The Department of Education’s mission is to ensure equal access to education and to promote educational excellence throughout the nation. Education does this, in part, by disbursing billions of dollars each year in grants and loans to school districts, state education agencies, organizations, and individuals. Appendix I describes the various grant and loan programs and the amounts disbursed for these programs during the period we reviewed. In supporting its mission, Education also paid close to a billion dollars in fiscal year 2000 to various contractors and vendors for goods and services, including computers and supplies. Education used various payment methods for these expenses, including third party drafts and government purchase cards. The following table shows the amounts disbursed in fiscal year 2000 for the various grant and loan programs and the amount of expenses paid by third party drafts and government purchase cards. Education funds for various grants go directly to the recipients—state education agencies, schools, individuals, and school districts—and are to be used by the recipients for the stated purposes. Education disburses funds for Pell Grants and direct loans, which help finance the higher education of millions of students, directly to schools. The schools are responsible for determining student eligibility for these funds and for disbursing the grants and loans to students. The disbursement process for these grants and loans relies extensively on various computer information systems within Education and their related computer application controls. Each student applying for federal financial aid must complete an application form, either electronically or on a paper copy. This application includes information that is used to determine eligibility. The application information goes directly into Education’s Central Processing System (CPS) if submitted electronically, or to a contractor for data entry into CPS if a paper copy is submitted. CPS matches the student data against several databases at other agencies, such as the Social Security Administration (SSA), the Immigration and Naturalization Service, the Selective Service System, and the Department of Veterans Affairs. Errors can occur if the student submits wrong information or the information on the application was not entered correctly in CPS. If discrepancies are found, the application is rejected or identified for follow-up. Generally, the school to which the student applied must have correct data before it can disburse federal Education funds to the student. However, the school can disburse funds to the student without waiting for submitted corrections to be processed in the system. Third party drafts are check-like instruments drawn on and paid by a financial institution or outside contractor. Agencies receive the drafts from the institution or contractor that maintains the agency account and may use them as an alternative to imprest funds. Education originally used third party drafts to pay field readers—non-Education employees who review grant applications. By May 1999, Education’s policy allowed the use of third party drafts to pay for a wide variety of other expenses including employee local travel reimbursements, fuel and maintenance for government vehicles, and other “small purchases.” The Executive Officer in each of Education’s principal offices determined who had signature authority. Third party drafts could be issued for up to $10,000—a limitation that is printed on the face of each draft. Following our April 2001 testimony before the Subcommittee on Select Education, and in response to a letter from the Chairman and Vice-Chairman of the subcommittee, Education took action in May 2001 to eliminate the use of third party drafts. Government purchase cards, a type of credit card, are available to federal agencies under a General Services Administration (GSA) contract and are to be used to make small purchases with minimal paperwork. The Department of the Treasury requires agencies to establish approved uses and limitations on the types of purchases and dollar amounts. During the period of our review—May 1998 through September 2000—Education’s purchase card program was operating under a policy dated March 1990. This policy stated that purchase cards could be used to buy various small items such as supplies not available from the GSA Customer Supply Center. The policy prohibited purchases for nonexpendable property, such as desks, chairs, tables, and personal computers. Education’s purchase card policy stated that an approving official was to ensure that all credit card transactions were for authorized Education purchases and in accordance with departmental and other federal regulations. The approving official signified that a cardholder’s purchases were appropriate by reviewing and signing monthly statements. Education’s 1990 written policy did not establish specific dollar limits for either the cumulative purchases in a given month or the total for a single purchase, known as the monthly purchase limit and single purchase limit, respectively. As of January 2001, single purchase limits for individual cardholders, which were established by each principal office, ranged from $500 to $80,000, and their monthly limits ranged from $1,500 to $300,000. Currently, both single and monthly limits range from $500 to $30,000. Bank of America currently services the purchase card program at Education. During the time frame of our review, each individual principal office made its own purchases of computers and related equipment on a decentralized basis. There were no established policies that required approvals from the Office of the Chief Information Officer (OCIO). In July 2000, Education issued new written procedures for computer asset management. The procedures state that a new position, asset manager, will be established in OCIO. The procedures further state that principal offices are required to use only vendors approved by the department. Education is to request that these vendors bar code equipment before delivering it to the department with bar codes provided by the new asset manager. Vendors are to electronically submit a list of equipment with serial numbers and bar codes, which will be entered into the new Asset Management System before the equipment is delivered. The new procedures also modify procedures for controlling computer equipment that leaves any Education building. Security guards are to verify that anyone taking computer equipment from the building has been authorized to do so and has an appropriate property pass. Internal control is a major part of managing an organization. As mandated by the Federal Managers’ Financial Integrity Act of 1982, the Comptroller General issues standards for internal control in the federal government. These standards provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives. Internal control is the first line of defense in safeguarding assets and preventing and detecting fraud and errors. Internal control, which is synonymous with management control, helps government program managers achieve desired results through effective stewardship of public resources. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives and help ensure that actions are taken to address risks. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achieving effective results. They include a wide range of diverse activities. Some examples of control activities include controls over information processing, physical control over vulnerable assets, segregation of duties, proper execution of transactions and events, and access restrictions to and accountability for resources and records. Management should design and implement internal control based on the related costs and benefits. No matter how well designed and operated, internal control cannot provide absolute assurance that all agency objectives will be met, and thus, once in place, internal control provides reasonable, not absolute, assurance of meeting agency objectives. The objectives of our review were to assess internal controls in place from May 1998 through September 2000 and to identify any fraudulent or otherwise improper payments that may have resulted from control weaknesses in Education’s processes for (1) disbursing grants and loans, (2) paying for purchases with third party drafts, and (3) use of government purchase cards. In addition, our objective was to assess Education’s physical controls over its computer equipment from May 1998 through September 2000 and identify any effects of weak controls. Further, at your request, we assessed the effectiveness of recent changes to Education’s process for purchase card purchases, which took effect in July 2001 following our testimony before the subcommittee. To identify and assess internal controls over Education’s (1) disbursement process for grants and loans and (2) processes for paying for purchases with third party drafts and government purchase cards, we obtained an understanding of the processes, interviewed staff and officials in the Office of Chief Financial Officer (OCFO) and program offices, and performed walk-throughs of the processes. We also reviewed Education’s policies and procedures and reviewed our own reports and those by Education’s OIG and independent auditors. To identify potential improper payments, we requested and obtained payment data and other supporting data from Education and sources external to the department, including SSA, Rocky Mountain Bank, and Bank of