Foreign students interested in studying in the United States must first be admitted to an SEVP-certified school or university before applying for a nonimmigrant visa at a U.S. embassy or consulate overseas to authorize travel to the United States. A visa holder must present himself or herself for inspection at a U.S. port of entry by an officer with DHS’s U.S. Customs and Border Protection to determine admissibility. Nonimmigrants, including foreign students, are permitted to enter the United States for an authorized period of stay. Schools seeking to enroll foreign students on F and M visas must pay an application fee and petition for SEVP certification by submitting an electronic certification petition and supporting documentation to ICE through SEVIS. Among other things, SEVIS assists ICE in tracking and providing oversight of foreign students—while they are approved to study in SEVP-certified U.S. educational institutions—and their accompanying dependents. Figure 1 outlines the steps required for schools seeking to obtain and maintain SEVP certification and the process for foreign nationals to pursue a course of study in the United States. More specifically, during the initial certification process, a school must provide ICE, specifically SEVP’s School Certification Unit (Certification Unit), with evidence of the school’s legitimacy (or bona fides) and eligibility. Such evidence includes the following: proof of any requisite licensure or approval by an appropriate state- level licensing or approving agency; proof of accreditation by an accrediting agency recognized by the Department of Education, if accreditation is required or otherwise claimed; DSO’s attestation statement that he or she is familiar, and intends to comply, with program rules and regulations for admission under, and maintenance and change of, nonimmigrant student status; and confirmation by the school that it is eligible for certification, among other things (willful misstatements in a school certification petition may constitute perjury); and DSOs’ proof of U.S. citizenship or lawful permanent residency. In addition, petitioning schools must generally submit a school catalog or written statement including certain information with respect to the qualifications of teaching staff, and attendance and grading policies, among other things. However, the requirement for a school catalog or written statement is not applicable to a public school or school system, a school accredited by a Department of Education–recognized accrediting agency, or a secondary school operated by or as part of such an accredited school. Moreover, an institution of higher education that is not a public educational institution or system, or not accredited by a recognized accrediting body, must provide evidence “in lieu of” meeting those criteria. Such evidence must show either that the school of higher learning confers recognized degrees upon its graduates or its credits have been and are unconditionally accepted by at least three public or accredited institutions of higher education. Schools nominate individuals to serve as DSOs, who act as liaisons between foreign students, the DSOs’ employing school, and federal government agencies. DSOs support school compliance with record- keeping, reporting, and other requirements, and provide recommendations to foreign students regarding the maintenance of their immigration status. In addition to entering and maintaining complete information on students in SEVIS in a timely manner, DSOs are responsible for using SEVIS to submit their school’s certification petition and update the information, as necessary. To demonstrate eligibility, DSOs must, among other things, provide to ICE statements certifying their familiarity and intent to comply with the program rules and regulations relating to the requirements for nonimmigrant students’ admission, maintenance of status, and change of status, and requirements for school approval. ICE’s regulations provide that willful misstatements in certification and recertification submissions may constitute perjury. Once ICE has received a complete petition from a school seeking SEVP certification, staff from SEVP’s Field Representative Unit are to conduct a site visit to the school, including each instructional site foreign students will attend, to interview school officials and review the facilities. After receiving all necessary evidence and a site-visit report from the field representatives, ICE staff in the Certification Unit analyze the documentation, determine the school’s eligibility, and certify those schools that they determine meet all of the program’s requirements. Further, DHS is required to conduct a review, every 2 years, of certified schools’ continued eligibility and compliance with the program’s requirements. To be eligible for recertification, an SEVP-certified school must demonstrate at the time of filing that it remains eligible for certification and has complied during its previous period of certification or recertification with record-keeping, retention, reporting, and other program requirements. During the recertification process, the Certification Unit requires schools to submit the same type of evidence that was required for certification, including, among other things, proof of state licensing and accreditation and DSO attestation statements and citizenship documentation. The Certification Unit also evaluates how the school has ensured that its foreign-student records are accurate and in compliance with statutory record-keeping requirements. However, site visits are not required for recertification. The Enhanced Border Security and Visa Entry Reform Act of 2002 states that a material failure of an SEVP-certified school to comply with the record-keeping and reporting requirements to receive foreign students shall result in the suspension for at least 1 year, or termination, of the school’s approval to receive such students. SEVP’s Analysis and Operations Center (Compliance Unit) conducts ongoing monitoring of SEVP-certified schools for compliance with these regulatory record- keeping and reporting requirements, as well as schools’ continued eligibility for certification. Under federal regulation, SEVP can deny an SEVP-certified school’s recertification petition or, subsequent to out-of- cycle review, withdraw certification if the school or its programs are no longer eligible for certification. Denial of recertification or withdrawal on notice as a result of out-of-cycle review may be for any valid and substantive reason, including failure to comply with record-keeping and reporting requirements, willful issuance by a DSO of a false statement, or not operating as a bona fide institution of learning, among other bases. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level. In July 2015, we issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt, as depicted in figure 2. