Education Financial Management: Weak Internal Controls Led to Instances of Fraud and Other Improper Payments
Published: 2002-04-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Education has a history of financial management problems, including serious internal control weaknesses, that have affected the Department's ability to provide reliable financial information on its operations.
section_title: What GAO Found
paragraphs: GAO found that significant internal control weaknesses in payment processes and poor physical control over its computer assets led to fraud, improper payments, and lost assets. GAO also identified instances of grant and loan fraud and pervasive control breakdowns and improper payments in other areas, particularly involving purchasing cards.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the final results of our review of  the Department of Education’s disbursement processes and how significant  internal control weaknesses led to instances of fraud and other improper  payments.  My testimony summarizes our report being released today,  which discusses the internal control problems we found at Education, the  resultant improper payments, and recommendations for strengthening  internal controls over disbursements.
As we discussed in our two testimonies before this subcommittee last  year, the Department of Education has a history of financial management  problems, including serious internal control weaknesses.  These  weaknesses have affected Education’s ability to provide reliable financial  information to decisionmakers both inside and outside the agency and to  maintain the financial integrity of its operations.  We and Education’s Office  of Inspector General (OIG) have issued many reports over the last several  years on the financial challenges facing the department and the need to  eliminate internal control weaknesses to reduce the potential for fraud,  waste, abuse, and mismanagement.  In addition, since 1990, we have  designated Education’s student financial assistance programs as a high-risk  area for fraud, waste, abuse, and mismanagement.  Given the billions of  dollars in payments made by Education each year and the risk of erroneous  or fraudulent payments making their way through Education’s processes  without prevention or detection, you requested that we audit selected  department accounts that may be particularly susceptible to improper  payments.
In response to your request, we assessed internal controls over Education’s  processes for (1) disbursing grants and loans, (2) paying for purchases with  third party drafts, and (3) use of government purchase cards, and  determined whether any fraudulent or otherwise improper payments were  made in these areas.  Our review covered the period May 1998 through  September 2000 during which time Education disbursed $181.5 billion  through these processes—$181.4 billion in grants and loans, $55 million in  third party drafts, and $22 million in purchase card transactions.  While we  identified some fraudulent and improper payments, our work was not  designed to identify all fraudulent or otherwise improper payments made  by the department.  In addition, we assessed Education’s physical controls  over its computer equipment.  We also assessed the effectiveness of  changes to Education’s process for purchase card purchases, which took  effect in July 2001 following our prior testimony before this subcommittee.   Our work built upon earlier work done by Education’s OIG in which the  OIG identified weaknesses in the department’s third party draft and  purchase card processes.
To summarize, we found that significant internal control weaknesses in  Education’s payment processes and poor physical control over its  computer assets made the department vulnerable to and in some cases  resulted in fraud, improper payments, and lost assets.  We identified several  instances of fraud in the grant and loan areas and pervasive control  breakdowns and improper payments in other areas, particularly involving  purchase cards.  Further, because of the risks we identified in the third  party draft process, Education eliminated their use.  My testimony today  discusses our findings in each of these areas, as well as some of the actions  Education has taken to address the problems we identified.
subsections: section_title: Controls over Grants Disbursement Process Failed to Detect Certain Improper Payments
paragraphs: As we testified in July 2001, controls over grant and loan disbursements did  not include a key edit check or follow-up process that would help identify  schools that were disbursing Pell Grants to ineligible students.  To identify  improper payments that may have resulted from the absence of these  controls, we performed tests to identify students 70 years of age and older  because we did not expect large numbers of older students to be receiving  Pell Grants, and in 1993, we identified abuses in the Pell Grant program  relating to older students.  Based on the initial results of our tests and  because of the problems we identified in the past, we expanded our review  of 7 schools that had disproportionately high numbers of older students to  include recipients 50 years of age and older. We found that 3 schools  fraudulently disbursed about $2 million of Pell Grants to ineligible  students, and another school improperly disbursed about $1.4 million of  Pell Grants to ineligible students.  We also identified 31 other schools that  had similar disbursement patterns to those making the payments to  ineligible students.  These 31 schools disbursed approximately $1.6 million  of Pell Grants to potentially ineligible students.  We provided information  on these schools to Education for follow-up.