America; contracted with forensic and information risk management experts; and used an automated approach, including database searches, file comparisons, and other detailed analyses, to identify unusual transactions and payment patterns that may be improper. For those payments that we identified as potentially improper, we requested and analyzed supporting documentation to assess their propriety. To assess Education’s controls over computer equipment, we conducted an unannounced search for computers and their related components that were purchased with government purchase cards and third party drafts and were not included in Education’s asset management system inventory. To assess the effectiveness of recent changes in Education’s process for approving purchase card purchases, we reviewed a statistical sample of cardholders’ monthly statements for July, August, and September 2001. While we identified some fraudulent and improper payments, our work was not designed to identify all fraudulent or otherwise improper payments throughout the department. Appendix II provides further details on our scope and methodology. We conducted our work from August 2000 through February 2002, in accordance with generally accepted government auditing standards, as well as with investigative standards established by the President’s Council on Intergrity and Efficiency. We requested comments on a draft of this report from the Secretary of Education or his designee. Written comments were received from the Deputy Secretary and are reprinted in appendix III. Education’s grant and loan disbursement process relies on computer systems application controls, or edit checks, to help ensure the propriety of payments. We focused our review on these edit checks and related controls because they are key to helping prevent or detect improper payments in an automated process. In our testing of the effectiveness of Education’s controls, we found that the department lacked a key edit check and follow-up process that would help identify schools that were disbursing Pell Grants to ineligible students. As a result of our tests and follow-up investigation, we identified 3 schools that fraudulently disbursed about $2 million of Pell Grants. These schools produced fraudulent documentation to support the grants. We also identified another school that improperly disbursed about $1.4 million of Pell Grants to ineligible students. In addition, we identified 31 other schools with similar characteristics that we referred to Education for follow-up. In testing whether existing edit checks were working effectively or whether additional edit checks were needed, we found other grant and loan payments that were potentially improper. However, because Education did not provide adequate supporting documentation, we were unable to determine the validity of these transactions or conclude on the effectiveness of the related edit checks. We also found that a system used in the loan origination process contained erroneous data on some students that could affect the ability of the department to collect those student loans. In April 2002, Education plans to implement a new grant and loan disbursement system designed to improve controls and reduce the risk of future improper grant payments. Education’s CPS for student aid applications lacked an edit that would identify students who were older than would typically be expected. In addition, the department lacked a formal, systematic process to follow up on unusual disbursement patterns identified by such an edit. To identify improper payments that may have resulted from the absence of these controls, we identified schools that disbursed Pell Grants over multiple years to students 70 years of age or older. We chose to test for students of this age because we did not expect large numbers of older students to be receiving Pell Grants. We identified 707 schools that had disbursed more than 4,500 Pell Grants totaling about $7 million to students 70 years of age and older during the period covered by our review. Based on the initial results of our test and because of the problems we had identified in the past, we decided to expand our review of 7 of the 707 schools that had disproportionately high numbers of older students to include recipients 50 years of age or older. Our Office of Special Investigations investigated 4 of these 7 schools and found that they disbursed approximately $3.4 million in Pell Grants to ineligible students during this period. These students were ineligible because their primary course of study was English as a second language (ESL), and they were not seeking degrees or certificates. Further, most of the students interviewed during the investigation said that they were not working and were studying English in order to improve their speaking abilities, not to obtain a degree or certificate. The investigation disclosed that 3 schools generated fraudulent student admissions documents to create the appearance that students who were not in fact seeking degrees were participating in degree programs. We investigated 2 of these 4 schools in 1993 and found similar activities, including the falsification of student records. The remaining 3 schools disbursed approximately $450,000 in Pell Grants and warranted additional review because they also had unusually high concentrations of older students who were potentially ineligible. We have formally referred the information on these 3 schools, as well as the results of our investigations of the 4 schools discussed above, to Education’s OIG for appropriate follow-up. To determine whether the other 700 schools made improper Pell Grant payments to students 70 years of age and older, we asked Education to provide us with documentation supporting the students’ eligibility. Education requested documentation from these schools. The department provided us with student transcripts and other data from less than half of the 700 schools. Based on our review of the documentation we received, we identified 19 additional schools that disbursed Pell Grants to large numbers of students who were 70 years of age or older and whose course of study was mainly ESL. These 19 schools made disbursements totaling about $573,000 to these students during the period of our review. We also identified 9 other schools, based solely on data from the Pell Grant system, that had similar disbursement patterns to those making the payments to ineligible students. These 9 schools did not provide supporting documentation for approximately $547,000 in Pell Grant disbursements. We provided information on these 28 schools to Education for follow-up. Education staff and officials told us that they have performed ad hoc reviews in the past to identify schools that disbursed Pell Grants to ineligible students and have recovered some improper payments as a result. However, Education did not have a formal, systematic process in place specifically designed to identify schools that may be improperly disbursing Pell Grants. In September 2001, we issued an interim report in which we recommended that the Secretary of Education (1) establish appropriate edit checks to identify unusual grant and loan disbursement patterns and (2) design and implement a formal, routine process to investigate unusual disbursement patterns identified by the edit checks. This type of process would serve not only to detect fraudulent and otherwise improper payments, but would also act as a deterrent to others who may be inclined toward these types of activities. In response to our work, Education told us an edit was implemented in January 2002 in CPS, the application processing system, that will identify applications that indicate a student is 75 years of age or older. If the student’s date of birth indicates that he or she is 75 years of age or older, the system edit will reject the application and the school will not be authorized to give the student federal education funds until the student either submits a corrected date of birth or verifies that it is correct. However, without also looking for unusual patterns and following up, the edit may not be very effective, other than to correct data entry errors or confirm older students applying for aid. Education is also in the process of implementing a new system called Common Origination and Disbursement (COD) that is to be effective beginning in April 2002. Education officials told us that this integrated system will replace the separate systems Education has used for Pell Grants and direct loans and other systems containing information on student aid, and it will integrate with applicant data in CPS. The focus of COD is to improve program and data integrity. According to Education officials, they will be able to use COD to identify schools with characteristics like those we identified. However, until there is a mechanism in place to investigate schools once unusual patterns are identified, Education will continue to be vulnerable to the types of improper Pell Grant payments we identified during our review. We performed several additional tests of Education’s disbursements to identify potentially improper grant and loan payments that may not have been detected because of missing or ineffective edit checks. In addition to Pell Grant payments to students 70 years of age and older, we identified $28.8 million of other potentially improper grant and loan payments made by more than 1,800 schools to students who (1) were much older or younger than would be expected, (2) had social