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires the Office of Management and Budget (OMB), in consultation with the Comptroller General of the United States, to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities. The act further requires OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines. In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under OMB guidelines, among other things. ICE developed a risk-assessment framework and other tools to assist in its efforts to manage fraud risks to SEVP. For example, in 2014, ICE began developing an SEVP Risk Assessment Model and Framework, which provides an overview of how SEVP identifies, assesses, responds to, and reports on identified internal and external risks to the program. Specifically, SEVP’s Risk Assessment Model and Framework—which was updated several times between 2014 and 2017—discusses categories of fraud risks to the program, including fraud associated with schools, DSOs, and students. Moreover, in 2014, ICE developed a Risk Assessment Tool for SEVP that uses data from SEVIS records to identify potential fraud and other noncompliance issues among certified schools. The tool prioritizes different risk indicators—such as the proportion of the school that consists of foreign students—and ranks schools by risk level. SEVP officials stated that schools identified as high risk receive additional administrative review by the Compliance Unit. According to SEVP officials and documentation we reviewed, ICE has continued to update and refine the tool since 2014 to improve its effectiveness in helping to identify program risks, including fraud risks. Through these and its oversight efforts, ICE has identified various fraud risks in SEVP; such risks may take various forms, including immigration benefit fraud, which involves the willful or knowing misrepresentation of material facts for the purpose of obtaining an immigration benefit, such as a nonimmigrant student status, without lawful entitlement. According to ICE documentation we reviewed and officials we spoke to, the fraud risks to the program generally fall into four broad categories: schools, students, DSOs, and third-party brokers, who are individuals engaged in the fee- or commission-based recruitment of foreign students, among other activities. Figure 3 illustrates the types of fraud that may occur in these four categories during different stages of a certified school’s involvement in the program, as we identified in ICE documentation and through our interviews with ICE officials. For specific examples of fraud risks that ICE has identified in SEVP, see figure 4. ICE has also taken steps since 2012 to strengthen its fraud risk- management efforts in response to our prior recommendations. For example, in our 2012 report on SEVP risks, we found that, among other things, ICE did not have a process to assess risks in SEVP and did not consistently implement existing internal controls for determining school eligibility. To address this and other findings, we made eight recommendations to enhance ICE’s ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP. ICE took action that addressed these eight recommendations and has developed various tools designed to strengthen its fraud risk- management efforts (see app. I). Further, ICE has taken steps to improve collaboration and coordination to enhance fraud risk management between SEVP and CTCEU, the unit within ICE responsible for managing criminal investigations. More specifically, ICE has embedded agents within SEVP’s Compliance Unit, and these agents help provide law-enforcement expertise within the unit and act as liaisons with ICE agents located in the field to provide information and support ongoing criminal investigations. According to a senior ICE official with CTCEU, the embedded agents have helped streamline processes and provide expertise to aid administrative and investigative efforts. Figure 5 shows the process for coordination between CTCEU and SEVP. Further, ICE officials with CTCEU stated they have acquired specialized software tools to manage fraud tips and to conduct open-source and related research on certified schools suspected of acting fraudulently. To help identify and prioritize leads, ICE officials stated that they use a software tool to efficiently help review and prioritize tips received through ICE’s tip line, which gathers tips from the general public on suspicious or potential criminal activity. To aid investigations of schools, ICE explored the use of another specialized software to aid the review of online social media associated with schools or individuals, among other things. In addition, changes to SEVIS have aided ICE’s efforts to manage fraud risks in the program. In 2008, ICE initiated an effort to modernize SEVIS to address identified system vulnerabilities, such as the inability to capture detailed school data that would allow the detection of patterns and anomalies that could indicate fraud. Although SEVIS modernization is not yet complete, changes made in the system have helped to improve system usability and the ability to identify suspected fraud in the program, according to program officials. For example, system edit checks implemented in 2015 and 2016 to verify user-entered names and addresses have enhanced data quality by helping to identify and prevent likely data-entry errors. SEVP officials also stated that improved data quality can help make it easier to distinguish potential fraud from unintentional data-entry errors. ICE officials we spoke to and related documentation we reviewed stated that SEVIS modernization efforts may include additional functionality, such as the ability to create person-centric records for each student. Although ICE has developed a Risk Assessment Model and Framework and taken other action to improve fraud risk management in SEVP, ICE has not fully developed and implemented a “fraud risk profile” that would help guide its efforts. According to our Fraud Risk Framework, an effective antifraud entity tailors the approach for carrying out fraud risk assessments to its programs. This approach allows an agency to, among other things, develop a fraud risk profile that identifies the inherent fraud risks affecting the program, assesses the likelihood and effect of each type of fraud risk that the determines the agency’s tolerance for certain types or levels of fraud risks in the program, examines the suitability of existing controls for each fraud risk, and documents the program’s fraud risk profile. Effective managers of fraud risks use this profile to help decide how to allocate resources to respond to fraud risks. Further, Federal Internal Control Standards require managers to respond to identified risks. Appendix III provides additional information on the key elements in the fraud risk-assessment process including the development of a fraud risk profile. Our assessment of SEVP’s Risk Assessment Model and Framework found that while it describes the program’s approach for managing fraud risks, it does not include all of the key elements of a fraud risk profile: First, SEVP’s Risk Assessment Model and Framework identifies three broad categories of inherent fraud risks that affect the program (those posed by schools, DSOs, and students), but does not include all risks that the program or its stakeholders have identified, such as the risk of third-party brokers. As noted previously, ICE agents and program officials identified brokers as a risk to the program because brokers have helped facilitate school and student fraud and misused or stolen student funds in the past. However, according to ICE officials with SEVP, SEVP’s Risk Assessment Model and Framework was not designed to define all of the risks posed to SEVP. Second, while SEVP’s Risk Assessment Model and Framework assesses the potential effect of its risk posed by students, schools, and DSOs, it does not discuss the likelihood of the risk’s occurrence. For example, the Risk Assessment Model and Framework contains a narrative outlining the potential negative consequences of each of the three broad risk categories but does not address the likelihood of those risks occurring. According to SEVP officials, SEVP’s Risk Register helps identify and determine the likelihood of identified program risks. However, our review of the Risk Register found that it is used to track program-wide risks and does not identify or discuss specific fraud risks. Further, these officials stated that many of the components in a fraud risk profile are included in SEVP’s Risk Assessment Tool, but this tool was developed to prioritize the review of SEVP-certified schools that have