Education Financial Management: Weak Internal Controls Led to Instances of Fraud and Other Improper Payments
Released: 2002-04-10T00:00:00

Letter

Controls over Grants Disbursement Process Failed to Detect Certain Improper Payments

As we testified in July 2001, controls over grant and loan disbursements did not include a key edit check or follow-up process that would help identify schools that were disbursing Pell Grants to ineligible students. To identify improper payments that may have resulted from the absence of these controls, we performed tests to identify students 70 years of age and older because we did not expect large numbers of older students to be receiving Pell Grants, and in 1993, we identified abuses in the Pell Grant program relating to older students. Based on the initial results of our tests and because of the problems we identified in the past, we expanded our review of 7 schools that had disproportionately high numbers of older students to include recipients 50 years of age and older. We found that 3 schools fraudulently disbursed about $2 million of Pell Grants to ineligible students, and another school improperly disbursed about $1.4 million of Pell Grants to ineligible students. We also identified 31 other schools that had similar disbursement patterns to those making the payments to ineligible students. These 31 schools disbursed approximately $1.6 million of Pell Grants to potentially ineligible students. We provided information on these schools to Education for follow-up.

Education staff and officials told us that they have performed ad hoc reviews in the past to identify schools that disbursed Pell Grants to ineligible students and have recovered some improper payments as a result. However, Education did not have a formal, systematic process in place specifically designed to identify schools that may be improperly disbursing Pell Grants. In September 2001, we issued an interim report in which we recommended that the Secretary of Education (1) establish appropriate edit checks to identify unusual grant and loan disbursement patterns and (2) design and implement a formal, routine process to investigate unusual disbursement patterns identified by the edit checks.

In our July 2001 testimony, we told you that Education decided to implement a new edit check, effective beginning with the 2002-2003 school year to identify students who are 85 years of age or older. We explained that we believed the age limit was too high and would exclude many potential ineligible students. Education subsequently lowered the age limit for that edit to 75 years of age or older. If the student’s date of birth indicates that he or she is 75 years of age or older, the system edit will reject the application and the school will not be authorized to give the student federal education funds until the student either submits a corrected date of birth or verifies that it is correct. However, without also looking for unusual patterns and following up, the edit may not be very effective, other than to correct data entry errors or confirm older students applying for aid.

Education is also in the process of implementing a new system, called the Common Origination and Disbursement (COD) system, which is to become effective starting this month. Education officials told us that this integrated system will replace the separate systems Education has used for Pell Grants, direct loans, and other systems containing information on student aid, and it will integrate with applicant data in the application processing system. The focus of COD is to improve program and data integrity. If properly implemented, a byproduct of this new system should be improved controls over grant and loan disbursements. According to Education officials, they will be able to use COD to identify schools with characteristics like those we identified. However, until there is a mechanism in place to investigate schools once unusual patterns are identified, Education will continue to be vulnerable to the types of improper Pell Grant payments we identified during our review.

We identified over $32 million of other potentially improper grant and loan payments. Based on supporting documentation provided to us by Education, we determined that over $21 million of these payments were proper. However, because Education did not provide adequate supporting documentation, we were unable to determine the validity of about $12 million of these transactions or conclude on the effectiveness of the related edit checks. While the amount of improper and potentially improper grant and loan payments we identified is relatively insignificant compared to the billions of dollars disbursed for these programs annually, it represents a control risk that could easily be exploited to a greater extent.

During our investigation of potentially improper transactions, we found that two students submitted counterfeit Social Security cards and fraudulent birth certificates along with their applications for federal education aid, and they received almost $55,000 in direct loans and Pell Grants. The U.S. Attorney’s Office is considering prosecuting these individuals.

During our tests to determine the effectiveness of Education’s edit checks, we also found data errors, such as incorrect social security numbers (SSN) of borrowers, in the Loan Origination System (LOS), which processes all loan origination data received from schools. Such errors could negatively affect the collection of student loans because without correct identifying information, Education may not be able to locate and collect from borrowers when their loans become due. We reviewed data for more than 1,600 loans and determined that for almost 500 of these loans, the borrowers’ SSNs or dates of birth were incorrect in LOS. During the application process, which is separate from the loan origination process, corrections to items such as incorrect SSNs are processed in the Central Processing System (CPS); however, these corrections are not made to data in LOS. The new COD system discussed earlier may alleviate this situation. If this system works as intended, student data should be consistent among all of the department’s systems, including CPS and LOS, because it will automatically share corrected data. However, until the new system is fully implemented, errors in LOS could impede loan collection efforts.

