 2006 USAC’s Board of  Directors approved modifications to the Audit Committee’s charter to  remove this responsibility. Furthermore, two USAC divisions have  overlapping responsibilities for maintaining the audit results database. It is  unclear from these various procedures who, for example, is responsible  for maintaining information on the status of audit findings (e.g., open or  closed) and the recovery of improper payments. Other inconsistencies  may exist between the processes used and the processes that management  believes are in use to address audit findings.
Program officials have acknowledged the importance of documented and  approved policies and procedures for the beneficiary audit process and  are taking action to address this need. USAC officials stated that in  September 2009, they began an initiative to update and streamline existing  policies and procedures, including those related to the beneficiary audit  process. According to these officials, procedures were updated and  approved in July 2010 specific to the Schools & Libraries Division’s  responsibilities for audit response and follow-up. USAC officials stated  that all other existing audit process policies and procedures are scheduled  to be completed and submitted to FCC for review and approval by  December 2010.
section_title: Conclusions
paragraphs: Since the establishment of the E-rate program, FCC and USAC have taken  steps to revise the program’s internal controls to address problems they  have identified as well as concerns raised by external auditors, such as  GAO, the FCC Inspector General, and others. However, FCC and USAC  have generally been reactive, rather than proactive, regarding internal  controls, and they have not conducted a robust risk assessment of the  program’s design and core activities and functions. The continuing lack of  performance goals and measures in the E-rate program limits FCC’s ability  to efficiently identify and address problems with the program, indicates a  lack of strategic vision for the program, and affects the program’s internal  control structure. The E-rate program’s internal control structure is a  product of accretion and is not clearly targeted to reasonably and  effectively address programmatic risks. Because the administrative costs  for the program (i.e., the costs to fund USAC and Solix operations) come  out of the Universal Service Fund, an internal control structure that has  not been well-designed could be using more resources than necessary and,  thus, could be reducing the amount of program dollars available to  beneficiaries. Without an overall assessment, FCC and USAC might not  know how to appropriately balance their resources to better target risks  and best ensure that the program fulfills its overall goal of providing  technology funding to schools and libraries. Following that, periodic  examinations of the design of the E-rate program’s internal control  structure can help ensure that it is well-designed and -operated, is  appropriately updated to meet changing conditions, and provides  reasonable assurance that the internal controls appropriately address risk  across the entire E-rate program.
In addition, although FCC uses beneficiary audits as an oversight tool to  assist in assessing schools’ and libraries’ compliance with E-rate program  requirements, these audit results could also help inform systematic  assessments of the program’s internal control structure. Using this  information as part of a continuous improvement effort could help  strengthen internal controls by better targeting the nature, extent, or scope  of the beneficiary audits. Maximizing the use of beneficiary audits as a  core safeguard of Universal Service Fund monies would require a  sustained FCC and USAC effort. Our work has shown that sustained  efforts can best be supported by documented policies and procedures that  address the timely and appropriate resolution of audit findings and  consideration of the results of audits when assessing a program’s internal  controls.
Finally, it is important to note that the overall design of E-rate’s internal  control structure is complex because the E-rate program itself is complex.  The National Broadband Plan’s recommendation to streamline aspects of  the program opens the door for both an examination of the program as a  whole and of its internal control structure. A broad evaluation of the E- rate program’s procedures and internal controls would present  opportunities for FCC to improve the design of the program to ease the  administrative burden on schools and libraries and to better address the  risks of fraud, waste, and abuse.
section_title: Recommendations for Executive Action
paragraphs: To improve internal controls over the E-rate program, we recommend that  the Federal Communications Commission take the following four actions:    conduct a robust risk assessment of the E-rate program;    based on the findings of the risk assessment, conduct a thorough  examination of the overall design of E-rate’s internal control structure to  ensure that the procedures and administrative resources related to  internal controls are aligned to provide reasonable assurance that program  risks are appropriately targeted and addressed; implement a systematic approach to assess internal controls that  appropriately considers the results of beneficiary audits and that is  supported by a documented and approved set of policies and procedures;  and   develop policies and procedures to periodically monitor the internal  control structure of the E-rate program, including evaluating the costs and  benefits of internal controls, to provide continued reasonable assurance  that program risks are targeted and addressed.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Federal Communications  Commission and the Universal Service Administrative Company for their  review and comment.