security numbers (SSN) that were either not in SSA’s database or were in SSA’s death records, or (3) received Pell Grants in excess of statutory limits. Based on supporting documentation provided to us by Education, we determined that $20.3 million of these payments were proper. Education did not, however, provide adequate supporting documentation to enable us to determine the validity of $8.5 million of these payments made by these schools. In addition, Education did not provide adequate supporting documentation for us to determine the validity of $3.5 million of Pell Grants disbursed to students 70 years of age and older, for a total of $12 million of grant and loan payments for which we could not determine the validity. Table 2 shows the amounts of potentially improper grant and loan payments we initially identified and the disposition of those amounts after we reviewed supporting documentation. Although Education officials told us they requested supporting documentation from the approximately 1,800 schools that disbursed these funds, over 1,000 schools did not provide the documentation, and documentation provided by some of the schools was inadequate for independent verification of the validity of these payments. According to Education officials, if a school that did not provide support or provided inadequate support had only a small number of potential improper payments, the department did not follow up because it did not consider doing so a wise use of its resources. We agree that Education should weigh the costs of resources required to follow up on potential improper payments with the benefits that could be obtained when making such decisions. However, 20 of the schools that did not provide support or provided inadequate support had from 20 to 138 instances of these potential improper payments totaling $1.5 million. Without following up with the schools that exhibit such patterns, Education is missing an opportunity to identify problem schools, including those that may be improperly disbursing Pell Grant funds. Because of this, we reaffirm our previous recommendation that Education design and implement a formal, routine process to investigate unusual disbursement patterns identified by the edit checks. During our investigation of potentially improper transactions, we did find that direct loans and Pell Grants provided to two students were obtained fraudulently. The students, two brothers, submitted counterfeit Social Security cards and fraudulent birth certificates along with their applications for federal education aid. They received almost $55,000 in direct loans and Pell Grants. We have referred them to Education’s OIG and SSA’s OIG. The U.S. Attorney’s Office is considering prosecuting these individuals. During our tests to determine the effectiveness of Education’s edit checks, we also found data errors, such as incorrect SSNs of borrowers, in the Loan Origination System (LOS). Such errors could negatively affect the collection of student loans because without correct identifying information, Education may not be able to locate and collect from borrowers when their loans become due. LOS processes all loan origination data received from schools and contains information on each loan and borrower. We reviewed data for more than 1,600 loans and determined that for almost 500 of these loans, the borrowers’ SSNs or dates of birth were incorrect in LOS. It is likely that many of these errors occurred during the loan origination process. As described earlier, when students apply for federal Education grants and loans, the information from their applications goes into the application processing system, CPS, which matches the student data against several databases at other agencies, including SSA. If the SSA match results indicate that the student’s SSN or date of birth is incorrect, the student is notified and asked to provide corrected data, which is input in CPS. However, these corrections are not made to data in LOS. Because Education’s loan collection system relies on data from LOS, Education’s ability to locate borrowers who have defaulted on their loans is negatively affected. The new COD system discussed earlier may alleviate this situation because it will replace separate systems, including LOS, and will interface with CPS. If this system works as intended, then student data will be consistent among all of the department’s systems because it will automatically share corrected data. However, until the new system is fully implemented, errors in LOS could impede loan collection efforts. Significant internal control weaknesses over Education’s process for third party drafts, which were used to pay expenses totaling $55 million from May 1998 through September 2000, increased the department’s vulnerability to improper payments. In testing the third party draft process, we found that (1) Education employees circumvented a key computer system application control and (2) some individuals could control the entire payment process because accounting duties were not properly segregated. Because of these weaknesses, we tested third party draft transactions and identified potential improper payments, many of which remain unresolved because Education was unable to provide us with adequate supporting documentation. Education has since canceled its third party draft program. The circumvented computer system application control, which was designed to avoid duplicate payments, was an edit in Education’s system indicating that an invoice number had already been entered into the system. Internal control standards require agencies to have adequate application controls such as automated edits that help ensure that transactions completed through computerized applications are valid, properly authorized, and completely and accurately processed and reported. Our review of one of Education’s procedures manuals disclosed that the department had created a procedure that allowed employees to circumvent this control. The manual instructed Education employees to add a suffix to the invoice or voucher number when the system indicated that a number had already been used. For example, if invoice number 123 had already been entered into the system, an employee could add the letter “a” to this invoice number and issue another third party draft or other payment mechanism related to the invoice. Education officials told us this procedure was implemented as a way to allow users to issue replacement drafts in the event the draft had to be reissued. However, it also significantly increased Education’s exposure to duplicate payments. We also found that it was common practice for Education employees to use multiple third party drafts to pay for purchases in excess of the $10,000 limit imprinted on the blank drafts. Education officials told us that they used multiple third party drafts to pay invoices greater than $10,000 primarily as a matter of convenience. For example, when it was necessary to research a transaction, Education officials told us that it was more convenient to have their own check numbers and copies of the checks on hand rather than having to review records of payments from Treasury. This process of using multiple third party drafts negated the control of limiting third party drafts to $10,000 and further exacerbated Education’s vulnerability to making improper payments. Another weakness in the third party draft process was inadequate segregation of duties; that is, some individuals could control the entire payment process. Segregation of duties is one of the most fundamental internal control concepts. To reduce the risk of fraud and other improper payments, key duties and responsibilities associated with the payment process need to be divided or segregated among different people. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling the related funds. We found that some individuals at Education could control the entire payment process for third party drafts. Forty-nine Education employees could request blank checks. Further, 21 of these 49 individuals could also access the system, generate a payment without prior obligation, print and sign the check, and submit it to the payee. Education officials told us this control was lacking because, as the department moved toward decentralization and flexibility, the responsibility for monitoring and enforcing the use of the third party drafts became inconsistent from one organization to another. Because these individuals had the capacity to control the entire payment process, the department was vulnerable to the possibility that third party drafts could be used to pay for personal expenses or other improper purchases. One of the primary risks Education was exposed to because of these internal control weaknesses was the risk of overpaying invoices. Based on our tests of third party draft transactions, we identified 268 instances, totaling approximately $8.9 million, in which multiple third party drafts were issued to the same payee with the same invoice number or on the same day. We reviewed the available supporting documents provided by Education for $7.2 million of these transactions and found no instances of overpayments. However, Education officials could not provide us with adequate supporting documentation to enable us to assess the validity of the remaining $1.7 million of these third party drafts. As a result, these remain potential improper payments. Because of the risks we identified in the third party draft payment process, and in response to a letter from