Education staff and officials told us that they have performed ad hoc  reviews in the past to identify schools that disbursed Pell Grants to  ineligible students and have recovered some improper payments as a  result.  However, Education did not have a formal, systematic process in  place specifically designed to identify schools that may be improperly  disbursing Pell Grants.  In September 2001, we issued an interim report in  which we recommended that the Secretary of Education (1) establish  appropriate edit checks to identify unusual grant and loan disbursement  patterns and (2) design and implement a formal, routine process to  investigate unusual disbursement patterns identified by the edit checks.
In our July 2001 testimony, we told you that Education decided to  implement a new edit check, effective beginning with the 2002-2003 school  year to identify students who are 85 years of age or older.  We explained  that we believed the age limit was too high and would exclude many  potential ineligible students. Education subsequently lowered the age limit  for that edit to 75 years of age or older.  If the student’s date of birth  indicates that he or she is 75 years of age or older, the system edit will  reject the application and the school will not be authorized to give the  student federal education funds until the student either submits a corrected  date of birth or verifies that it is correct.  However, without also looking for  unusual patterns and following up, the edit may not be very effective, other  than to correct data entry errors or confirm older students applying for aid.
Education is also in the process of implementing a new system, called the  Common Origination and Disbursement (COD) system, which is to become  effective starting this month.  Education officials told us that this  integrated system will replace the separate systems Education has used for  Pell Grants, direct loans, and other systems containing information on  student aid, and it will integrate with applicant data in the application  processing system.  The focus of COD is to improve program and data  integrity.  If properly implemented, a byproduct of this new system should  be improved controls over grant and loan disbursements.  According to  Education officials, they will be able to use COD to identify schools with  characteristics like those we identified.  However, until there is a  mechanism in place to investigate schools once unusual patterns are  identified, Education will continue to be vulnerable to the types of  improper Pell Grant payments we identified during our review.
We identified over $32 million of other potentially improper grant and loan  payments.  Based on supporting documentation provided to us by  Education, we determined that over $21 million of these payments were  proper.  However, because Education did not provide adequate supporting  documentation, we were unable to determine the validity of about  $12 million of these transactions or conclude on the effectiveness of the  related edit checks.  While the amount of improper and potentially  improper grant and loan payments we identified is relatively insignificant  compared to the billions of dollars disbursed for these programs annually,  it represents a control risk that could easily be exploited to a greater  extent.
During our investigation of potentially improper transactions, we found  that two students submitted counterfeit Social Security cards and  fraudulent birth certificates along with their applications for federal  education aid, and they received almost $55,000 in direct loans and Pell  Grants.  The U.S. Attorney’s Office is considering prosecuting these  individuals.
During our tests to determine the effectiveness of Education’s edit checks,  we also found data errors, such as incorrect social security numbers (SSN)  of borrowers, in the Loan Origination System (LOS), which processes all  loan origination data received from schools.  Such errors could negatively  affect the collection of student loans because without correct identifying  information, Education may not be able to locate and collect from  borrowers when their loans become due.  We reviewed data for more than  1,600 loans and determined that for almost 500 of these loans, the  borrowers’ SSNs or dates of birth were incorrect in LOS.  During the  application process, which is separate from the loan origination process,  corrections to items such as incorrect SSNs are processed in the Central  Processing System (CPS); however, these corrections are not made to data  in LOS.  The new COD system discussed earlier may alleviate this situation.   If this system works as intended, student data should be consistent among  all of the department’s systems, including CPS and LOS, because it will  automatically share corrected data.  However, until the new system is fully  implemented, errors in LOS could impede loan collection efforts.
section_title: Ineffective Controls over Third Party Drafts Led to Their Elimination
paragraphs: As we testified in April and July 2001, significant internal control  weaknesses over Education’s process for third party drafts markedly  increased the department’s vulnerability to improper payments.  Although  segregation of duties is one of the most fundamental internal control  concepts, we found that some individuals at Education could control the  entire payment process for third party drafts.  We also found that  Education employees circumvented a key computer system application  control designed to prevent duplicate payments.  We tested third party  draft transactions and identified $8.9 million of potential improper  payments, $1.7 million of which remain unresolved because Education was  unable to provide us with adequate supporting documentation. Education  has referred the $1.7 million to the OIG for further investigation.  Because  of the risks we identified in the third party draft payment process, and in  response to a letter from this subcommittee, Education took action in May  2001 to eliminate the use of third party drafts.
section_title: Poor Controls over Government Purchase Cards Resulted in Some Fraudulent, Improper, and Questionable Purchases
paragraphs: In our July 2001 testimony before this subcommittee, we described internal  control weaknesses over Education’s purchase card program, including  lack of supervisory review and improper authorization of transactions.  We  found that Education’s inconsistent and inadequate authorization and  review processes for purchase cards, combined with a lack of monitoring,  created an environment in which improper purchases could be made with  little risk of detection.  Inadequate control over these expenditures,  combined with the inherent risk of fraud and abuse associated with  purchase cards, resulted in fraudulent, improper, and questionable  purchases, totaling about $686,000, by some Education employees.