In its written comments, FCC agreed with our recommendations. FCC  stated that it intends to work closely with USAC and provide the  appropriate directives concerning the implementation of a risk  assessment. FCC’s full comments are reprinted in appendix V.
In its written comments, USAC noted that it was pleased that we had  recognized that FCC and USAC have implemented many internal controls  for processing E-rate applications and making E-rate funding  commitments. However, USAC stated that it does not believe that the  facts, viewed in their full context, support some of our conclusions. USAC  does not agree with our conclusion that the E-rate program has not been  subjected to a robust risk assessment. USAC believes that we too narrowly  construed the review performed by an independent public accounting firm  in 2008 when we determined that the review focused on the risks  associated with financial reporting. USAC states that the 2008 review did  assess and test specific internal controls for the E-rate program. We agree  that some E-rate internal controls were in fact assessed and tested;  nonetheless, the focus of the public accounting firm’s work was neither  the E-rate program nor its programmatic aspects. No risk assessment that  USAC has undertaken to date has been the type of risk assessment that we  envision under the first recommendation we make in this report. Such an  assessment would consider the existing design of the E-rate program as a  whole, including the roles of FCC, USAC, beneficiaries, and service  providers; whether the design and mix of preventive and detective  controls already in place for the E-rate program are appropriate; and  whether the program lacks internal controls that are needed.
USAC also does not agree with our findings regarding its analysis of audit  findings, including repeat audit findings; the timeliness of its beneficiary  audit process; and the division of responsibility within USAC for  maintaining the audit results database. We continue to believe that USAC  could analyze audit findings on a timely basis and use the information to  address risks and reduce instances of repeat audit findings. USAC’s  comments are reprinted in Appendix VI, followed by our full response to  USAC. We made no changes to our recommendations based on USAC’s  comments, although we did add material to the report to acknowledge  some of the internal control changes that USAC discusses in its letter,  including its new Payment Quality Assurance program and USAC’s plans  to implement new internal controls in its invoicing process in response to  our work.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, the Chairman of the Federal Communications  Commission, the Acting Chief Executive Officer of the Universal Service  Administrative Company, and other interested parties. In addition, the  report will be available at no charge on GAO’s Web site at  http://www.gao.gov.
If you have any questions about this report, please contact me at (202) 512- 2834 or goldsteinm@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors to this report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our report addresses the following questions: (1) What actions have the  Federal Communications Commission (FCC) and the Universal Service  Administrative Company (USAC) taken to establish internal controls in the  E-rate program? (2) Does the design of the E-rate program’s internal  control structure appropriately consider program risks? This appendix  describes the various procedures that we undertook to answer these  questions.
We conducted the following background research that helped inform each  of our reporting objectives:    We reviewed prior GAO reports on the E-rate program; provisions of the  Telecommunications Act of 1996; FCC regulations, orders, and other  documents related to the administration of the E-rate program; the  memorandum of understanding (MOU) between FCC and USAC; risk  assessments conducted on the E-rate program; internal and external audits  and reports concerning USAC and the E-rate program; and documents  from FCC and USAC regarding the structure and operation of the program.
We interviewed officials from FCC’s Office of Managing Director, Wireline  Competition Bureau, and Office of Inspector General to learn what efforts  have been made to address internal controls and concerns about fraud,  waste, and abuse within the program. We also interviewed officials from  USAC’s Schools & Libraries Division to understand their roles and  responsibilities in relation to FCC and USAC’s subcontractor, Solix, Inc.,  as well as the overall structure of the E-rate program. We interviewed staff  at the independent public accounting firm that conducted the 2008 internal  controls review for USAC to learn more about the 2008 review and the  firm’s conclusions related to the E-rate program. We also spoke with a  former USAC official to understand more fully the history of implementing  internal controls for the program.
subsections: section_title: Analysis of the E-rate Application and Invoice Processes
paragraphs: To understand the internal control structure within the application and  invoice review processes and understand the risks addressed by the  internal control components, we reviewed internal USAC and Solix  procedures and guidance, and interviewed USAC and Solix staff.