the Chairman and Vice-Chairman of the Subcommittee on Select Education, Education took action in May 2001 to eliminate the use of third party drafts. Education lacked fundamental internal controls over its purchase card program that would have minimized the risk of improper purchases. We found that Education’s inconsistent and inadequate authorization and review processes, combined with a lack of monitoring, created an environment in which improper purchases could be made with little risk of detection. Inadequate control over these expenditures, combined with the inherent risk of fraud and abuse associated with purchase cards, resulted in fraudulent, improper, and questionable purchases by some Education employees. Recently, the department has made changes to the way it administers its purchase card program to help reduce its vulnerability in this area. However, because the department has not effectively implemented its new policies, vulnerabilities remain. Treasury guidance for purchase cards states that agencies are responsible for developing their own procedures for using purchase cards, including approved uses of the cards and limitations on the types of purchases and dollar amounts. During the time covered by our review, Education’s purchase card program was operating under policies and procedures that were implemented in March 1990. Education officials told us that since this policy was drafted, the number of cards and frequency of their use expanded significantly. Education’s policy provided very limited guidance on what types of purchases were appropriate. Although Education’s policy required each cardholder and approving official to receive training on their respective responsibilities, we found several cardholders and at least one approving official who were not trained. This lack of detailed and timely policies and procedures, as well as the lack of training for all cardholders and approving officials, resulted in a lax control environment for this inherently risky program. Internal control standards state that transactions should be authorized and executed only by persons acting within the scope of their authority to ensure that only valid transactions are entered into. For purchase cards, specific procedures should include (1) authorizing purchases, (2) monitoring monthly reports of card usage, (3) blocking certain Merchant Category Codes (MCC) for vendors whose business is unrelated to Education’s mission, and (4) reviewing and approving monthly purchase card statements. We found serious deficiencies in each of these four areas that made the department vulnerable to improper purchases. Only 4 out of 14 offices within Education required cardholders to obtain authorization prior to making some or all purchases, although Education’s policy required that all requests to purchase items over $1,000 be made in writing to the applicable department Executive Officer. We also found that approving officials did not use monitoring reports that were available from Bank of America to identify unusual or unauthorized purchases. For instance, if a cardholder used a government purchase card to obtain a cash advance, which is prohibited by Education’s policies, the MCC for this type of vendor (a financial institution) would appear on the report next to the cardholder’s name. Additionally, Bank of America can block specific MCCs to prohibit certain types of transactions that are clearly not business related, such as purchases from snowmobile or boat dealers. However, prior to November 2001, Education only blocked four MCCs related to gambling and obtaining cash advances. As discussed later in this section, the department recently took action to block certain other MCCs. Education officials told us that they had not used this control extensively because the department relied on the approving official’s review of the cardholder’s monthly purchase card statements to ensure that all purchases made by employees were proper. In order to test the effectiveness of the approving officials’ review of purchase card statements, we selected 5 months of cardholder statements to review for certain attributes, including the approving official’s signature. We reviewed all 903 monthly statements that were issued during these months, totaling about $4 million, and found that 338, or 37 percent, which totaled about $1.8 million, were not approved by the appropriate authorizing official. The approval process was also less effective because some approving officials were not in a good position to know which purchases were appropriate. For example, we identified an employee who, in addition to regular job duties, had responsibility for reviewing the monthly purchases of 96 cardholders located throughout the country. In these situations, the approving official may not have had sufficient contact with cardholders to understand their duties and the types of purchases they would routinely make. Combined, the inconsistent review of purchases and the ineffective review process created an environment where improper purchases could be made with little risk of detection. Because of the extensive internal control weaknesses related to the department’s purchase card program, we requested supporting documentation for the 338 monthly statements totaling $1.8 million we reviewed that were not properly approved, as well as for other transactions that appeared unusual. However, Education was unable to provide adequate supporting documentation to enable us to determine the validity of purchases totaling over $218,000. In our review of the available documentation, we identified some fraudulent, improper, and questionable purchases. We considered fraudulent purchases to be those that were unauthorized and intended for personal use. Improper purchases included those for government use that were not, or did not appear to be, for a purpose permitted by law or regulation. We also identified as improper purchases those made on the same day from the same vendor that appeared to circumvent cardholder single purchase limits. We defined questionable transactions as those that, while authorized, were for items purchased at an excessive cost, for a questionable government need, or both, as well as transactions for which Education could not provide adequate supporting documentation to enable us to determine whether the purchases were valid. We found one instance in which a cardholder made several fraudulent purchases from two Internet sites for pornographic services. Notwithstanding the relatively small amount of money involved, the name of at least one of the pornographic sites—Slave Labor Productions.com— should have caused suspicion when it appeared on the employee’s monthly credit card statement. To determine whether these purchases were approved, we obtained the monthly statements containing these charges. The statements contained handwritten notes next to the pornography charges indicating that these were charges for transparencies and other nondescript items. According to the approving official, he was not aware of the cardholder’s day-to-day responsibilities and did not feel that he was in a position to review the monthly statements properly. The approving official stated that the primary focus of his review was to ensure there was enough money available in that particular appropriation to pay the bill. As a result of investigations related to these pornography purchases, Education management issued a termination letter, prompting the employee to resign. We also identified purchases totaling $4,427 from a restaurant in San Juan, Puerto Rico, that we determined to be improper. These restaurant charges were incurred during a Year 2000 (Y2K) focus group meeting, and included breakfasts and lunches for federal employees and nonfederal guests. The Statement of Work for the focus group notes that the travel expenses fell “under the invitational travel statute (5 U.S.C. 5703).” Appropriated funds may not be used to pay the costs of nonfederal individuals to attend meetings unless otherwise specifically authorized by law. Such authority exists in 5 U.S.C. 5703, which allows an agency to use invitational travel to pay the costs of nonfederal individuals to attend meetings if the attendees are providing direct services to the government. Education, however, could not provide us with any evidence that the nonfederal attendees provided direct services to the government. In fact, the Statement of Work for the focus group states that the purpose of the meeting was for attendees to “share their experiences with the Y2K issue and to assure that the education community’s computers are compliant.” Thus, rather than providing a direct service to the federal government, it appears that the attendees were receiving a benefit from the meeting. According to an Education official, there were eight additional Y2K focus group meetings, similar to the San Juan meeting, held in various cities throughout the United States. This official estimated that the agency paid approximately $45,000 in expenses for nonfederal individuals to attend the nine meetings. We have referred this matter to Education’s OIG. We also found 28 improper purchases totaling $123,985 where Education employees made multiple purchases from a vendor on the same day. These purchases appear to violate the Federal Acquisition Regulation that prohibits splitting purchases into more than one segment to circumvent single purchase limits. For example, one cardholder purchased two computers from the same