During the time of our review, Education’s purchase card program was  operating under policies and procedures that were implemented in 1990.   The policy provided very limited guidance on what types of purchases  could be made with the purchase cards.  While the policy required each  cardholder and approving official to receive training on their respective  responsibilities, we found that several cardholders and at least one  approving official were not trained.  In addition, we found that only 4 of  Education’s 14 offices required cardholders to obtain authorization prior to  making some or all purchases, although Education’s policy required all  requests to purchase items over $1,000 be made in writing to the applicable  department Executive Officer.  We also found that approving officials did  not use monitoring reports that were available from Bank of America to  identify unusual or unauthorized purchases and that only limited use was  made of available mechanisms to block specific undesirable Merchant  Category Codes (MCC).  These factors combined resulted in a lax control  environment for this inherently risky program.
Education officials told us the department relied on the approving official’s  review of the cardholder’s monthly purchase card statements to ensure that  all purchases made by employees were proper.  We tested the effectiveness  of the approving officials’ review of 5 months of cardholder statements.  We  reviewed all 903 monthly statements that were issued during these months,  totaling about $4 million, and found that 338, or 37 percent, totaling about  $1.8 million, were not approved by the appropriate approving official.  To  determine whether improper purchases were made without being detected,  we requested documentation supporting the $1.8 million of purchases that  were not properly reviewed.  We also requested documentation for other  transactions that appeared unusual.  We reviewed the documentation  provided by Education and identified some fraudulent, improper, and  questionable purchases, which I will discuss in a moment.
We considered fraudulent purchases to be those that were unauthorized  and intended for personal use.  Improper purchases included those for  government use that were not, or did not appear to be, for a purpose  permitted by law or regulation.  We also identified as improper purchases  those made on the same day from the same vendor that appeared to  circumvent cardholder single purchase limits.  We defined questionable  transactions as those that, while authorized, were for items purchased at an  excessive cost, for a questionable government need, or both, as well as  transactions for which Education could not provide adequate supporting  documentation to enable us to determine whether the purchases were  valid.
We found one instance in which a cardholder made several fraudulent  purchases from two Internet sites for pornographic services.  The purchase  card statements contained handwritten notes next to the pornography  charges indicating that these were charges for transparencies and other  nondescript items.  According to the approving official, he was not aware  of the cardholder’s day-to-day responsibilities and did not feel that he was  in a position to review the monthly statements properly.  The approving  official stated that the primary focus of his review was to ensure there was  enough money available in that particular appropriation to pay the bill.  As  a result of investigations related to these purchases, Education  management issued a termination letter that prompted the employee to  resign.
We identified over $140,000 of improper purchases.  For example, one  employee made improper charges totaling $11,700 for herself and a  coworker to attend college classes that were unrelated to their jobs at the  department.  We also identified improper purchases totaling $4,427 from a restaurant in San Juan, Puerto Rico.  These restaurant charges were  incurred during a Year 2000 focus group meeting, and included breakfasts  and lunches for federal employees and nonfederal guests.  Education,  however, could not provide us with any evidence that the nonfederal  attendees provided a direct service to the government, which is required by  federal statute in order to use federal appropriated funds to pay for the  costs of nonfederal individuals at such meetings.  We have referred this  matter to Education’s OIG.
Other examples of improper purchases we identified include 28 purchases  totaling $123,985 where Education employees made multiple purchases  from a vendor on the same day.  These purchases appear to violate the  Federal Acquisition Regulation provision that prohibits splitting purchases  into more than one segment to circumvent single purchase limits.  For  example, one cardholder purchased two computers from the same vendor  at essentially the same time.  Because the total cost of these computers  exceeded the cardholder’s $2,500 single purchase limit, the total of  $4,184.90 was split into two purchases of $2,092.45 each.  In some  instances, Education officials sent memos to the offending cardholders  reminding them of the prohibition against split purchases.  We identified  five additional instances, totaling about $17,000, in which multiple  purchases were made from a single vendor on the same day.  Although we  were unable to determine based on the available supporting documentation  whether these purchases were improper, these transactions share similar  characteristics with the 28 split purchases.