potential compliance issues and was not designed to address all SEVP fraud risks such as the risks posed by students or brokers. Using information on the likelihood of risk occurrence can help managers decide how to allocate resources. For example, managers can use this information to make decisions to allocate resources to addressing fraud risks that are most likely to occur or have relatively high impact. Third, SEVP’s Risk Assessment Model and Framework does not assess the agency’s tolerance for all fraud risks to the program. For example, while SEVP officials stated that students represent a significant risk to the program, they have not fully assessed the extent of risks associated with student fraud or the agencies’ tolerance for it. In October 2017, the SEVP Director stated that SEVP was just beginning to get a better understanding of student risks, but had not done an assessment of their likelihood and tolerance. However, SEVP officials acknowledged the importance of fully assessing student risks because of the challenges that can be associated with detecting, preventing, and responding to student fraud. Fourth, SEVP’s Risk Assessment Model and Framework does not examine the suitability of existing fraud controls or prioritize all residual risks that remain after inherent risks have been mitigated by existing control activities. We found that, while the Risk Assessment Model and Framework discusses different internal controls and tools used to prioritize and address risks in the school certification and recertification process, such as the Risk Assessment Tool, it does not explicitly identify any internal controls or tools used to prioritize or address student risks. In addition, the Risk Assessment Model and Framework does not identify and prioritize residual fraud risks that ICE has flagged as being vulnerabilities to the program. According to ICE agents in four field offices and officials in the Compliance Unit, limitations to SEVP’s ability to prevent some schools that present fraud risks from obtaining certification or continuing to participate in the program after fraud risks have been identified represent residual risks to the program. For example, officials in the Compliance Unit stated that certified schools that have been accredited through an accrediting body recognized by the Department of Education generally represent a lower fraud risk, but ICE has still experienced noncompliance and cases of fraud with these schools. At one point several fraud cases were tied to the same accrediting body. In another example of a potential residual risk to the program, ICE field agents stated that potentially fraudulent schools may continue to operate during criminal investigations, which can take several years to investigate and prosecute. During the investigation, schools may remain in operation and continue to enroll foreign students, provided their certification is not withdrawn through other administrative actions. As one example, ICE’s investigation into Prodee University—a case that involved hundreds of students—began in 2011, but warrants were not issued until 2015. The school continued to operate and accept foreign students during the 4-year investigation, creating residual risk to the program during these years. According to SEVP’s Director, the program has not developed a fraud risk profile that fully addresses all identified risks because the program has not yet developed the maturity needed to manage its risks in this way, but she noted that doing so could be a good next step in the process. Without a fraud risk profile consistent with leading practices—which identifies all fraud risks, discusses the likelihood of those risks, assesses the agency’s risk tolerance, and determines the suitability of related controls—ICE cannot ensure it has taken all necessary actions to address SEVP risks. ICE is exploring the use of better data analytics to help detect fraud in SEVP but has not yet employed techniques, like network analysis, to help detect and prevent fraud prior to certification. ICE officials with SEVP stated that they are exploring the use of additional data-analytics tools to help mitigate fraud in the program, including tools that can perform network analysis. However, these efforts are in their early stages and have been limited to conversations between program staff. While previously noted efforts to improve SEVIS may also include additional data analytics to mitigate fraud, these efforts have remained underway since 2008. Agency officials told us they recognize that better analytic tools can help them detect and prevent fraud in the certification process and are seeking additional resources to support this effort. According to agency documentation, SEVP awarded a contract in September 2018 to help establish a data-governance framework within SEVP. Among other things, the contract will examine the tools, skill sets, and number of people needed to support the data-related needs for SEVP, to include operational data and analytics. According to agency officials, SEVP plans to award a contract in the first quarter of fiscal year 2019 to provide better data-analytics support. Data-analytics approaches, such as network analysis, have the potential to enable ICE to identify high-risk schools prior to initial certification, thus allowing SEVP to apply increased oversight, as needed, during the adjudication process. Network analysis involves a quantitative approach for analyzing, summarizing, and graphically representing complex patterns of relationships among individuals or organizations. Such a technique is useful for identifying associations, such as between schools with current or past administrative and criminal concerns and those schools seeking certification. Information about the connections and relationships among schools—developed through network analysis—may then provide leads in reviews and investigations in the certification and recertification processes, which are important controls for preventing fraudulent schools from entering and remaining in the SEVP program. ICE field agents with two of five field offices we visited stated that it can be challenging to identify fraudulent schools as compared to legitimate ones during the initial certification of schools. For example, agents familiar with one investigation stated that after ICE began investigating a school for suspected fraud, the owner tried to establish another school, which was only identified because of a lead provided through interviews conducted during the investigation. Further, because tools such as the Risk Assessment Tool use data analytics, but rely on information collected from current SEVP-certified schools, it can be difficult to identify schools with fraud concerns before they are certified to participate in the program. Using a network approach in our analysis of 2,439 SEVP-certified schools, we identified 11 connections that could raise fraud concerns. Specifically, we conducted a network analysis utilizing both public and proprietary information associated with certified schools as of September 2017. We obtained basic information on these schools from ICE, such as school names and addresses. We also used public records associated with these schools related to businesses and people, such as past and current executives. Using this information and freely available public software, we identified relationships among certified schools that ICE had previously identified as having potential compliance or fraud concerns and other certified schools that did not have such concerns. For example, in 11 connections, we identified instances in which an executive appeared to have been employed by a school under active criminal investigation or administrative review who was either previously or