vendor at essentially the same time. Because the total cost of these computers exceeded the cardholder’s $2,500 single purchase limit, the total of $4,184.90 was split into two purchases of $2,092.45 each. In some instances, Education officials sent memos to the offending cardholders reminding them of the prohibition against split purchases. We identified five additional instances, totaling about $17,000, in which multiple purchases were made from a single vendor on the same day. Although we were unable to determine whether these purchases were improper, based on the available supporting documentation, these transactions share similar characteristics with the 28 split purchases. For example, one cardholder purchased two printers, costing $1,711 each, from the same vendor on the same day. The combined cost of these purchases, $3,422, exceeded the cardholder’s $2,500 single purchase limit. Education provided us with no explanation for why these two items were purchased separately. We identified questionable purchases totaling $286,894 where Education employees paid for new office furniture and construction costs to renovate office space that they were planning to vacate. Only a small amount of furniture, including chairs for employees with special needs, were moved to the new building when department employees relocated. Other purchases we questioned included numerous charges, totaling $35,760 over several years, made by an Education employee for herself and a coworker to attend college. Some of the classes the employees took were apparently prerequisites to obtain a liberal arts degree, but were unrelated to Education's mission. The classes included biology, music, and theology, and represent $11,700 of the $35,760. Because the Government Employees Training Act, 5 U.S.C. 4103 and 4107, requires that training be related to an employee’s job and prohibits expenditures to obtain a college degree unless necessitated by retention or recruitment needs, which was not the case here, we consider these purchases improper. Moreover, most of the monthly charge statements were not reviewed by anyone but the employee who made the charges and received more than half of the financial benefit. After we questioned the charges for these tuition expenses, Education determined that the classes costing $11,700 were improperly charged. As of December 2001, one of the employees had received a bachelor's degree and left the department; no funds had been recovered from either employee. In addition, we identified as questionable purchases totaling more than $218,000 for which Education provided us with no support or inadequate support to assess the validity of these purchases. These inadequately supported or unsupported purchases included charges to various hotels for more than $3,000, purchases of computer equipment and software totaling more than $22,000, and charges for various college and other training courses totaling about $51,000. Numerous other purchases were made from home electronics and appliance stores as well as toy, book, and furniture stores. Education could not provide any support for more than $152,000 of these purchases, nor does the department know specifically what was purchased, why it was purchased, or whether these purchases were appropriate. For the remaining $66,000, Education was able to provide only limited supporting documentation. As a result, we were unable to assess the validity of these payments, and we consider these purchases to be potentially improper. Our interim report, issued in September 2001, described the poor internal controls over Education’s cash disbursement processes, including purchase cards. In that report, we recommended that the department reiterate to all employees established policies regarding the appropriate use of government purchase cards; strengthen the process of reviewing and approving purchase card transactions, focusing on identifying split purchases and other inappropriate transactions; and expand the use of MCCs to block transactions with certain vendors. Recently, Education has made some changes in the way it administers its purchase card program in an effort to address these three recommendations. For example, in December 2001, the department issued new policies and procedures that, among other things, (1) establish detailed responsibilities for the cardholder and the approving official, (2) prohibit personal use of the card and split purchases to circumvent the cardholder’s single purchase limits, (3) require approving officials to review the appropriateness of each individual purchase, (4) establish mandatory training prior to receiving the card and refresher training every 2 years, and (5) establish a quarterly quality review of a sample of purchase card transactions to ensure compliance with key aspects of the department’s policy. If appropriately implemented, these new policies and procedures are a good step toward reducing Education’s vulnerability to future improper purchases. Further, in July 2001, the department implemented a new process to approve purchase card purchases. Instead of the approving official signing a monthly statement indicating that all transactions are proper, the approval is now done electronically for each individual transaction. According to Education officials, most approving officials and cardholders received training on this new process. In order to assess the effectiveness of this new approval process, we reviewed a statistical sample of the monthly statements of cardholders for July, August, and September 2001. Purchases during these months totaled $1,881,220. While we found evidence in the department’s system that all of the 87 statistically sampled monthly statements had been reviewed by the cardholder’s approving official, 20 of the statements had inadequate or no support for items purchased, totaling $23,151. Based on our work, we estimate the most likely amount of unsupported or inadequately supported purchases during these 3 months is $65,817. The effectiveness of the department’s new approval process has been minimized because approving officials are not ensuring that adequate supporting documentation exists for all purchases. In addition, these procedures do not address the problem of an authorizing official who does not have personal knowledge of the cardholder’s daily activities and therefore is not in a position to know what types of purchases are appropriate. In response to our recommendation regarding the use of MCCs to block transactions from certain vendors, in November 2001, the department implemented blocks on purchases from a wide variety of merchants that provide goods and services totally unrelated to the department’s mission, including veterinary services, boat and snowmobile dealers, and cruise lines. In total, Education blocked more than 300 MCCs. By blocking these codes, Education has made use of a key preventive control to help reduce its exposure to future improper purchases. Earlier in 2001, Education took action to improve internal controls related to the use of government purchase cards by lowering the maximum monthly spending limit to $30,000, lowering other cardholders’ single purchase and total monthly purchase limits, and revoking some purchase cards. This action was in response to a letter from the Subcommittee on Select Education dated April 19, 2001, which highlighted our April 2001 testimony, in which we stated that some individual cardholders had monthly purchase limits as high as $300,000. These and the other steps described above have helped reduce Education’s exposure to improper purchase card activities. However, more needs to be done to improve the approval function, which is key to adequate control of these activities. As part of following up on computer purchases made with third party drafts and purchase cards, we assessed the controls over these portable assets. We found that Education lacked adequate physical controls over its computers, which contributed to 241 missing personal computers and computer-related equipment with an acquisition cost of about $261,500. After we completed our work in this area, we again visited the office where most of the computer equipment was missing because Education officials told us they had located some of the missing inventory. Although Education officials stated they had located 73 pieces of equipment, we were able to locate only 62 pieces of the equipment with an acquisition value of about $49,800. Education officials have been unable to locate the remaining 179 pieces of missing computer equipment with an acquisition value of about $211,700. This matter is currently under investigation by Education’s OIG. From May 1998 through September 2000, the period covered by our audit, Education made purchases totaling more than $2.9 million from personal computer and other computer-related equipment vendors using purchase cards and third party drafts—a violation of Education’s policy, which prohibited the use of purchase cards for this purpose. These purchases included personal computers, scanners, color printers, software, and other computer accessories. According to Education, during this period, the department’s computer purchases were decentralized so that individual principal offices were able to purchase the types of equipment from any vendors they chose. This provided considerable flexibility and rapid acquisition of equipment, but had several drawbacks. For example, unnecessary, duplicate orders were placed even within the same