Ineffective Controls over Third Party Drafts Led to Their Elimination

As we testified in April and July 2001, significant internal control weaknesses over Education’s process for third party drafts markedly increased the department’s vulnerability to improper payments. Although segregation of duties is one of the most fundamental internal control concepts, we found that some individuals at Education could control the entire payment process for third party drafts. We also found that Education employees circumvented a key computer system application control designed to prevent duplicate payments. We tested third party draft transactions and identified $8.9 million of potential improper payments, $1.7 million of which remain unresolved because Education was unable to provide us with adequate supporting documentation. Education has referred the $1.7 million to the OIG for further investigation. Because of the risks we identified in the third party draft payment process, and in response to a letter from this subcommittee, Education took action in May 2001 to eliminate the use of third party drafts.

Poor Controls over Government Purchase Cards Resulted in Some Fraudulent, Improper, and Questionable Purchases

In our July 2001 testimony before this subcommittee, we described internal control weaknesses over Education’s purchase card program, including lack of supervisory review and improper authorization of transactions. We found that Education’s inconsistent and inadequate authorization and review processes for purchase cards, combined with a lack of monitoring, created an environment in which improper purchases could be made with little risk of detection. Inadequate control over these expenditures, combined with the inherent risk of fraud and abuse associated with purchase cards, resulted in fraudulent, improper, and questionable purchases, totaling about $686,000, by some Education employees.

During the time of our review, Education’s purchase card program was operating under policies and procedures that were implemented in 1990. The policy provided very limited guidance on what types of purchases could be made with the purchase cards. While the policy required each cardholder and approving official to receive training on their respective responsibilities, we found that several cardholders and at least one approving official were not trained. In addition, we found that only 4 of Education’s 14 offices required cardholders to obtain authorization prior to making some or all purchases, although Education’s policy required all requests to purchase items over $1,000 be made in writing to the applicable department Executive Officer. We also found that approving officials did not use monitoring reports that were available from Bank of America to identify unusual or unauthorized purchases and that only limited use was made of available mechanisms to block specific undesirable Merchant Category Codes (MCC). These factors combined resulted in a lax control environment for this inherently risky program.

Education officials told us the department relied on the approving official’s review of the cardholder’s monthly purchase card statements to ensure that all purchases made by employees were proper. We tested the effectiveness of the approving officials’ review of 5 months of cardholder statements. We reviewed all 903 monthly statements that were issued during these months, totaling about $4 million, and found that 338, or 37 percent, totaling about $1.8 million, were not approved by the appropriate approving official. To determine whether improper purchases were made without being detected, we requested documentation supporting the $1.8 million of purchases that were not properly reviewed. We also requested documentation for other transactions that appeared unusual. We reviewed the documentation provided by Education and identified some fraudulent, improper, and questionable purchases, which I will discuss in a moment.

We considered fraudulent purchases to be those that were unauthorized and intended for personal use. Improper purchases included those for government use that were not, or did not appear to be, for a purpose permitted by law or regulation. We also identified as improper purchases those made on the same day from the same vendor that appeared to circumvent cardholder single purchase limits. We defined questionable transactions as those that, while authorized, were for items purchased at an excessive cost, for a questionable government need, or both, as well as transactions for which Education could not provide adequate supporting documentation to enable us to determine whether the purchases were valid.

We found one instance in which a cardholder made several fraudulent purchases from two Internet sites for pornographic services. The purchase card statements contained handwritten notes next to the pornography charges indicating that these were charges for transparencies and other nondescript items. According to the approving official, he was not aware of the cardholder’s day-to-day responsibilities and did not feel that he was in a position to review the monthly statements properly. The approving official stated that the primary focus of his review was to ensure there was enough money available in that particular appropriation to pay the bill. As a result of investigations related to these purchases, Education management issued a termination letter that prompted the employee to resign.

We identified over $140,000 of improper purchases. For example, one employee made improper charges totaling $11,700 for herself and a coworker to attend college classes that were unrelated to their jobs at the department. We also identified improper purchases totaling $4,427 from a restaurant in San Juan, Puerto Rico. These restaurant charges were incurred during a Year 2000 focus group meeting, and included breakfasts and lunches for federal employees and nonfederal guests. Education, however, could not provide us with any evidence that the nonfederal attendees provided a direct service to the government, which is required by federal statute in order to use federal appropriated funds to pay for the costs of nonfederal individuals at such meetings. We have referred this matter to Education’s OIG.