later employed by a different school not under investigation or review. Moreover, for 2 of the 11 connections, we found additional derogatory information associated with executives tied to SEVP-certified schools that could raise fraud concerns. For instance, one executive had employment terminated from a previous school and was under investigation for misappropriating school funds for personal use. While these connections do not prove fraud or noncompliance, they do provide information about potential risks, which can inform the prioritization of administrative and investigative resources during certification. ICE currently has limited ability to identify associations among schools with potential fraud concerns before they are certified to participate in the program. According to our Fraud Risk Framework, federal managers should design and implement specific control activities to prevent and detect fraud. These control activities can include data analytics, among other things, and should emphasize fraud prevention to the extent possible. A network approach provides the capability to better prevent and detect fraud by identifying potentially fraudulent schools before they are certified by SEVP and by detecting associations that pose a fraud risk among those already certified. ICE has processes in place for school certification, recertification, and ongoing compliance monitoring, and has taken steps to improve school certification controls since our 2012 report. We also found that ICE followed its established procedures and specifically identified GAO’s fraudulent petitions or otherwise took appropriate steps to prevent the petitions from moving forward in the process during our three independent covert tests of SEVP internal controls over the school certification process. However, the agency continues to face long- standing delays in conducting recertification reviews every 2 years to ensure that SEVP-certified schools continue to meet program requirements—one of its important fraud risk controls. As a result of these delays, ICE has a queue of recertification petitions awaiting adjudication, which creates additional fraud risks to the program if higher-risk schools continue to operate pending recertification. However, the agency has not assessed the magnitude of these risks. ICE’s certification and recertification processes are designed to assess schools’ initial and continued eligibility to enroll foreign students and, as previously discussed, once a school is certified, ICE is to monitor its continued program eligibility. SEVP-certified schools are to undergo recertification reviews every 2 years (see fig. 6). Initial certification: As previously discussed, to be eligible for SEVP certification, a petitioning school must establish at the time of filing that it is a bona fide institution of learning or other recognized place of study that possesses the necessary facilities, personnel, and finances to conduct, and is in fact engaged in, instruction in recognized courses. SEVP officials stated that they address potential fraud risks during the initial certification process by verifying the schools’ information and documentation through web-based research and a site visit to interview the school’s DSO and observe the school’s facilities. According to SEVP officials and guidance, as of October 2016, field representatives are responsible for conducting and documenting site visits for certifications. When conducting the visits, field representatives are to gather evidence on school eligibility for certification, review the facilities, and interview personnel nominated on the petition to become DSOs. They may also report back any anomalies or areas of concerns they may notice for further vetting by the compliance unit. SEVP received approximately 2,000 certification petitions from fiscal years 2013 through 2017. See figure 7 for details on the number of approved and denied petitions during this period. ICE has implemented several controls to address fraud risks in the school certification process since our 2012 report on SEVP program risks, but long-standing delays in the recertification process create additional fraud risks. In particular, ICE strengthened its processes for verifying and monitoring schools’ accreditation and states’ licensing statuses. For example, since December 2012, SEVP adjudicators are to verify all “in lieu of” letters during the school’s initial-certification and recertification processes. In May 2015, SEVP developed a continuous process for verifying schools’ state licensing and accreditation status and updated its Adjudicator’s Manual with specific actions adjudicators must take to consistently verify evidence provided by schools, including “in lieu of” letters and states’ licensing documentation. In addition, SEVP took steps to ensure that all flight schools had the appropriate Federal Aviation Administration certification. Recertification: To be eligible for recertification, an SEVP-certified school must demonstrate at the time of filing that it remains eligible for certification and has complied during its previous period of certification or recertification with record-keeping, retention, reporting, and other program requirements. SEVP received approximately 14,000 recertification petitions from fiscal years 2013 through 2017. See figure 8 for details on the number of approved and denied petitions during this period. The recertification process is an important fraud risk control, according to ICE officials, since they may determine that some certified schools are potentially noncompliant during the recertification process. For example, SEVP denied 105 recertification petitions from fiscal year 2013 through fiscal year 2017. On the basis of our review of recertification denial data, the majority of denials were due to the school’s abandoning its petition for recertification by not responding to SEVP’s request for further information. Appendix IV provides additional details on the withdrawal and denial of certification and recertification petitions as outlined in federal statute and regulation. For the remaining schools, SEVP issued a formal recertification denial notice for a variety of reasons, including those that highlight fraud risks in the program, such as improper issuance of Forms I-20, including the issuance of forms to foreign students who will not be enrolled in or carry a full course of study; DSO conduct did not comply with program regulations; willful issuance by a DSO of a false statement; failure to timely report school or course of study information, including material changes; and failure to maintain the accreditation or licensing necessary to qualify graduates as represented in the school’s Form I-17. Ongoing compliance monitoring: The Enhanced Border Security and Visa Entry Reform Act of 2002 provides that SEVP-certified schools are to comply with record-keeping and reporting requirements to enroll nonimmigrant students. Between schools’ initial certifications and their subsequent recertification reviews, ICE uses a variety of mechanisms to monitor ongoing compliance with program requirements and mitigate fraud risks. For example: SEVP deployed its first group of field representatives in 2014. As of June 2018, ICE had 57 field representatives across 60 different geographic areas of responsibility nationwide. According to SEVP guidance, field representatives are to act as direct liaisons between SEVP and certified schools and are to try to meet with all certified schools in their territory at least once per year if the school has foreign students enrolled, or once every 2 years if no foreign students are enrolled. According to SEVP officials, the field representatives are to have a customer-service focus and assist DSOs in adhering to