offices. Further, equipment that could not be supported by Education’s networked environment was ordered. Other equipment was ordered and then left in closets only to be found sometimes a year later, when it was no longer needed. As a result of this decentralized ordering, virtually no volume discounts could be used because of the small amounts of equipment being purchased at any given time. According to the Education Inspector General, the department had not taken a comprehensive physical inventory for at least 2 years prior to October 2000, thus compounding the lack of accountability over this equipment. Education staff members who were involved with ordering and receiving this equipment described a process that included significant breakdowns in basic internal controls. Internal control standards state that key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. In the office where most of the missing equipment was purchased, two individuals had interchangeable responsibility for receiving more than $120,000 of computer equipment purchased by a single cardholder, from one particular vendor. In addition, these two individuals also had responsibility for bar coding the equipment, securing the equipment in a temporary storage area, and delivering the computers to the users. Furthermore, one of these two individuals was responsible for providing information on computer purchases to the person who entered the data into the department’s asset management system. According to the cardholder who purchased the equipment, they did not routinely compare the purchase request with the receiving documents from the shipping company to ensure that all items purchased were received. In addition, our review of records obtained from the computer vendor from which Education made the largest number of purchase card and third party draft purchases showed that less than half of the $614,725 worth of computers had been properly entered in the department’s property records. Combined, these weaknesses created an environment in which computer equipment could be easily lost or stolen without detection. In order to identify computers that were purchased with purchase cards and third party drafts that were not included in the department’s asset management system, we obtained the serial numbers of all pieces of computer equipment purchased from the largest computer vendor the department used. We compared these serial numbers to those in the department’s asset management system and found that 384 pieces of equipment, totaling $399,900, appeared to be missing, including desktop computers, scanners, and printers. We conducted an unannounced inventory to determine whether these computers were actually missing or were inadvertently omitted from the property records. We located 143 pieces of equipment that were not on the property records, valued at about $138,400, and determined that 241 pieces, valued at about $261,500, were missing. Education’s Inspector General is in the process of investigating the disappearance of these vulnerable assets. After we completed our work in this area, we again visited the office where most of the computer equipment was missing because Education officials told us they had located some of the missing inventory. Officials in this office told us they hired a contractor to keep track of their computers when moving to their new space. According to the officials, as part of its work, the contractor recorded the serial numbers of all computers moved and identified 86 of the 241 pieces of computer equipment that we were unable to locate during our unannounced inventory in September 2001. However, when Education staff and officials tried to locate this equipment, they were only able to find 73 of the 86 pieces of equipment. When we visited the department, we located only 62 pieces of equipment with an acquisition value of about $49,800. Education officials have been unable to locate the remaining 179 pieces of missing computer equipment with an acquisition value of about $211,700. They surmised that some of these items may have been surplused; however, there is no paperwork to determine whether this assertion is valid. According to Education officials, new policies have been implemented that do not allow individual offices to purchase computer equipment without the consent of the OCIO. However, during our previously mentioned review of a statistical sample of purchase card transactions made from July 2001 through September 2001, we found three transactions totaling $2,231 for the purchase of computer equipment without any supporting documentation from the OCIO. Based on these results, the new policies are not being effectively implemented. This is another indication that the new purchase card approval function is not operating as an effective deterrent to improper purchases. Further, we found mixed results in a walk-through of the new computer ordering and receiving processes in the office where most of the missing equipment was purchased. These new policies are designed to maintain control over the procurement of computers and related equipment and include purchasing computers from preferred vendors that apply the department’s inventory bar code label and record the serial number of each computer on a computer disk that is sent directly to the Education official in charge of the property records; loading the computer disk containing the bar code, serial number, and description of the computer into the property records; and having an employee verify that the computers received from the vendor match the serial numbers and bar codes on the shipping documents and the approved purchase order. However, a continued lack of adequate physical control negates the effectiveness of these new procedures. For example, the doors to the two rooms used to store computer equipment waiting to be installed were both unlocked and unattended. The receptionist at the mail counter next to the first storage room we visited told us that he had the door open to regulate the room temperature. The Education official responsible for this process stated that he did not know that mailroom personnel had access to this room. Furthermore, he stated that he does not have a key to either storage room. Also, during our second search for this equipment, we visited four rooms where some of the computers were stored and found them all to be unsecured. This lack of physical security was pointed out to the department nearly 7 weeks earlier when we first found some of its temporary computer storage rooms unsecured. The department’s new written procedures state that security guards in the Washington, D.C., facilities should inspect all bags, cases, and boxes leaving the buildings to determine if they contain computer equipment, and require property passes for all equipment removed from the building. However, Education officials acknowledged that the primary focus of the building security is people and packages entering the building. Education officials told us that individuals could likely leave the building with equipment without being questioned by security. Without enhanced physical security, Education will continue to be at risk to further computer equipment losses. The problems we found in grant and loan payments, purchase card use, and physical controls over computer equipment leave Education vulnerable to fraudulent or otherwise improper payments, questionable purchases, and loss or theft of assets. While Education has taken steps to develop new policies and procedures to address these problems, in many cases they are not being effectively implemented. Vulnerabilities remain in all areas we reviewed, except for third party drafts, which have been discontinued. Until Education takes further action to strengthen its internal controls over Pell Grants, purchase cards, and computer equipment, it will continue to be susceptible to fraud, waste, abuse, and mismanagement in these areas. To strengthen its internal controls over Pell Grants and loans, purchase cards, and computer equipment and to reduce Education’s vulnerability to improper payments and lost assets, we recommend that the Secretary of Education take the following actions. In the area of Pell Grants and loans, we recommend that the Secretary direct the Chief Operating Officer of student financial assistance programs to conduct on-site investigations, including interviews of school personnel and students, at the 28 schools with characteristics similar to those we found that improperly disbursed Pell Grants to determine whether the grants were properly disbursed; follow up with the schools that had high concentrations of the $12 million in potential improper payments for which the department did not provide adequate supporting documentation; and implement a process to verify borrowers’ SSNs and dates of birth submitted by schools to LOS. In the third party drafts area, we recommend that the Secretary direct the Chief Financial Officer to follow up on the $1.7 million of third party draft payments for which the department did not provide adequate supporting documentation for us to use to determine their validity. For purchase cards, we recommend that the Secretary direct the Chief Financial Officer to implement an effective review and approval process that ensures all approving officials (1) conduct a thorough review of all purchases made, including the review of all supporting documentation, (2) are knowledgeable of the cardholders’ daily responsibilities and therefore can effectively