We identified questionable purchases totaling $286,894 where Education  employees paid for new office furniture and construction costs to renovate  office space that they were planning to vacate.  Only a small amount of  furniture, including chairs for employees with special needs, was moved to  the new building when department employees relocated.
In addition, we identified as questionable more than $218,000 of purchases  for which Education provided us with no support or inadequate support to  assess the validity.  For $152,000, Education could not provide any support,  nor did the department know specifically what was purchased, why it was  purchased, or whether these purchases were appropriate.  For the  remaining $66,000, Education was able to provide only limited supporting  documentation.  As a result, we were unable to assess the validity of these  payments, and we consider these purchases to be potentially improper.
After our July 2001 testimony, we issued an interim report, that described  the poor internal controls over purchase cards and made recommendations  that the department  reiterate to all employees established policies regarding the appropriate  use of government purchase cards;  strengthen the process of reviewing and approving purchase card  transactions, focusing on identifying split purchases and other  inappropriate transactions; and  expand the use of MCCs to block transactions with certain vendors.
Recently, Education has made some changes in the way it administers its  purchase card program in an effort to address these three  recommendations.  For example, in December 2001, the department issued  new policies and procedures that, among other things, (1) establish  detailed responsibilities for the cardholder and the approving official, (2) prohibit personal use of the card and split purchases to circumvent the  cardholder’s single purchase limits, (3) require approving officials to  review the appropriateness of individual purchases, (4) establish  mandatory training prior to receiving the card and refresher training every  2 years, and (5) establish a quarterly quality review of a sample of purchase  card transactions to ensure compliance with key aspects of the  department’s policy.  If appropriately implemented, these new policies and  procedures are a good step toward reducing Education’s vulnerability to  future improper purchases.
Further, in July 2001, the department implemented a new process to  approve purchase card purchases.  Instead of the approving official signing  a monthly statement indicating that all transactions are proper, the  approval is now done electronically for each individual transaction.   According to Education officials, most approving officials and cardholders  received training on this new process.  In order to assess the effectiveness  of this new approval process, we reviewed a statistical sample of the  monthly statements of cardholders for July, August, and September 2001.   Purchases during these months totaled $1,881,220.  While we found  evidence in the department’s system that all of the 87 statistically sampled  monthly statements had been reviewed by the cardholder’s approving  official, 20 of the statements had inadequate or no support for items  purchased, totaling $23,151.  Based on our work, we estimate the most  likely amount of unsupported or inadequately supported purchases during  these 3 months is $65,817.  The effectiveness of the department’s new  approval process has been minimized because approving officials are not  ensuring that adequate supporting documentation exists for all purchases.   In addition, these procedures do not address the problem of an authorizing  official who does not have personal knowledge of the cardholder’s daily  activities and therefore is not in a position to know what types of purchases  are appropriate.
In response to our recommendation regarding the use of MCCs to block  transactions from certain vendors, in November 2001, the department  implemented blocks on purchases from a wide variety of merchants that  provide goods and services totally unrelated to the department’s mission,  including veterinary services, boat and snowmobile dealers, and cruise  lines.  In total, Education blocked more than 300 MCCs.  By blocking these  codes, Education has made use of a key preventive control to help reduce  its exposure to future improper purchases.
As we told you in our July 2001 testimony, Education took action earlier in  2001 to improve internal controls related to the use of government  purchase cards by lowering the maximum monthly spending limit to  $30,000, lowering other cardholders’ single purchase and total monthly  purchase limits, and revoking some purchase cards.  This action was in  response to a letter from this subcommittee dated April 19, 2001, which  highlighted our April 2001 testimony, in which we stated that some  individual cardholders had monthly purchase limits as high as $300,000.   These and the other steps I just discussed have helped reduce Education’s  exposure to improper purchase card activities.  However, more needs to be  done to improve the approval function, which is key to adequate control of  these activities.
section_title: Poor Controls Contributed to Loss of Computer Equipment
paragraphs: Education lacked adequate internal controls over computers acquired with  purchase cards and third party drafts which contributed to the loss of 179  pieces of computer equipment with an aggregate purchase cost of about  $211,700.  From May 1998 through September 2000, Education employees  used purchase cards and third party drafts to purchase more than  $2.9 million of personal computers and other computer-related equipment.   Such purchases were actually prohibited by Education’s purchase card  policy in effect at the time.