program requirements and, as a result, do not have law-enforcement or investigative responsibilities. However, if field representatives learn of potential fraud while visiting a school, they are to document and send this information to SEVP headquarters. All of the eight field representatives we interviewed reported that they primarily have a customer-service role but have also identified and reported suspected fraud to SEVP headquarters. For instance, one representative stated that she reported a language school because its stated level of student enrollment did not appear to correspond with the number of students in class during her visits to the school. SEVP adjudicators are to verify and adjudicate changes that occur at an SEVP-certified school that require an update to the school’s Form I-17 petition information in SEVIS. These changes include the school’s name, location, or new areas of study offered, among others. According to Certification Unit officials, adjudicators review information from both SEVP’s risk tools and field-representative school-visit reports when adjudicating updates to identify any indications of noncompliance or fraud that need to be further reviewed and researched by the Compliance Unit. Compliance Unit staff are to vet tips provided by external parties (such as DSOs from other schools) or internal stakeholders (such as field representatives or Certification Unit adjudicators) to determine whether they indicate the need to open an administrative or criminal investigation on the school. Compliance Unit staff may also identify schools for additional monitoring. The Compliance Unit is also responsible for extracting and analyzing data from SEVIS on an ongoing basis, including data related to certified schools and foreign students suspected of noncompliance and fraud, among other things. According to ICE officials, staff are responsible for researching schools with high-risk scores provided by the Risk Assessment Tool. ICE may conduct an out-of-cycle review of a school at any time to help determine whether the school is complying with its reporting and record-keeping requirements and to ensure the school’s continued eligibility for SEVP certification. ICE may initiate an out-of-cycle review as a result of receiving information regarding potential noncompliance or fraud. The out-of-cycle review process may include a review of student records, a request for the submission of documentation to verify accreditation, a request for proof of state licensure, or a request for any other required evidence that establishes a school’s continued eligibility for SEVP certification. ICE officials stated that they may, pending the result of this review, issue a remedial action plan to the school describing the areas of noncompliance, such as correcting student records, that the school is required to address to maintain its program eligibility. If, upon completion of an out-of-cycle review, SEVP determines that a certified school has failed to sustain eligibility or has failed to comply with the record-keeping, retention, reporting, and other requirements, SEVP will institute withdrawal proceedings by serving the school a notice of intent to withdraw SEVP certification. At the conclusion of withdrawal proceedings, a school found to be ineligible for continued SEVP certification as a result of an out-of-cycle review will receive a notice of withdrawal (see app. IV for additional information on the withdrawal process). ICE followed established procedures during our three covert tests of the internal controls over the SEVP school certification process by either successfully identifying GAO’s fraudulent petitions or by taking appropriate steps to prevent the petitions from moving forward in the process. Therefore, we did not identify any significant deficiencies during our testing of these controls. We submitted certification petitions and conducted other covert investigative work for three fictitious schools, all of which have differing certification requirements. Using these schools, GAO agents applied for SEVP certification. For one of the fictitious schools, we tested SEVP certification controls that require schools to submit complete documentation by submitting an application for the school that was missing several of the required documents. Consistent with its procedures, ICE flagged our petition as incomplete and sent us a notification stating that our petition was canceled because we failed to submit all supporting evidence as outlined in the regulations. For our second school, we tested SEVP controls requiring schools to schedule and complete a site visit conducted by an SEVP field representative, by submitting a completed petition, but avoiding the site visit and requesting that our paperwork move forward without it. SEVP’s field representative subsequently notified us that our petition would not move forward until a site visit was performed. For our third fictitious school, we submitted an application, and participated in a site visit with SEVP officials. We tested SEVP controls related to verifying application documentation, and whether SEVP site- visit officials followed established procedures for the site visit. The field representative toured the facilities and interviewed GAO agents posing as school officials. During its review of our petition, ICE took steps to verify our school’s information and discovered that documentation we submitted was fictitious. As a result, SEVP officials subsequently referred our school to ICE agents for further investigation, consistent with ICE policies and procedures. Upon learning that ICE followed its documented internal control processes, we concluded our covert testing. ICE faces long-standing challenges in conducting school recertification on a 2-year basis consistent with statute and regulation, which may allow potentially fraudulent schools to operate for a longer period without detection. The Enhanced Border Security and Visa Entry Reform Act of 2002 states that DHS must conduct compliance reviews every 2 years, during which ICE reviews a school’s records to verify that it continues to comply with program-eligibility requirements. ICE began the first recertification cycle in May 2010—8 years after the enactment of the statutory requirement for periodic review of SEVP-certified schools. As of March 2012—nearly 10 years after statutory enactment—ICE reported that it had recertified approximately 19 percent of certified schools. In October 2016, ICE reported that it had completed its first round of recertification (in other words, all existing certified schools had been recertified at least one time) and had used recertification to address a number of issues, including gathering missing data for some school records. ICE has continued to recertify schools. However, Certification Unit officials told us that, while recertification should be conducted every 2 years, ICE has been unable to meet a 2-year time frame for all certified schools. ICE has been extending schools’ certification expiration dates since officials began recertifying schools in 2010, according to Certification Unit officials, to provide additional time for adjudicating recertification petitions. According to ICE regulations, schools should be notified 180 days before their certification expiration date and must file a completed petition for recertification by such date, which is 2 years from the date of their previous SEVP certification or the recertification expiration date. However, as described in figure 9, SEVP has been extending schools’ certification expiration dates by 180 days beyond the 2-year mark as defined in ICE’s regulation. Under this process, schools must submit their complete petition and supporting documentation to SEVP within 180 days after