We reviewed documentation of the program’s key internal controls and  risk assessments, and related policies and procedures. Specifically, we  reviewed the design of the program’s key internal controls for (1)  processing applications and making funding commitments, (2) processing  invoices requesting reimbursement, and (3) monitoring the effectiveness  of internal controls through audits of schools and libraries. We assessed  the design of these internal controls against GAO’s Standards for Internal  Control in the Federal Government.
We spoke with FCC, USAC, and Solix officials about program risks, the  design and functioning of internal controls, and how internal controls are  monitored and assessed.
To determine the results of various reviews within the overall application  and invoice review process, we requested and reviewed the following data  for funding years 2006 through 2009.
Record-level data of all applications, including the name and identification  number of the applicant, the original requested amount, the amount  committed, and the exceptions that were triggered by USAC’s Program  Integrity Assurance (PIA) review process. These data were from the  Streamlined Tracking and Application Review System (STARS), which is  used to process applications for funding and to track information  collected during the application review process.
Record-level and summary data from the Invoice Streamlined Tracking  and Application Review System (ISTARS), including a summary of data for  each type of edit that can be flagged during the automated validation  process. These data included a description of the edit; the number of  occurrences; the total dollar amount without the E-rate discount; the total  dollar amounts requested, approved, and modified; the total percentage of  the modification as part of the undiscounted amount; the total number of  invoice lines with edits; and the total number of invoice lines without  edits.
Summary data for the results of various reviews that make up the  application review process, including the final review, quality assurance  reviews, and the heightened scrutiny reviews. For the final and quality  assurance reviews, we reviewed data on the number of returns that were  triggered by the reviews and the exception(s) associated with each return.  The heightened scrutiny review data included the total number of  applications or applicants reviewed, categorized by funding  determinations (i.e., modifications, withdrawals, denials, and full  approvals), and the total dollar amount associated with each type of  determination.
To provide these data, Solix performed queries on the system and  provided the resulting reports to us between December 2009 and May  2010. Data from the STARS and ISTARS systems can change on a daily  basis as USAC processes applications for funding and reimbursement,  applicants request adjustments to requested or committed amounts, and  other actions are taken. As a result, the data we obtained and reported on  in this report reflect the amounts at the time that Solix produced the data  and could be somewhat different if we were to perform the same analyses  with data produced at a later date.
To assess the reliability of the data, we contacted experts at USAC and  Solix to determine whether major changes in how data are processed have  been made since GAO determined that the STARS system was reliable in  2007. We also clarified that ISTARS and STARS share the same platform  and security, and that data can be accessed across both systems. For the  summary data for the heightened scrutiny reviews, we also reviewed  descriptions from USAC on how each team processes its data.
We did not include an analysis of some of the data that we requested. For  example, we did not include an analysis of data from the application  review process in this report, because limitations with the data process did  not allow us to produce a relevant analysis within our available time  frame. Similarly, we did not include an analysis of the invoice data that  summarized the invoice edits by type of edit because limitations with the  data process did not allow us to produce a relevant analysis within our  available time frame. With these exceptions, we determined the data were  sufficiently reliable for the purposes of our review.
section_title: Analysis of the E-rate Audit Process
paragraphs: We interviewed USAC and FCC officials and reviewed USAC’s policies and  procedures governing its audit process, including the process for reporting  audit results and the status of audit follow-up to USAC’s Board of  Directors and FCC. We also reviewed applicable regulations, FCC orders  and directives, as well as provisions of the MOU between FCC and USAC.  Furthermore, we analyzed data in USAC’s audit tracking systems on  beneficiary audits performed between 2006 and 2010. To do so, we  obtained an understanding of how beneficiary audit data are processed  and maintained for each phase of the audit process in USAC’s Improper  Payment Audit Tracking System (IPATS) and Consolidated Post Audit  Tracking System (CPATS). We interviewed USAC officials about the  quality of the data maintained in these database systems. CPATS was  implemented in 2009; thus, numerous CPATS data elements for prior  years’ Improper Payments Information Act of 2002 (IPIA) beneficiary  audits were blank. Therefore, we appropriately modified our analysis of  the audit data and determined that these data were sufficiently reliable for  our purposes. Specifically, we (1) calculated the average number of days  between draft audit report and board approval of the final audit report,  using data from audits performed in 2009 and 2010; (2) evaluated the  frequency of reported audit findings from audits performed in 2006  through 2010; and (3) evaluated the frequency with which schools and  libraries were audited in 2006 through 2010 to determine whether there  were repeat audit findings in successive audits.
