ICE has not developed and implemented a process to identify and analyze program risks since assuming responsibility for SEVP in 2003, making it difficult for ICE to determine the potential security and fraud risks across the more than 10,000 SEVP-certified schools and to identify actions that could help mitigate these risks. SEVP and CTCEU officials expressed concerns about the security and fraud risks posed by schools that do not comply with program requirements. Furthermore, various cases of school fraud have demonstrated vulnerabilities in the management and oversight of SEVP-certified schools. We reported that SEVP faces two primary challenges to identifying and assessing risks posed by schools: (1) it does not evaluate program data on prior and suspected instances of school fraud and noncompliance, and (2) it does not obtain and assess information from CTCEU and ICE field office school investigations and outreach events. Evaluating SEVP information on prior and suspected cases of school noncompliance and fraud. SEVP does not have a process to evaluate prior and suspected cases of school fraud and noncompliance to identify lessons learned from such cases, which could help it better identify and assess program risks. SEVP has maintained a compliance case log since 2005—a list of approximately 172 schools (as of December 2011) that officials have determined to be potentially noncompliant with program requirements. The compliance case log represents those schools that SEVP, on the basis of leads and out-of- cycle reviews, is monitoring for potential noncompliance. According to SEVP officials, it has not used this list to identify and evaluate possible trends in schools’ noncompliance, although this list could provide useful insights to SEVP to assess programwide risks. Further, SEVP officials said that they have not looked across previous cases of school fraud and school withdrawals to identify lessons learned on program vulnerabilities and opportunities to strengthen internal controls. Our analysis indicates that there are patterns in the noncompliant schools, such as the type of school. For example, of the 172 postsecondary institutions on SEVP’s December 2011 compliance case log, about 83 percent (or 142) offer language, religious, or flight studies, with language schools representing the highest proportion. Without an evaluation of prior and suspected cases of school fraud and noncompliance, ICE is not well positioned to identify and apply lessons learned from prior school fraud cases, which could help it identify and mitigate program risks going forward. Obtaining information from CTCEU and ICE field offices’ investigations and outreach efforts. Based on our interviews with SEVP’s Director and other senior officials, we reported that SEVP had not established a process to obtain lessons learned information from CTCEU’s criminal investigators. Investigators may have valuable knowledge from working cases of school fraud in identifying and assessing program risks, including information such as characteristics of schools that commit fraud, how school officials exploited weaknesses in the school certification process, and what actions ICE could take to strengthen internal controls. For example, according to investigators in one ICE field office, CTCEU was hampered in pursuing a criminal investigation because SEVP officials did not obtain a signed attestation statement within the I-17 application from a school official stating that the official agreed to comply with rules and regulations. Another risk area we reported on is designated school officials’ access to SEVIS. In 2011, CTCEU provided SEVP officials with a position paper expressing concerns that designated school officials, who are not required to undergo security background checks, are responsible for maintaining updated information on foreign students in SEVIS. Investigators at three of the eight field offices we interviewed said that SEVP allowed designated school officials to maintain SEVIS access and the ability to modify records in the system while being the subject of an ongoing criminal investigation, despite requests from CTCEU to terminate SEVIS access for these officials. In addition, CTCEU collects data on its outreach efforts with schools through its Campus Sentinel program; however, the SEVP Director stated that his office had not obtained and analyzed reports on the results of these visits. CTCEU initiated Campus Sentinel in 2011, which ICE operates across all of its field offices nationwide.conducted 314 outreach visits to schools. According to CTCEU investigators, these visits provide an opportunity to identify potential risks, including whether schools have the capacity and resources to support From October 1, 2011, through March 6, 2012, CTCEU programs for foreign students. Obtaining information on lessons learned from CTCEU investigators could help provide SEVP with additional insights on such issues as characteristics of schools that have committed fraud and the nature of those schools’ fraudulent activities. To address these issues, we recommended that ICE develop and implement a process to identify and assess risks in SEVP, including evaluating prior and suspected cases of school noncompliance and fraud to identify potential trends, and obtaining and assessing information from CTCEU and ICE field office investigative and outreach efforts. DHS concurred and stated that ICE will