Other examples of improper purchases we identified include 28 purchases totaling $123,985 where Education employees made multiple purchases from a vendor on the same day. These purchases appear to violate the Federal Acquisition Regulation provision that prohibits splitting purchases into more than one segment to circumvent single purchase limits. For example, one cardholder purchased two computers from the same vendor at essentially the same time. Because the total cost of these computers exceeded the cardholder’s $2,500 single purchase limit, the total of $4,184.90 was split into two purchases of $2,092.45 each. In some instances, Education officials sent memos to the offending cardholders reminding them of the prohibition against split purchases. We identified five additional instances, totaling about $17,000, in which multiple purchases were made from a single vendor on the same day. Although we were unable to determine based on the available supporting documentation whether these purchases were improper, these transactions share similar characteristics with the 28 split purchases.

We identified questionable purchases totaling $286,894 where Education employees paid for new office furniture and construction costs to renovate office space that they were planning to vacate. Only a small amount of furniture, including chairs for employees with special needs, was moved to the new building when department employees relocated.

In addition, we identified as questionable more than $218,000 of purchases for which Education provided us with no support or inadequate support to assess the validity. For $152,000, Education could not provide any support, nor did the department know specifically what was purchased, why it was purchased, or whether these purchases were appropriate. For the remaining $66,000, Education was able to provide only limited supporting documentation. As a result, we were unable to assess the validity of these payments, and we consider these purchases to be potentially improper.

After our July 2001 testimony, we issued an interim report, that described the poor internal controls over purchase cards and made recommendations that the department reiterate to all employees established policies regarding the appropriate use of government purchase cards; strengthen the process of reviewing and approving purchase card transactions, focusing on identifying split purchases and other inappropriate transactions; and expand the use of MCCs to block transactions with certain vendors.

Recently, Education has made some changes in the way it administers its purchase card program in an effort to address these three recommendations. For example, in December 2001, the department issued new policies and procedures that, among other things, (1) establish detailed responsibilities for the cardholder and the approving official, (2) prohibit personal use of the card and split purchases to circumvent the cardholder’s single purchase limits, (3) require approving officials to review the appropriateness of individual purchases, (4) establish mandatory training prior to receiving the card and refresher training every 2 years, and (5) establish a quarterly quality review of a sample of purchase card transactions to ensure compliance with key aspects of the department’s policy. If appropriately implemented, these new policies and procedures are a good step toward reducing Education’s vulnerability to future improper purchases.

Further, in July 2001, the department implemented a new process to approve purchase card purchases. Instead of the approving official signing a monthly statement indicating that all transactions are proper, the approval is now done electronically for each individual transaction. According to Education officials, most approving officials and cardholders received training on this new process. In order to assess the effectiveness of this new approval process, we reviewed a statistical sample of the monthly statements of cardholders for July, August, and September 2001. Purchases during these months totaled $1,881,220. While we found evidence in the department’s system that all of the 87 statistically sampled monthly statements had been reviewed by the cardholder’s approving official, 20 of the statements had inadequate or no support for items purchased, totaling $23,151. Based on our work, we estimate the most likely amount of unsupported or inadequately supported purchases during these 3 months is $65,817. The effectiveness of the department’s new approval process has been minimized because approving officials are not ensuring that adequate supporting documentation exists for all purchases. In addition, these procedures do not address the problem of an authorizing official who does not have personal knowledge of the cardholder’s daily activities and therefore is not in a position to know what types of purchases are appropriate.

In response to our recommendation regarding the use of MCCs to block transactions from certain vendors, in November 2001, the department implemented blocks on purchases from a wide variety of merchants that provide goods and services totally unrelated to the department’s mission, including veterinary services, boat and snowmobile dealers, and cruise lines. In total, Education blocked more than 300 MCCs. By blocking these codes, Education has made use of a key preventive control to help reduce its exposure to future improper purchases.

As we told you in our July 2001 testimony, Education took action earlier in 2001 to improve internal controls related to the use of government purchase cards by lowering the maximum monthly spending limit to $30,000, lowering other cardholders’ single purchase and total monthly purchase limits, and revoking some purchase cards. This action was in response to a letter from this subcommittee dated April 19, 2001, which highlighted our April 2001 testimony, in which we stated that some individual cardholders had monthly purchase limits as high as $300,000. These and the other steps I just discussed have helped reduce Education’s exposure to improper purchase card activities. However, more needs to be done to improve the approval function, which is key to adequate control of these activities.

