Student and Exchange Visitor Program: DHS Needs to Take Actions to Strengthen Monitoring of Schools
Published: 2012-07-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony discusses the findings from our June 2012 report assessing U.S. Immigration and Customs Enforcement’s (ICE) oversight of the Student and Exchange Visitor Program (SEVP). ICE, within the Department of Homeland Security (DHS), is responsible for managing SEVP, including ensuring that foreign students studying in the United States comply with the terms of their admission into the country. ICE also certifies schools as authorized to accept foreign students in academic and vocational programs. As of January 2012, more than 850,000 active foreign students were enrolled at over 10,000 certified schools in the United States. In addition, ICE manages the Student and Exchange Visitor Information System (SEVIS), which assists the agency in tracking and monitoring certified schools, as well as approved students. We reported in April 2011 on the need for close monitoring and oversight of foreign students, and that some schools have attempted to exploit the immigration system by knowingly reporting that foreign students were fulfilling their visa requirements when they were not attending school or attending intermittently.
Schools interested in accepting foreign students on F and M visas must petition for SEVP certification by submitting a Form I-17 to ICE. Once this certification is achieved, schools issue Forms I-20 for students, which enable them to apply for nonimmigrant student status. The Border Security Act requires DHS to confirm, every 2 years, SEVP-certified schools’ continued eligibility and compliance with the program’s requirements. During the initial petition and recertification processes, a school must provide ICE with evidence of its legitimacy and its eligibility, such as designated school officials’ attestation statements that both the school and officials intend to comply with program rules and regulations.
This testimony summarizes the key findings of our report on ICE’s management of SEVP, which was publicly released last week. Like that report, this statement will address ICE’s efforts to (1) identify and assess risks in SEVP, and (2) develop and implement procedures to prevent and detect fraud during the initial certification process and once schools begin accepting foreign students.
section_title: What GAO Found
paragraphs: In summary, we reported that ICE does not have a process to identify and assess risks posed by schools in SEVP. Specifically, SEVP (1) does not evaluate program data on prior and suspected instances of school fraud and noncompliance, and (2) does not obtain and assess information from CTCEU and ICE field office school investigations and outreach events. Moreover, weaknesses in ICE’s monitoring and oversight of SEVP-certified schools contribute to security and fraud vulnerabilities. For example, ICE has not consistently implemented internal control procedures for SEVP in the initial verification of evidence submitted in lieu of accreditation. In addition, ICE has not consistently followed the standard operating procedures that govern the communication and coordination process among SEVP, CTCEU, and ICE field offices.
We recommended that ICE, among other things, identify and assess program risks; consistently implement procedures for ensuring schools’ eligibility; and, revise its standard operating procedure to specify which information to share among stakeholders during criminal investigations. ICE concurred with all the recommendations we made to address these challenges and has actions planned or under way to address them.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the findings from our June 2012  report assessing U.S. Immigration and Customs Enforcement’s (ICE)  oversight of the Student and Exchange Visitor Program (SEVP). ICE,  within the Department of Homeland Security (DHS), is responsible for  managing SEVP, including ensuring that foreign students studying in the  United States comply with the terms of their admission into the country.  ICE also certifies schools as authorized to accept foreign students in  academic and vocational programs. As of January 2012, more than  850,000 active foreign students were enrolled at over 10,000 certified  schools in the United States. In addition, ICE manages the Student and  Exchange Visitor Information System (SEVIS), which assists the agency  in tracking and monitoring certified schools, as well as approved students.  We reported in April 2011 on the need for close monitoring and oversight  of foreign students, and that some schools have attempted to exploit the  immigration system by knowingly reporting that foreign students were  fulfilling their visa requirements when they were not attending school or  attending intermittently.