develop and implement such a process by later this year. ICE has not consistently implemented existing internal control procedures for SEVP in four areas: (1) initial verification of evidence submitted in lieu of accreditation, (2) recordkeeping to ensure schools’ continued eligibility, (3) ongoing compliance monitoring of school licensing and accreditation status, and (4) certification of schools offering flight training. Regulations require schools to establish that they are legitimate and meet other eligibility criteria for their programs to obtain certification from ICE. In addition, weaknesses in managing and sharing key information with CTCEU impede SEVP’s prevention and detection of school fraud. The following summarizes these key findings and recommendations we made to address these issues. Initial verification of evidence submitted in lieu of accreditation. ICE requires schools to present evidence demonstrating that the school is legitimate and is an established institution of learning or other recognized place of study, among other things. Non-accredited, post-secondary schools, in particular, must provide “in lieu of” letters, which are evidence provided by petitioning schools in lieu of accreditation by a Department of Education-recognized accrediting agency. ICE policy and guidance require that SEVP adjudicators render an approval or denial of schools’ petitions based on such evidence and supporting documentation. This includes verifying that schools’ claims in the Form I-17, such as accreditation status and “in lieu of” letters, are accurate. However, SEVP adjudicators have not verified all “in lieu of” letters submitted to ICE by the approximately 1,250 non-accredited, post-secondary schools, as required by ICE’s policy. Rather, adjudicators decide whether to verify a letter’s source and the signatory authority of the signee based on any suspicions of the letters’ validity. Investigators at one of the eight ICE field offices we interviewed stated SEVP officials certified at least one illegitimate school—Tri-Valley University in California—because the program had not verified the evidence provided in the initial petition. In March 2012, CTCEU officials stated that several of their ongoing investigations involve schools that provided fraudulent evidence of accreditation or evidence in lieu of accreditation to ICE. Consistent verification of these letters could help ICE ensure that schools are legitimate and detect potential fraud early in the certification process. We recommended that ICE consistently implement procedures for ensuring schools’ eligibility, including consistently verifying “in lieu of” letters. DHS agreed and stated that SEVP personnel have initiated mandatory verification of all “in lieu of” letters. Recordkeeping to ensure continued eligibility of schools. ICE’s standard operating procedures for recordkeeping require SEVP officials to maintain records to document ongoing compliance. We reported that ICE had not consistently maintained certain evidence of selected schools’ eligibility for the program. According to our review of a stratified random sample of 50 SEVP-certified school case files, 30 files did not contain at least one piece of evidence required by the program’s policies and procedures. In addition, ICE was unable to produce two schools’ case files that we requested as part of our randomly selected sample. Without the schools’ information and evidence contained in these case files, including attestation statements and site visit reports, ICE does not have an institutional record to provide reasonable assurance that these schools were initially and continue to be legitimate and eligible for certification. According to ICE officials, the school recertification process would help address issues with incomplete and missing school files because schools are required to resubmit all evidence required by regulation when going through recertification. The Border Security Act required recertification for all SEVP-certified schools by May 2004 and every 2 years thereafter. However, ICE began the first recertification cycle in May 2010 and did not recertify all schools during this 2-year cycle, which ended in May 2012. As of March 31, 2012, ICE reported to have recertified 1,870 schools (approximately 19 percent of SEVP-certified schools). Given the delays in completing recertification, ICE is not positioned to address gaps in SEVP’s case files and cannot provide reasonable assurance that schools that were initially certified to accept foreign students are still compliant with SEVP regulations. Thus, we recommended that ICE establish a process to identify and address all missing school case files, including obtaining required documentation for schools whose case files are missing evidence. DHS concurred and stated that SEVP plans to work with ICE Records Management to develop protocols and actions to strengthen records management. Ongoing compliance monitoring of school licensing and accreditation status. ICE does not have a process to monitor the ongoing eligibility of licensed and accredited, non-language schools enrolling foreign students. ICE regulations require all certified schools to maintain state licensing (or exemption) and provide various forms of evidence to ICE supporting schools’ legitimacy and eligibility. If a school loses its state license, the school would be unable to operate legally as a school within that state.