Poor Controls Contributed to Loss of Computer Equipment

Education lacked adequate internal controls over computers acquired with purchase cards and third party drafts which contributed to the loss of 179 pieces of computer equipment with an aggregate purchase cost of about $211,700. From May 1998 through September 2000, Education employees used purchase cards and third party drafts to purchase more than $2.9 million of personal computers and other computer-related equipment. Such purchases were actually prohibited by Education’s purchase card policy in effect at the time.

The weak controls we identified over computers acquired with purchase cards and third party drafts included inadequate physical controls— according to Education’s OIG, the department had not taken a comprehensive physical inventory for at least 2 years prior to October 2000—and lack of segregation of duties, which is one of the most fundamental internal controls. In the office where most of the missing equipment was purchased, two individuals had interchangeable responsibility for receiving more than $120,000 of computer equipment purchased by a single cardholder, from one particular vendor. In addition, these two individuals also had responsibility for bar coding the equipment, securing the equipment in a temporary storage area, and delivering the computers to the users. Furthermore, one of these two individuals was responsible for providing information on computer purchases to the person who entered the data into the department’s asset management system. According to the cardholder who purchased the equipment, they did not routinely compare the purchase request with the receiving documents from the shipping company to ensure that all items purchased were received. In addition, our review of records obtained from the computer vendor from which Education made the largest number of purchase card and third party draft purchases showed that less than half of the $614,725 worth of computers had been properly recorded in the department’s property records, thus compounding the lack of accountability over this equipment. Combined, these weaknesses created an environment in which computer equipment could be easily lost or stolen without detection.

In order to identify computers that were purchased with purchase cards and third party drafts that were not included in the department’s asset management system, we obtained the serial numbers of all pieces of computer equipment purchased from the largest computer vendor the department used. We compared these serial numbers to those in the department’s asset management system and found that 384 pieces of equipment, including desktop computers, scanners, and printers totaling $399,900, appeared to be missing. In September 2001, we conducted an unannounced inventory to determine whether these computers were actually missing or were inadvertently omitted from the property records. We located 143 pieces of equipment that were not on the property records, valued at about $138,400, and determined that 241 pieces, valued at about $261,500, were missing at that time.

After we completed our work in this area, we again visited the office where most of the computer equipment was missing because Education officials told us they had located some of the missing inventory. Officials in this office told us that they hired a contractor to keep track of their computers when the office moved to its new space. According to the officials, as part of its work, the contractor recorded the serial numbers of all computers moved and identified 86 of the 241 pieces of computer equipment that we were unable to locate during our unannounced inventory in September 2001. However, when Education staff and officials tried to locate this equipment, they were only able to find 73 of the 86 pieces of equipment. When we visited, we located only 62 of the 73 pieces of equipment. Education officials have been unable to locate the remaining 179 pieces of missing computer equipment with an acquisition value of about $211,700. They surmised that some of these items may have been surplused; however, there is no paperwork to determine whether this assertion is valid.

According to Education officials, new policies have been implemented that do not allow individual offices to purchase computer equipment without the consent of the Office of the Chief Information Officer (OCIO). However, during our previously mentioned review of a statistical sample of purchase card transactions made from July 2001 through September 2001, we found three transactions totaling $2,231 for the purchase of computer equipment without any supporting documentation from the OCIO. Based on these results, the new policies are not being effectively implemented. This is another indication that the new purchase card approval function is not fully operating as an effective deterrent to improper purchases.

In January 2002, we also reviewed the new computer ordering and receiving processes in the office where most of the missing equipment was purchased and found mixed results. These new policies are designed to maintain control over the procurement of computers and related equipment and include purchasing computers from preferred vendors that apply the department’s inventory bar code label and record the serial number of each computer on a computer disk that is sent directly to the Education official in charge of the property records; loading the computer disk containing the bar code, serial number, and description of the computer into the property records; and having an employee verify that the computers received from the vendor match the serial numbers and bar codes on the shipping documents and the approved purchase order.

However, a continued lack of adequate physical control negates the effectiveness of these new procedures. For example, the doors to the two rooms used to store computer equipment waiting to be installed were both unlocked and unattended. The receptionist at the mail counter next to the first storage room we visited told us that he had the door open to regulate the room temperature. The Education official responsible for this process stated that he did not know that mailroom personnel had access to this room. Furthermore, he stated that he does not have a key to either storage room. Also, during our second search for this equipment, we visited four rooms where some of the computers were stored and found them all unsecured.