Schools interested in accepting foreign students on F and M visas must  petition for SEVP certification by submitting a Form I-17 to ICE. Once  this certification is achieved, schools issue Forms I-20 for students, which  enable them to apply for nonimmigrant student status. The Border  Security Act requires DHS to confirm, every 2 years, SEVP-certified  schools’ continued eligibility and compliance with the program’s  requirements. During the initial petition and recertification processes, a  school must provide ICE with evidence of its legitimacy and its eligibility,  such as designated school officials’ attestation statements that both the  school and officials intend to comply with program rules and regulations.
My testimony today summarizes the key findings of our report on ICE’s  management of SEVP, which was publicly released last week. Like that  report, my statement will address ICE’s efforts to (1) identify and assess  risks in SEVP, and (2) develop and implement procedures to prevent and  detect fraud during the initial certification process and once schools begin  accepting foreign students. To conduct our work, we interviewed officials  from each of SEVP’s seven branches and criminal investigators from the  Counterterrorism and Criminal Exploitation Unit (CTCEU), as well as eight  ICE field offices, which allowed us to obtain their perspective on the  magnitude and risks associated with school fraud. We reviewed publicly  available information on 12 cases of school fraud dating from 2006 to  2011, which allowed us to better understand SEVP program risks.  Additionally, we reviewed standard operating procedures and tested  internal controls designed to ensure school oversight. To test SEVP’s  internal controls, we selected a nongeneralizable, stratified random  sample of 50 SEVP-certified schools and reviewed their case files to  verify that evidence required for certification existed, such as designated  school officials’ proof of citizenship or lawful permanent residency. We  conducted this work in accordance with generally accepted government  auditing standards. More detailed information on the scope and  methodology of our published report can be found therein.
In summary, we reported that ICE does not have a process to identify and  assess risks posed by schools in SEVP. Specifically, SEVP (1) does not  evaluate program data on prior and suspected instances of school fraud  and noncompliance, and (2) does not obtain and assess information from  CTCEU and ICE field office school investigations and outreach events.  Moreover, weaknesses in ICE’s monitoring and oversight of SEVP- certified schools contribute to security and fraud vulnerabilities. For  example, ICE has not consistently implemented internal control  procedures for SEVP in the initial verification of evidence submitted in lieu  of accreditation. In addition, ICE has not consistently followed the  standard operating procedures that govern the communication and  coordination process among SEVP, CTCEU, and ICE field offices. We  recommended that ICE, among other things, identify and assess program  risks; consistently implement procedures for ensuring schools’ eligibility;  and, revise its standard operating procedure to specify which information  to share among stakeholders during criminal investigations. ICE  concurred with all the recommendations we made to address these  challenges and has actions planned or under way to address them.
subsections: section_title: ICE Does Not Have a Process to Identify and Assess Risks Posed by Schools in SEVP
paragraphs: ICE has not developed and implemented a process to identify and  analyze program risks since assuming responsibility for SEVP in 2003,  making it difficult for ICE to determine the potential security and fraud  risks across the more than 10,000 SEVP-certified schools and to identify  actions that could help mitigate these risks. SEVP and CTCEU officials  expressed concerns about the security and fraud risks posed by schools  that do not comply with program requirements. Furthermore, various  cases of school fraud have demonstrated vulnerabilities in the  management and oversight of SEVP-certified schools. We reported that  SEVP faces two primary challenges to identifying and assessing risks  posed by schools: (1) it does not evaluate program data on prior and  suspected instances of school fraud and noncompliance, and (2) it does  not obtain and assess information from CTCEU and ICE field office  school investigations and outreach events.