We conducted this performance audit from August 2009 to September 2010  in accordance with generally accepted government auditing standards.  These standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: E-rate Program Application, Funding, and Reimbursement Processes
section_title: Appendix III: Analysis of Selected E-rate Program Beneficiaries
paragraphs: We did not conduct any transaction testing related to the E-rate  application process; however, we did conduct follow-up to audit work  performed for our March 2009 E-rate report. For that report, we  determined the percentage of eligible entities participating in the E-rate  program by performing a matching analysis using funding year 2005 data  from USAC and school year 2005 or 2005-2006 data from the Department  of Education’s National Center for Education Statistics (NCES). At the end  of our matching analysis, we found that we could not match a number of  schools and libraries from USAC’s database to schools and libraries from  the NCES data. We found various reasons that could explain some of the  nonmatching schools and libraries. For example, schools often submit  multiple applications, some of which may only cover specific school  buildings that would then not show up as a match to a particular school,  even though the building is a subpart of an eligible school. We determined  that the issue of the nonmatched schools was an issue of internal controls,  which was not the subject of our 2009 E-rate report, and would best be  handled during our internal controls work. Therefore, for this report, we  selected the 1,208 private schools from our list of nonmatching schools for  further examination because we determined that private schools present a  greater risk of fraud for the E-rate program. We subsequently determined  that we would focus our follow-up analysis on the 408 private schools  from our funding year 2005 list that had also applied for E-rate support in  funding year 2008. We sent USAC a list of 274 private schools that received  funding year 2008 funding commitments and asked USAC to reverify the  eligibility of each entity to participate in the E-rate program using USAC’s  PIA Form 471 Review Procedures manual.
USAC was able to verify the eligibility of 265 of these private schools  through their Form 471 review procedures manual, which includes  matching the schools to the NCES database, other acceptable third-party  documentation, or documentation provided by the school itself. We were  able to determine the eligibility of an additional 5 private schools from the  NCES database. We did not assess USAC’s procedures or make our own  assessment of the adequacy of the documentation provided by the schools.
USAC determined that 4 private schools within the scope of our request  could not be validated as eligible for the program, including 3 schools that  were confirmed as being closed. USAC determined these schools to be  ineligible for funding as a result of the revalidation process initiated by our  request. USAC officials noted that they verify that a school has been  closed by receiving confirmation from the applicant or a valid third party,  such as a state E-rate coordinator. According to USAC officials, once  USAC staff confirm that the school is closed, the staff will provide USAC’s  invoicing team with the entity number and closed date. The invoicing team  will place the entity on watch to prevent any invoices from being paid.  Based on the closing date provided by the applicant or third party, USAC  may also send a commitment adjustment (COMAD) referral to the COMAD  team, which will adjust any previous commitments or recover funds in the  cases where payments were made after the closed date.
section_title: Appendix IV: E-rate Program Full-Time- Equivalent Positions
paragraphs: During calendar years 2006 through 2009, Solix and USAC dedicated  between 21.5 and 22.5 full-time-equivalent (FTE) positions annually for the  invoice review process. In the same period, they dedicated 131.5 to 149.5  FTEs annually for the application review process (see table 2).
section_title: Appendix V: Comments from the Federal Communications Commission
section_title: Appendix VI: Comments from the Universal Service Administrative Company
paragraphs: Following are GAO’s comments on the Universal Service Administrative  Company’s letter dated September 20, 2010.