the 2-year mark. Extending certification expiration dates increases the period between each recertification review, resulting in a decrease in the number of recertification reviews conducted in a given time frame, as shown in the hypothetical example of two schools in figure 10. For instance, if SEVP initially certified a school in January 2016, by providing an extension SEVP is setting the school’s certification expiration date to July 2018—2 years and 180 days after the initial certification—as opposed to 2 years after the initial certification, which would be consistent with ICE regulations. After receiving the school’s documentation, Certification Unit staff need time to review and adjudicate the petition. If this school submits a complete petition to SEVP in June 2018—1 month before its revised expiration date—SEVP staff may and do take additional time, depending on the facts and circumstances of the specific petition, beyond the revised expiration date to adjudicate the petition. SEVP officials stated that, if necessary, they can further extend the certification expiration date to accommodate the time needed for their review. For instance, SEVP may not adjudicate this school’s petition until December 2018. Once SEVP completes its adjudication in December 2018, the school’s new certification expiration date would be June 2021 (2 years and 180 days after December 2018). Thus, rather than potentially being able to complete two rounds of recertification during this 5-year period consistent with ICE regulation, SEVP would recertify the school only once. As we reported in 2012, according to SEVP officials, ICE delayed the recertification process until after SEVIS was deployed in 2003 and the program fee was increased in 2008 to support hiring additional staff. Further, with regard to resources, ICE officials stated that they are cross- training adjudicative staff across all of their program areas to help address the recertification workload, and creating regional adjudication teams with assigned territories similar to the field representatives’ territories to allow the adjudicators to work with the same schools throughout the school’s participation in the program. In addition, in February 2018, SEVP’s Director stated that ICE was expecting to hire additional adjudicators for a total of 10. In July 2018, ICE identified the need to increase initial certification fees and add a new recertification fee to, among other things, hire additional adjudicators to address longer recertification processing times. Specifically, ICE stated that, at present staffing levels, SEVP is able to process 1,939, or 44 percent, of the required annual projected 4,400 recertification cases. ICE’s actions to allocate additional resources to the recertification process are a step in the right direction toward addressing its recertification delays. However, it is unclear whether these actions alone will be adequate to address the delays. As of June 2018, ICE officials told us that there were 3,281 recertification petitions that needed to be adjudicated. As previously discussed, recertification reviews are an important fraud risk control because they are one of ICE’s primary means of reviewing each school’s data and identifying potential school noncompliance and fraud, especially since an out-of-cycle review may not be conducted for each school. As Federal Internal Control Standards state, management should: (1) establish and operate activities to monitor the internal control system and evaluate the results, and (2) identify, analyze, and respond to risks related to achieving the defined objectives. By not requiring schools to submit their petitions within the 180-day period prior to the 2-year expiration date, as required by regulation, ICE has limited assurance it is leveraging the recertification process effectively to identify and respond to potential fraud risks to the program, including those risks associated with allowing a fraudulent school to operate for a longer period. ICE’s plan to increase the number of SEVP adjudicators may help it meet the 2-year recertification requirement, but without monitoring and evaluating the efficacy of these actions, ICE will not have reasonable assurance it can effectively manage the recertification process and associated fraud risks. As previously discussed, ICE’s queue of recertification petitions awaiting adjudication creates additional fraud risks to the program if higher-risk schools continue to operate pending recertification. However, ICE has not assessed the magnitude of such risks. As of June 26, 2018, ICE had 3,281 recertification petitions in a queue for review, according to SEVP officials, petitions that ICE adjudicates in the order in which they were filed. As discussed, ICE uses a variety of mechanisms to monitor schools’ ongoing compliance with program requirements and mitigate fraud risks. In addition, ICE assesses and considers schools’ risks during the adjudication process for recertification. Specifically, according to SEVP’s recertification standard operating procedures, case analysts in the Certification Unit are to review the recertification packages once submitted to determine whether they are complete and prepare them for adjudication. Further, SEVP officials stated that the Certification Unit staff use an assessment of the school’s risk to help prioritize further analysis and review efforts. When adjudicating recertification petitions, adjudicators are to confirm that they have assessed the school’s risk and whether any identified risks have previously led to any further action, according to Certification Unit officials. If case analysts determine that compliance issues are present (e.g., the school has closed or the school has made updates to the Form I-17 that are awaiting adjudication), they are to notify their supervisors. For higher-risk schools, Certification Unit officials stated that adjudicators may request more detailed evidence from schools as part of recertification, consistent with their standard operating procedures, than they would for lower-risk schools to help make more efficient use of the resources in this unit. These processes have helped SEVP consider and address potential risks during the recertification process. However, SEVP has not determined risks posed by schools in its recertification queue and, according to Certification Unit officials, does not prioritize the review of schools’ recertification petitions in its queue based on risk. As previously noted, ICE is required to conduct periodic reviews every 2 years to determine SEVP-certified schools’ continued program eligibility and compliance. The statute governing recertification does not, by its terms, preclude ICE from considering a school’s relative risk as part of the compliance review process. However, SEVP’s Director and Certification Unit officials stated that a recertification process that prioritizes reviews based on school risk would not be particularly helpful or add value in addressing school compliance concerns because the officials already have a number of mechanisms they can use, as previously discussed, to address potential noncompliance, including conducting out-of-cycle reviews of high-risk schools. Although ICE considers schools’ risk-related information during the adjudication process and may identify noncompliant or potentially fraudulent schools through ongoing monitoring activities, ICE has not determined the extent to which there are residual fraud risks posed by schools in the recertification queue that ICE has identified as higher-risk than other schools awaiting recertification. According to GAO’s Fraud Risk Framework, managers should rank residual fraud risks in order of priority, using the likelihood and impact analysis, as well as risk