assess the appropriateness of each purchase, (3) are not reviewing a large volume of purchase card statements each month, and (4) are appropriately trained on how to perform their approving official responsibilities; perform periodic tests of this new approval process and, where necessary, take action to ensure that approving officials comply with it; take action to recover questioned tuition costs from the two employees; follow up on the $218,000 of purchases for which the department did not provide adequate supporting documentation for us to use to determine the validity, to determine whether the purchases were proper. Regarding computer equipment, we recommend that the Secretary direct the Director, Office of Management, to conduct routine inventories of computer equipment, including reconciling computer purchases with property records; enhance physical security over the computer storage rooms; provide access to computer storage rooms only to authorized ensure that security personnel in the Washington, D.C., facilities inspect all bags, cases, and boxes leaving the buildings to determine if they contain computer equipment and that property passes accompany all equipment removed from the buildings; and establish appropriate monitoring procedures to ensure that security personnel are actually inspecting items being removed from the buildings. In written comments on a draft of this report, which are reprinted in appendix III, the Deputy Secretary generally agreed with our findings and recommendations and stated that Education has made great strides to improve its internal controls and manage its payment processes to prevent and detect erroneous payments, and it is developing a formal corrective action plan to address each of our recommendations. Regarding grants and loans, the Deputy Secretary stated that, while there is room for improvement in Education’s systems and processes, he believes the department’s current controls are strong and provide reasonable assurance that its objectives can be met. He pointed out that the $3.4 million in Pell Grants we identified that was disbursed by four schools to ineligible students was less than five thousandths of a percent of the total disbursements we reviewed. We agree that the fraudulent and improper grant and loan payments we identified are a very small percentage of the total grants and loans disbursed every year. However, as we stated in our report, these improper payments represent an identified control risk that could easily be exploited to a greater extent. Although the Deputy Secretary stated that Education’s controls were strong, he presented steps that the department is taking to strengthen the integrity of these payment processes. For example, he stated that, as an interim process, the department analyzed student data to identify high concentrations of students over 65 and eligible noncitizens at a single institution to determine if problems exist in the ESL programs that warrant further review. Also, he stated that, before we started our review, Education had already begun a matching process with SSA’s death records. Further, as a result of our review, the Deputy Secretary stated that Education will implement an edit to identify all applicants whose dates of birth indicate they are 75 years of age or older beginning with the upcoming school year. He stated that the department is analyzing its data more systematically to establish baselines and indicators to focus its resources more effectively, and as we noted, the new COD system will assist Education in identifying unusual activity. We are encouraged by these actions, which, if properly implemented, should help improve internal controls over these vulnerable payments. With regards to our findings related to third party drafts, the Deputy Secretary stated that the department will refer the third party draft payments, for which we were unable to determine the validity, to the OIG for further investigation. In the purchase card area, the Deputy Secretary stated that Education issued an updated directive in January 2002, which strengthens the department’s policies and practices regarding appropriate use of the purchase card and has trained cardholders and approving officials on these policies and procedures. According to the Deputy Secretary, the directive provides detailed instructions on cardholder and approving official responsibilities for reviewing and approving purchase card transactions. He stated the department will also provide monthly management reports containing information on purchase card transactions to each principal office for review and that the OCFO will conduct quarterly internal control reviews and quality reviews of random sample purchase card transactions. This is an important action to determine whether cardholders and approving officials are following the directive and whether this training has effectively reduced unauthorized and improper purchases. The Deputy Secretary also stated that the department has blocked more than 300 MCCs, including those for wire transfer money orders, airline and car rentals, and banks. Regarding the improper charges for college tuition that we identified, the Deputy Secretary stated the department will follow established debt collection procedures to recover the questioned costs. To help it better account for its computer equipment, the Deputy Secretary stated that Education is developing a single comprehensive system that covers accountable assets from purchase to disposition. The Deputy Secretary also stated that the department hired contractors to perform an independent physical inventory, and upon completion, was able to locate 93 percent of the items sampled. The Deputy Secretary pointed out Education is in the process of documenting detailed property management procedures and centralizing the property management responsibility with its Office of Management. He also stated that, while the department has taken steps to enhance physical security over allocation, storage, and transit of equipment, and to ensure that only authorized individuals have access to storage areas, it will continue to work to improve in this area. We are encouraged by the department’s efforts to account for and secure its computers. At the same time, based on our most recent search for missing computers, significant vulnerabilities remain unresolved. We urge the department to immediately focus on providing adequate physical security over these vulnerable assets. Overall, the actions the department has taken and plans to take to improve its controls over grant and loan payments, purchase card transactions, and computer and related equipment are encouraging and represent a positive tone at the top of the organization to improve internal control. As the department has recognized, it must continually review its processes to ensure that the improved controls are sustained and, therefore, will help to reduce the department’s vulnerability to fraudulent and improper payments and lost assets and improve its financial management overall. As we arranged with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its date. At that time, we will send copies to the Ranking Minority Member of the Subcommittee on Select Education, House Committee on Education and the Workforce; the Secretary of Education; and other interested parties. We will make copies available to others upon request. Please contact me at (202) 512-9508 or by e-mail at calboml@gao.gov if you or your staff have any questions concerning this report. An additional GAO contact and staff acknowledgments are provided in appendix IV. The Department of Education disburses billions of dollars each year to recipients for various grant and loan programs. The programs we reviewed include formula grants, Pell Grants, discretionary grants, direct loans, campus-based programs, and Impact Aid. Recipients include schools, state agencies, organizations, and individuals. Table 3 provides descriptions of the grant and loan programs we reviewed and the amounts disbursed for these programs during the period of our review. The objectives of our review were to assess internal controls in place during the period from May 1998 through September 2000 and to identify any fraudulent or otherwise improper payments that may have resulted from control weaknesses in Education’s processes for (1) disbursing grants and loans, (2) paying for purchases with third party drafts, and (3) using government purchase cards. In addition, our objective was to assess Education’s physical controls over its computer equipment during the period from May 1998 to September 2000 and identify any effects of weak controls. Further, at the subcommittee’s request, we assessed the effectiveness of recent changes to Education’s process for purchase card purchases, which took effect in July 2001 following our testimony before the subcommittee. To obtain an understanding of the payment processes, identify related controls, and assess the effectiveness of their design, we interviewed staff members and officials in Education’s OCFO and program offices; performed walk-throughs of the payment processes; reviewed Education’s policies and procedures; reviewed previous reports we prepared, as well as reports issued by Education’s OIG and independent auditors; and identified vulnerabilities in the payment processes. To identify potential improper payments, we requested and obtained disbursement and related data from Education and various external sources, including SSA, Rocky