Evaluating SEVP information on prior and suspected cases of  school noncompliance and fraud. SEVP does not have a process to  evaluate prior and suspected cases of school fraud and noncompliance to  identify lessons learned from such cases, which could help it better  identify and assess program risks. SEVP has maintained a compliance  case log since 2005—a list of approximately 172 schools (as of  December 2011) that officials have determined to be potentially  noncompliant with program requirements. The compliance case log  represents those schools that SEVP, on the basis of leads and out-of- cycle reviews, is monitoring for potential noncompliance. According to  SEVP officials, it has not used this list to identify and evaluate possible  trends in schools’ noncompliance, although this list could provide useful  insights to SEVP to assess programwide risks. Further, SEVP officials  said that they have not looked across previous cases of school fraud and  school withdrawals to identify lessons learned on program vulnerabilities  and opportunities to strengthen internal controls. Our analysis indicates  that there are patterns in the noncompliant schools, such as the type of  school. For example, of the 172 postsecondary institutions on SEVP’s  December 2011 compliance case log, about 83 percent (or 142) offer  language, religious, or flight studies, with language schools representing  the highest proportion. Without an evaluation of prior and suspected  cases of school fraud and noncompliance, ICE is not well positioned to  identify and apply lessons learned from prior school fraud cases, which  could help it identify and mitigate program risks going forward.
Obtaining information from CTCEU and ICE field offices’  investigations and outreach efforts. Based on our interviews with  SEVP’s Director and other senior officials, we reported that SEVP had not  established a process to obtain lessons learned information from  CTCEU’s criminal investigators. Investigators may have valuable  knowledge from working cases of school fraud in identifying and  assessing program risks, including information such as characteristics of  schools that commit fraud, how school officials exploited weaknesses in  the school certification process, and what actions ICE could take to  strengthen internal controls. For example, according to investigators in  one ICE field office, CTCEU was hampered in pursuing a criminal  investigation because SEVP officials did not obtain a signed attestation  statement within the I-17 application from a school official stating that the  official agreed to comply with rules and regulations. Another risk area we  reported on is designated school officials’ access to SEVIS. In 2011,  CTCEU provided SEVP officials with a position paper expressing  concerns that designated school officials, who are not required to  undergo security background checks, are responsible for maintaining  updated information on foreign students in SEVIS. Investigators at three  of the eight field offices we interviewed said that SEVP allowed  designated school officials to maintain SEVIS access and the ability to  modify records in the system while being the subject of an ongoing  criminal investigation, despite requests from CTCEU to terminate SEVIS  access for these officials. In addition, CTCEU collects data on its  outreach efforts with schools through its Campus Sentinel program;  however, the SEVP Director stated that his office had not obtained and  analyzed reports on the results of these visits. CTCEU initiated Campus  Sentinel in 2011, which ICE operates across all of its field offices  nationwide.conducted 314 outreach visits to schools. According to CTCEU  investigators, these visits provide an opportunity to identify potential risks,  including whether schools have the capacity and resources to support   From October 1, 2011, through March 6, 2012, CTCEU  programs for foreign students. Obtaining information on lessons learned  from CTCEU investigators could help provide SEVP with additional  insights on such issues as characteristics of schools that have committed  fraud and the nature of those schools’ fraudulent activities.
To address these issues, we recommended that ICE develop and  implement a process to identify and assess risks in SEVP, including  evaluating prior and suspected cases of school noncompliance and fraud  to identify potential trends, and obtaining and assessing information from  CTCEU and ICE field office investigative and outreach efforts. DHS  concurred and stated that ICE will develop and implement such a process  by later this year.
section_title: Weaknesses in ICE’s Monitoring and Oversight of SEVP- Certified Schools Contribute to Security and Fraud Vulnerabilities
paragraphs: ICE has not consistently implemented existing internal control procedures  for SEVP in four areas: (1) initial verification of evidence submitted in lieu  of accreditation, (2) recordkeeping to ensure schools’ continued eligibility,  (3) ongoing compliance monitoring of school licensing and accreditation  status, and (4) certification of schools offering flight training. Regulations  require schools to establish that they are legitimate and meet other  eligibility criteria for their programs to obtain certification from ICE. In  addition, weaknesses in managing and sharing key information with  CTCEU impede SEVP’s prevention and detection of school fraud. The  following summarizes these key findings and recommendations we made  to address these issues.