tolerance, to help decide how to allocate resources to respond to residual fraud risks, all of which is documented in a fraud risk profile. As previously discussed, a fraud risk profile (1) identifies the inherent fraud risks affecting the program, (2) assesses the likelihood and effect of each type of fraud risk that it has identified, (3) determines the agency’s tolerance for certain types or levels of fraud risks in the program, and (4) examines the suitability of existing controls for each fraud risk. Given SEVP’s long- standing delays in recertifying schools, without an assessment of residual risks posed by the recertification queue—as part of its fraud risk profile, as previously noted—ICE cannot ensure that it is effectively addressing the risks posed by higher-risk schools awaiting recertification, a situation that does not help further strengthen ICE’s fraud risk-management efforts in SEVP. ICE has identified fraud risks related to DSOs and implemented controls to mitigate these risks, but weaknesses exist in four key areas: (1) verification of information provided by DSOs in support of their eligibility, (2) background checks, (3) mandatory compliance training, and (4) fraud- risk training. Prior to approval of schools’ nomination of individuals to serve as DSOs, these nominees must meet eligibility requirements and pass a criminal-background check, but weaknesses exist in both of these controls. In addition, once ICE approves prospective DSOs, it has controls for oversight and training; however, this training is not mandatory and does not address fraud risks. ICE has eligibility requirements for school employees seeking to serve as DSOs at SEVP-certified schools, as discussed earlier, but does not routinely verify DSO-submitted eligibility information in support of their immigration or citizenship status. According to ICE regulations, to be eligible to participate as a DSO, an individual must be a regularly employed member of the school administration whose office is located at the school and must meet two primary eligibility criteria. First, a DSO’s compensation may not include commissions for recruitment of foreign students. To verify that requirement, a field representative is to interview a school’s principal DSO during an initial certification site visit, and ask whether any prospective DSOs receive compensation from commissions for recruitment of foreign students. In addition, a field representative is to review the school’s website for recruitment-related activities and evaluate the DSO’s job title and position description, according to ICE officials. Second, DSOs must be U.S. citizens or lawful permanent residents, but the Certification Unit does not routinely verify the evidence provided to meet this eligibility requirement. Specifically, DSOs are to submit documentation during the school’s certification or recertification process— such as a passport, birth certificate, Permanent Resident Card or Alien Registration Receipt Card, or copy of naturalization/citizenship certificate—as evidence of their U.S. citizenship or lawful permanent resident status. The Certification Unit is to review this documentation to verify that the biographic details match the information provided on the school’s Form I-17. According to ICE officials, if the Certification Unit suspects that a prospective DSO’s documentation may not be valid, it will send the information to the Compliance Unit for additional review. However, neither the Certification Unit nor the Compliance Unit routinely verify the information reported by DSOs in support of their immigration or citizenship status because they do not have access to the type of information needed to independently verify this information for all prospective DSOs, according to ICE officials. Certification Unit officials told us that verifying information on naturalized U.S. citizens and lawful permanent residents would be beneficial. They said that they have previously asked for access to information, such as other DHS databases that contain information on naturalized U.S. citizens or lawful permanent residents, to strengthen their process for determining the eligibility of prospective DSOs. However, they have yet to receive access to this information. In addition, verifying eligibility information for U.S.-born citizens would also be valuable, but is more difficult than for naturalized U.S. citizens or lawful permanent residents, according to ICE officials. This is because ICE does not collect DSOs’ Social Security numbers— key information necessary to verify U.S. citizenship—in part because SEVIS does not have the necessary security features needed to collect and house those data, and adding those features would be costly. In June 2018, ICE management officials stated that they were reviewing databases that may be useful to verify DSOs’ self-reported eligibility information but did not provide any additional support or documentation of those plans or a time frame for completing this review. As outlined in our Fraud Risk Framework, as part of an effective antifraud strategy, managers should take steps to verify reported information, particularly self-reported data. Specifically, managers can benefit from conducting data matching to verify key information, including self-reported data and information necessary to determine eligibility, using government or third-party sources to verify data electronically. Until ICE routinely verifies the eligibility information submitted by prospective DSOs in support of their immigration or citizenship status, particularly for naturalized U.S. citizens and lawful permanent residents, ICE will not be able to ensure that it is preventing ineligible individuals, including those who represent a fraud risk, from becoming DSOs and providing them with access to SEVIS to maintain student records. ICE has taken some initial steps to strengthen the process for vetting prospective DSOs but has not implemented comprehensive background checks on DSO nominees prior to approving them to carry out the DSOs’ reporting, record-keeping, and other functions. ICE officials told us that they have been working since December 2016 to develop a plan to conduct comprehensive background checks on prospective DSOs to address past concerns about DSO vetting. Specifically, in 2011, ICE expressed concerns that DSOs, who were not required to undergo background checks, were responsible for maintaining updated information of foreign students in SEVIS. According to ICE officials, they have taken initial steps to address these concerns by implementing criminal-background checks on prospective DSOs. Specifically, in May 2017, ICE started conducting background checks on all school employees nominated to be DSOs at the time of petitioning for initial SEVP certification or whenever a school requests to add a new DSO. For these types of checks, ICE officials within CTCEU are to review the prospective DSO’s biographic information from both the Form I-17 and the proof of U.S. citizenship or immigration status documentation received by the school. After ICE officials in CTCEU complete this check, they are to forward the findings to SEVP for review. If SEVP determines that a prospective DSO is unsuitable for participation in the program, ICE officials in SEVP are to send a notice of rejection to the nominating school. From April 2017 to March 2018, ICE screened approximately 4,750 prospective DSOs and identified 68 individuals with a criminal history. ICE rejected the nomination of 15 of these prospective DSOs, because, for example, they had criminal histories that included instances of identity theft, fraud in obtaining U.S. citizenship, and conspiracy, among other crimes. ICE officials stated that certain crimes will not necessarily disqualify