Mountain Bank, and Bank of America. Education provided us with computer-generated records on more than 19 million disbursements totaling over $181 billion, made from May 1998 through September 2000 from the following systems: Grant Administration and Payment System (GAPS), Pell Grant Recipient Financial Management System (RFMS), Loan Origination System (LOS), National Student Loan Data System, Impact Aid system, Campus-based program system, Postsecondary Education Participants System, and Financial Management System Software (FMSS). Because of the large volume of data involved (millions of records), and the fact that we initially received some data in an unusable format, our testing extended to only selected portions of the data for certain systems. The majority of our tests were focused on data received from the GAPS, RFMS, LOS, and FMSS systems. In order to identify unusual grant and loan transactions that may have been improper payments, we searched databases, compared files, identified unusual transactions and patterns, and performed other detailed analyses to identify SSNs of grant and loan recipients that were either invalid or in SSA’s grant and loan recipients who were much older or younger than would individual SSNs associated with more than one name or date of birth, grants disbursed to individuals in excess of statutory limits, loan disbursements with no recorded loan number in the system, payments for grants and loans to schools that were either closed or ineligible for federal education funds, payment transactions that were returned by the Federal Reserve Bank payment transactions that did not have FRB confirmation schedule transactions that were posted on weekends, grantees with invalid grantee ID numbers or multiple ID numbers, Education employees who may have received grant funds, and disbursement records that did not contain required information such as a grant award number. To assist in our analysis and identification of improper payments, we contracted with forensic and information risk management experts. For those grant and loan payments that our tests indicated were potentially improper, we requested from Education documentation supporting their validity. After analyzing the documentation we received, we did the following. For those recipients identified as being older or younger than expected, we looked for proof of age generated by a source other than the school or the department, such as a birth certificate, driver’s license, or some other government-issued identification showing the recipient’s name and date of birth. For Pell Grants, if the support confirmed that the recipient was older or younger than would be expected, we looked for proof of enrollment in an eligible program. For those recipients we identified whose SSN was either invalid or in SSA’s death records, we looked for proof of the recipient’s SSN, such as a birth certificate, driver’s license, social security card, or other government-issued ID that showed the recipient’s name and SSN. If the support confirmed the accuracy of the recipient’s SSN, we reviewed transcripts, if available, to show the recipient’s dates of enrollment or additional support that was not generated by the school indicating the recipient’s date of death for those students who died while they were receiving aid. For those recipients who received grants in excess of the statutory limit, we looked for financial aid disbursement information from each institution the student attended during the award year showing the amounts disbursed and the dates on which the money was disbursed. We also looked for documentation showing repayment information, if applicable, or documentation demonstrating why repayment was not required for the recipient. For direct loan recipients, we reviewed information on loan payment status. For the schools that Education’s system showed to be either closed or ineligible to receive federal student financial aid, we reviewed documentation such as audit reports and disbursement information for these schools. Separately, for the four schools we investigated that we identified as disbursing Pell Grants to disproportionately high numbers of older students, we (1) interviewed Pell Grant recipients, school officials, and Education officials and (2) reviewed documents from the recipients, the schools, and Education. For third party drafts, we requested and obtained data from the third party draft systems administrator consisting of drafts that had been reconciled with downloaded information from Gelco and matched with data in FMSS. We used these data to test for third party drafts that had been used to pay for split purchases greater than $10,000. We also reviewed data provided by the third party draft systems administrator to identify unusual payees. Upon identifying payees that we thought would not normally be engaged in business with Education, we requested supporting documentation, such as purchase orders, invoices, and receipts, to determine the propriety of the purchases. For government purchase cards, we requested data on transactions from November 1998 through September 2000. Based on these data, we performed tests to identify the following types of potential improper purchase card transactions: unauthorized statements, such as purchases that were not properly reviewed by an approving official; split purchases for which Education employees either split transactions or made multiple transactions to the same vendor on the same day to circumvent their single purchase limit; purchases from questionable vendors; and purchases by Education employees on weekends or holidays. To assess Education’s controls over computer equipment, we obtained (1) invoices from the computer vendor with the largest volume of purchase card purchases and (2) information from Education’s asset management system. Using information on the invoices, including the serial numbers of the computer equipment purchased, we identified computer equipment that was purchased but not included in the asset management system. We then conducted an unannounced physical inventory of the computer equipment purchases that were not found in Education’s asset management system. To assess the effectiveness of recent changes to Education’s process for purchase card purchases, we requested monthly statements and invoices for purchases made during July, August, and September 2001. We reviewed a statistical sample of the monthly statements to determine whether approvals were done in accordance with the new policy. In addition, to identify any computer equipment that may have been purchased without the involvement of the OCIO and to determine whether purchases were sufficiently supported, we reviewed supporting documentation for each transaction in the statistical sample of monthly statements. While we identified some fraudulent and improper payments, our work was not designed to identify all fraudulent or otherwise improper payments. We performed our work from August 2000 through February 2002 in accordance with generally accepted government auditing standards, as well as with investigative standards established by the President’s Council on Intergrity and Efficiency. We requested comments on a draft of this report from the Secretary of Education or his designee. Written comments were received from the Deputy Secretary and are reprinted in appendix III. In addition to the contact named above, Lisa Crye, Anh Dang, Bonnie Derby, David Engstrom, Bill Hamel, Jeff Jacobson, Kelly Lehr, Sharon Loftin, Bridgette Lennon, Bonnie McEwan, Diane Morris, Andy O’Connell, Russell Rowe, Brooke Whittaker, and Doris Yanger made key contributions to this report. The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO E-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to daily e-mail alert for newly released products” under the GAO Reports heading. Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 or (202) 512-7470 (automated answering system).

Summary: Because of internal control weaknesses, the Department of Education's student financial assistance programs are at high risk for fraud or erroneous payments. GAO discovered fraud in the grant and loan areas and pervasive control breakdowns and improper payments in other areas. Controls over grant and loan disbursements lacked a key edit check or follow-up process that would identify schools improperly disbursing Pell Grants. Significant internal control weaknesses over Education's third party drafts also increased the department's vulnerability. GAO found that individual Education employees could control the entire payment process for third party drafts. Education employees also circumvented a key computerized control designed to prevent duplicate payments. Education eliminated third party drafts in May 2001. Inconsistent and inadequate authorization and review processes for purchase cards, combined with a lack of monitoring, meant that improper purchases were unlikely to be detected. Inadequate control over these expenditures, combined with the inherent risk of fraud and abuse associated with purchase cards, led to fraudulent, improper, and questionable purchases totaling $686,000. Poor internal controls over computers acquired with purchase cards and third party drafts led to 241 missing personal computers and other equipment valued at $261,500. Although Education changed policies and procedures over disbursements to improve internal controls and program integrity, many of these changes have not been effectively implemented.