Initial verification of evidence submitted in lieu of accreditation. ICE  requires schools to present evidence demonstrating that the school is  legitimate and is an established institution of learning or other recognized  place of study, among other things. Non-accredited, post-secondary  schools, in particular, must provide “in lieu of” letters, which are evidence  provided by petitioning schools in lieu of accreditation by a Department of  Education-recognized accrediting agency. ICE policy and guidance  require that SEVP adjudicators render an approval or denial of schools’  petitions based on such evidence and supporting documentation. This  includes verifying that schools’ claims in the Form I-17, such as  accreditation status and “in lieu of” letters, are accurate. However, SEVP  adjudicators have not verified all “in lieu of” letters submitted to ICE by the  approximately 1,250 non-accredited, post-secondary schools, as required  by ICE’s policy. Rather, adjudicators decide whether to verify a letter’s  source and the signatory authority of the signee based on any suspicions  of the letters’ validity. Investigators at one of the eight ICE field offices we  interviewed stated SEVP officials certified at least one illegitimate  school—Tri-Valley University in California—because the program had not  verified the evidence provided in the initial petition. In March 2012,  CTCEU officials stated that several of their ongoing investigations involve  schools that provided fraudulent evidence of accreditation or evidence in  lieu of accreditation to ICE. Consistent verification of these letters could  help ICE ensure that schools are legitimate and detect potential fraud  early in the certification process. We recommended that ICE consistently  implement procedures for ensuring schools’ eligibility, including  consistently verifying “in lieu of” letters. DHS agreed and stated that  SEVP personnel have initiated mandatory verification of all “in lieu of”  letters.
Recordkeeping to ensure continued eligibility of schools. ICE’s  standard operating procedures for recordkeeping require SEVP officials  to maintain records to document ongoing compliance. We reported that  ICE had not consistently maintained certain evidence of selected schools’  eligibility for the program. According to our review of a stratified random  sample of 50 SEVP-certified school case files, 30 files did not contain at  least one piece of evidence required by the program’s policies and  procedures. In addition, ICE was unable to produce two schools’ case  files that we requested as part of our randomly selected sample. Without  the schools’ information and evidence contained in these case files,  including attestation statements and site visit reports, ICE does not have  an institutional record to provide reasonable assurance that these schools  were initially and continue to be legitimate and eligible for certification.  According to ICE officials, the school recertification process would help  address issues with incomplete and missing school files because schools  are required to resubmit all evidence required by regulation when going  through recertification. The Border Security Act required recertification for  all SEVP-certified schools by May 2004 and every 2 years thereafter.
However, ICE began the first recertification cycle in May 2010 and did not  recertify all schools during this 2-year cycle, which ended in May 2012. As  of March 31, 2012, ICE reported to have recertified 1,870 schools  (approximately 19 percent of SEVP-certified schools). Given the delays in  completing recertification, ICE is not positioned to address gaps in  SEVP’s case files and cannot provide reasonable assurance that schools  that were initially certified to accept foreign students are still compliant  with SEVP regulations. Thus, we recommended that ICE establish a  process to identify and address all missing school case files, including  obtaining required documentation for schools whose case files are  missing evidence. DHS concurred and stated that SEVP plans to work  with ICE Records Management to develop protocols and actions to  strengthen records management.
Ongoing compliance monitoring of school licensing and  accreditation status. ICE does not have a process to monitor the  ongoing eligibility of licensed and accredited, non-language schools  enrolling foreign students. ICE regulations require all certified schools to  maintain state licensing (or exemption) and provide various forms of  evidence to ICE supporting schools’ legitimacy and eligibility. If a school  loses its state license, the school would be unable to operate legally as a  school within that state. However, ICE does not have controls to ensure  that SEVP compliance unit officials would be aware of this issue;  therefore, a school without a proper business license may remain certified  to enroll foreign students and its designated school officials may continue  to access SEVIS. We recommended that ICE develop and implement a  process to monitor state licensing and accreditation status of all SEVP- certified schools. DHS concurred and stated that SEVP personnel are  developing procedures to ensure frequent validation of license or  accreditation information.