subsections: section_title: GAO Comments
paragraphs: 1.  As stated in our report, USAC had not analyzed the findings from  beneficiary audits to determine whether corrective actions  implemented by beneficiaries in response to previous audits were  effective. We also stated that, consistent with our standards for  internal control in the federal government, repeat audit findings  (information that would be available to USAC from analysis of the  audits) are examples of the risks and vulnerabilities which, once  identified and assessed, could provide information about where  modifications to the nature, extent, or scope of beneficiary audits are  most needed. This is consistent with the objectives of internal controls  in the federal government and FCC’s and USAC’s responsibilities to  establish and maintain internal controls that appropriately safeguard  program funding and resources. We recognize that USAC cannot be  held responsible for the conduct of beneficiaries; however, USAC is  responsible for recognizing the risks that beneficiaries will not comply  with program rules and for implementing controls that appropriately  target those risks. Therefore, beneficiary conduct that affects such  things as the commitment of funds and payments to beneficiaries must  be part of USAC’s assessment of program controls and are not, as  stated by USAC, unrelated to USAC’s internal controls for the E-rate  program. 2.  Our work included consideration of the 2008 internal control review  consistent with our standards and audit objectives. As stated in our  report, the 2008 internal control work the independent public  accounting firm performed was a review of USAC’s controls for all  four Universal Service Fund programs and was not specific to any  single program, including E-rate. Further, the review did not address  program risks associated with beneficiary self-certification of key  information, nor did it consider the nature, extent, and scope of  beneficiary audits or the results from those audits. A comprehensive  assessment focused on the E-rate program would consider the existing  design of the E-rate program as a whole, including the roles of FCC,  USAC, beneficiaries, and service providers; whether the design and  mix of preventive and detective controls already in place for the E-rate  program are appropriate; and whether the program lacks internal  controls that are needed. With respect to the 2009 internal control  assessment performed by USAC’s own staff, as stated in our report,  this assessment was also not designed to identify and address specific  E-rate program risks and vulnerabilities.  3.  We do not agree with USAC’s statements concerning the timeliness of  its beneficiary audit process. The measurements USAC provides—239  days and 64 days—exclude weekends and holidays and therefore do  not portray the entire processing time. In our report, we stated that  the beneficiary audit process did not result in the timely resolution of  audit findings and approval of audit reports and, to illustrate, we  analyzed USAC data for a 3-year period and found that the average  time between when USAC received draft audit reports and when final  audit reports were approved was approximately 224 days. We focused  on the amount of time after USAC receives draft audit reports because  this is the period that is used to review the audit reports, have quality  control procedures performed by others, and approve the reports.  Also, as discussed in our report, we found that USAC was not  effectively analyzing the audit findings although the findings could  have been used to provide information about where modifications to  the nature, extent, or scope of beneficiary audits were most needed.  Therefore, this time period covers the time taken for the process steps  that are relevant to identification of an issue that requires management  attention to ensure that the results of audits are timely considered  when assessing and modifying the program’s internal controls. 4.  Our work did take into account the structure of the Universal Service  Fund audit approach. Instances of repeat audit findings and the  likelihood that they would be identified in successive audits are  examples of the risks and vulnerabilities that, once identified and  assessed, could inform the E-rate program’s internal controls. We  recognize that the timing of some of the audits may have made it  difficult for some audited beneficiaries to address and rectify non- compliant findings discovered in the first audit before a second audit  was completed. However, we found beneficiaries with repeat audit  findings from audits conducted in the first and third years of the 3-year  period, which should have been sufficient time to avoid repeated   findings. In any case, it is incumbent on USAC to analyze the results of  beneficiary audits to identify instances of repeat audit findings and  assess whether corrective actions were effective. 5.  As we stated in our report, it is unclear from USAC’s procedures who  is responsible for maintaining information on the status of audit  findings. We also reported that we found other inconsistencies  between activities in practice versus written procedures regarding the  audit process. It will be important that these inconsistencies are  addressed by the updated audit process policies and procedures that  USAC told us it expects to complete by December 2010.
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Faye Morrison and Robert Owens  (Assistant Directors), Frederick Evans, John Finedore, Natasha Guerra,  Christopher Howard, Bonnie Pignatiello Leer, Scott McNulty, Sara Ann  Moessbauer, Joshua Ormond, Steven Putansu, Amy Rosewarne, Matt  Shaffer, Betty Ward-Zukerman, and Mindi Weisenbloom made key  contributions to this report.