The weak controls we identified over computers acquired with purchase  cards and third party drafts included inadequate physical controls— according to Education’s OIG, the department had not taken a  comprehensive physical inventory for at least 2 years prior to October  2000—and lack of segregation of duties, which is one of the most  fundamental internal controls.  In the office where most of the missing  equipment was purchased, two individuals had interchangeable  responsibility for receiving more than $120,000 of computer equipment  purchased by a single cardholder, from one particular vendor.  In addition,  these two individuals also had responsibility for bar coding the equipment,  securing the equipment in a temporary storage area, and delivering the  computers to the users.  Furthermore, one of these two individuals was  responsible for providing information on computer purchases to the person  who entered the data into the department’s asset management system.   According to the cardholder who purchased the equipment, they did not  routinely compare the purchase request with the receiving documents from  the shipping company to ensure that all items purchased were received.  In  addition, our review of records obtained from the computer vendor from  which Education made the largest number of purchase card and third party  draft purchases showed that less than half of the $614,725 worth of  computers had been properly recorded in the department’s property  records, thus compounding the lack of accountability over this equipment.   Combined, these weaknesses created an environment in which computer  equipment could be easily lost or stolen without detection.
In order to identify computers that were purchased with purchase cards  and third party drafts that were not included in the department’s asset  management system, we obtained the serial numbers of all pieces of  computer equipment purchased from the largest computer vendor the  department used.  We compared these serial numbers to those in the  department’s asset management system and found that 384 pieces of  equipment, including desktop computers, scanners, and printers totaling  $399,900, appeared to be missing.  In September 2001, we conducted an  unannounced inventory to determine whether these computers were  actually missing or were inadvertently omitted from the property records.   We located 143 pieces of equipment that were not on the property  records, valued at about $138,400, and determined that 241 pieces, valued  at about $261,500, were missing at that time.
After we completed our work in this area, we again visited the office where  most of the computer equipment was missing because Education officials  told us they had located some of the missing inventory.  Officials in this  office told us that they hired a contractor to keep track of their computers  when the office moved to its new space.  According to the officials, as part  of its work, the contractor recorded the serial numbers of all computers  moved and identified 86 of the 241 pieces of computer equipment that we  were unable to locate during our unannounced inventory in September  2001.  However, when Education staff and officials tried to locate this  equipment, they were only able to find 73 of the 86 pieces of equipment.   When we visited, we located only 62 of the 73 pieces of equipment.   Education officials have been unable to locate the remaining 179 pieces of  missing computer equipment with an acquisition value of about $211,700.   They surmised that some of these items may have been surplused;  however, there is no paperwork to determine whether this assertion is  valid.
According to Education officials, new policies have been implemented that  do not allow individual offices to purchase computer equipment without  the consent of the Office of the Chief Information Officer (OCIO).   However, during our previously mentioned review of a statistical sample of  purchase card transactions made from July 2001 through September 2001,  we found three transactions totaling $2,231 for the purchase of computer  equipment without any supporting documentation from the OCIO.  Based  on these results, the new policies are not being effectively implemented.   This is another indication that the new purchase card approval function is  not fully operating as an effective deterrent to improper purchases.
In January 2002, we also reviewed the new computer ordering and  receiving processes in the office where most of the missing equipment was  purchased and found mixed results.  These new policies are designed to  maintain control over the procurement of computers and related  equipment and include  purchasing computers from preferred vendors that apply the  department’s inventory bar code label and record the serial number of  each computer on a computer disk that is sent directly to the Education  official in charge of the property records;  loading the computer disk containing the bar code, serial number, and  description of the computer into the property records; and  having an employee verify that the computers received from the vendor  match the serial numbers and bar codes on the shipping documents and  the approved purchase order.
However, a continued lack of adequate physical control negates the  effectiveness of these new procedures.  For example, the doors to the two  rooms used to store computer equipment waiting to be installed were both  unlocked and unattended.  The receptionist at the mail counter next to the  first storage room we visited told us that he had the door open to regulate  the room temperature.  The Education official responsible for this process  stated that he did not know that mailroom personnel had access to this  room.  Furthermore, he stated that he does not have a key to either storage  room.  Also, during our second search for this equipment, we visited four  rooms where some of the computers were stored and found them all  unsecured.