Certification of schools offering flight training. ICE’s policies and  procedures require flight schools to have Federal Aviation Administration  (FAA) Part 141 or 142 certification to be eligible for SEVP certification;  however, ICE has certified schools offering flight training without such  FAA certifications. As the federal agency responsible for regulating safety  of civil aviation in the United States, FAA administers pilot certification  (licensing) and conducts safety oversight of pilot training. FAA’s  regulations for pilot training and certification are found in three parts— Parts 61, 141, and 142. ICE established a policy that requires Part 141  and 142 for eligibility in SEVP because FAA directly oversees these flight  schools and training centers on an ongoing basis. We reported  identifying 434 SEVP-certified schools that, as of December 2011, offer  flight training to foreign students. However, 167 (38 percent) of these  flight training providers do not have FAA Part 141 or 142 certification.  SEVP senior officials acknowledged that all SEVP-certified schools  offering flight training do not have FAA Part 141 or 142 certification even  though the program requires it. ICE indicated that in most of the cases, it  may have initially certified flight schools with Part 141 or 142 certification  but the schools allowed their FAA certification to expire, and ICE did not  identify or take compliance action against them. ICE is taking actions to  address noncompliant flight schools as of May 2012, including notifying  all SEVP-certified schools that do not have the required FAA certification  that they must re-obtain the certification. Moreover, SEVP officials stated  that they plan to coordinate with FAA to determine which schools have  not met the requirements and will take withdrawal actions against them.  While these are positive steps, we reported that SEVP had not yet  established target time frames for implementing and completing these  planned actions. Because ICE has certified or maintained certification of  schools that provide flight training without the required FAA certification  and oversight, the program is vulnerable to security and fraud risks. Thus,  we recommended that ICE establish target time frames for notifying  SEVP-certified flight schools that do not have the required FAA  certification that they must re-obtain FAA certification. DHS concurred  and stated that SEVP is consulting with FAA to develop target time  frames.
Coordination among SEVP, CTCEU, and ICE field offices. ICE has not  consistently followed the standard operating procedures that govern the  communication and coordination process among SEVP, CTCEU, and ICE  field offices. Specifically, these procedures delineate roles and  responsibilities for criminal investigations and establish protocols for  SEVP taking administrative actions against schools during and following a  criminal investigation. In some instances, SEVP management has not  followed CTCEU requests to take or cease administrative actions and has  not referred potentially criminal cases to CTCEU in accordance with ICE’s  procedures. By strengthening coordination and communication between  SEVP and CTCEU, ICE could better ensure that SEVP, CTCEU, and ICE  field offices understand which information to share regarding whether to  take administrative actions during criminal investigations and that clear  criteria exist for referring cases from CTCEU based upon potentially  criminal behavior. Thus, we recommended that ICE revise its standard  operating procedure to specify which information to share among  stakeholders during criminal investigations. DHS concurred and stated  that SEVP will work with CTCEU and ICE field personnel to make the  necessary revisions. We also recommended that ICE establish criteria for  referring cases of a potentially criminal nature from SEVP to CTCEU. ICE  agreed and stated that SEVP will work with CTCEU to improve this  process.
Chairman Schumer, Ranking Member Cornyn, and members of the  subcommittee, this concludes my prepared statement. I would be pleased  to answer any questions that you may have at this time.
section_title: Contacts and Acknowledgments
paragraphs: For further information regarding this testimony, please contact Rebecca  Gambler at (202) 512-8777, or gamblerr@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals who made key  contributions to this testimony are Kathryn Bernet, Assistant Director;  Frances Cook; Elizabeth Dunn; Anthony C. Fernandez; David Greyer;  and, Lara Miklozek.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.