a candidate, such as misdemeanors, traffic- related infractions, or other lesser crimes. As of June 2018, ICE officials told us that they are developing a more- comprehensive background-check process to screen prospective DSOs against additional government data sources. Specifically, ICE officials told us that they are seeking to partner with DHS’s Transportation Security Administration (TSA) to collect biometric information (e.g., fingerprints) on prospective DSOs at TSA’s enrollment provider locations nationwide during the school certification process. ICE officials stated that they intend to provide the biometric information they collect through TSA’s enrollment provider to ICE’s Office of Professional Responsibility (OPR), and OPR officials will review such information to determine DSOs’ suitability. According to agency documentation, ICE’s OPR would vet such information against data sources to screen these individuals for prior criminal histories such as sexual misconduct, terrorist activities, and immigration violations. According to ICE officials, they also intend to use this process to periodically review the suitability of incumbent DSOs. While ICE officials have told us they intend to expand the screening of prospective DSOs, ICE does not have a documented implementation plan that outlines how the project will be executed. The Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) identifies standards related to project-management processes, including the need to have documented implementation plans describing how the project will be executed, monitored, and controlled, as well as requirements and techniques for communication and establishing agreements among stakeholders. In addition, GAO’s Schedule Assessment Guide identifies best practices associated with developing and maintaining a reliable, high-quality schedule. ICE provided us with a draft of its revised background-check policy, talking points on its plans for these checks, and draft requirements it shared with TSA in December 2016. However, these documents do not provide a detailed project- implementation plan to guide ICE’s effort. As of June 2018, ICE and TSA officials have met twice in the last 2 years, and ICE officials do not have any documents or other written details on their planned coordination with TSA. SEVP’s Director acknowledged that SEVP will need to develop a project plan to help guide its coordination with TSA and ICE’s OPR. Without a documented implementation plan for this effort that outlines how the project will be executed, monitored, and controlled, ICE does not have reasonable assurance that it will be able to implement a more- comprehensive DSO background-check process. ICE has established mechanisms for monitoring SEVIS usage by approved DSOs and providing support to DSOs to help them ensure their schools comply with SEVP requirements but does not mandate training for DSOs. Once DSOs are approved by SEVP, they are authorized to make changes to student records in SEVIS and to create Forms I-20, which enable students to apply for nonimmigrant student status. To detect noncompliance and fraud that may be committed by DSOs during this process, ICE has established mechanisms to monitor information entered and identify data for computers used by DSOs through SEVIS compliance checks, among other things. For example, according to agency officials, ICE monitors DSO actions in SEVIS to help prevent noncompliance and fraud. In addition to monitoring DSOs’ use of SEVIS, ICE provides support and training to DSOs to help ensure they can effectively update and maintain student records in SEVIS and provide recommendations to students regarding the maintenance of their status, according to our review of ICE documentation and interviews with ICE and school officials. According to program rules, DSOs are responsible for understanding SEVP regulations related to the requirements for foreign students’ admission, maintenance of status, and change of status and requirements for school approval. To assist them, ICE officials and DSOs that we interviewed told us that SEVP uses its field representatives to provide DSOs with a point of contact for questions related to the program. According to SEVP’s internal guidance, field representatives are expected to visit the schools within their areas of responsibility at least once a year to provide in-person guidance and training to DSOs. DSOs at 15 of the 17 schools we visited stated that the field representatives were helpful, including with providing guidance on how to comply with SEVP rules and regulations. In addition, SEVP internal guidance encourages DSOs to take its web- based training course on the responsibilities and obligations for both DSOs and foreign students in SEVIS. However, this course is voluntary. According to ICE officials and field representatives, the extent to which DSOs take the voluntary training varies—some DSOs receive additional training beyond the voluntary SEVP training, but other DSOs do not complete any training. ICE officials noted that the voluntary online training may be perceived as cumbersome and that, since it is not required, many DSOs instead reach out to field representatives or call the SEVP Response Center to get answers to questions that are covered by existing training materials. ICE officials also stated that they do not know the extent to which DSOs have completed the online training because they do not track this information. Further, the officials acknowledged that since training is voluntary, some DSOs may not complete it before assuming their responsibilities and gaining access to SEVIS. ICE officials we interviewed told us they encounter problems with DSOs complying with record-keeping requirements; however, they believe most of these issues are a result of DSOs not understanding program rules or their own responsibilities within the program. According to agency documentation, in 2014 SEVP found that some DSOs were inconsistently reporting school information in several SEVIS data fields. In addition, SEVP’s Risk Assessment Tool includes a number of high-risk indicators that may stem from DSO record-keeping errors within SEVIS, including students listed as enrolled in an academic program not available at that school (e.g., doctoral students at schools without doctorate degrees available) and students listed as active who have long exceeded their program’s end date or authorized employment’s end date. Errors such as these make it difficult for ICE officials to know whether the information in SEVIS is inaccurate due to unintentional mistakes by the DSO or whether the school or its employees may be engaged in potential fraud. For additional examples of potential noncompliance or fraud, see the box below. Potential Designated School Official Noncompliance or Fraud Student and Exchange Visitor Program officials cited the following examples of potential noncompliance or fraud that they have encountered, among others: the reported foreign-student enrollment listed in the Student and Exchange Visitor Information System (SEVIS) does not seem to correspond with the number of students attending class or the size of the school’s physical space, all enrolled foreign students listed in SEVIS are living at the same address, and students repeatedly transfer to several different schools. Field representatives at one location we visited noted that DSOs with multiple job responsibilities may not have time to keep up with SEVP rules and policy updates. Similarly, DSOs at 7 of the 17 schools we spoke with mentioned that they have multiple job responsibilities beyond their DSO duties. In addition, SEVP officials indicated that DSOs have a high rate of turnover, especially at small schools, and may lack the expertise to effectively follow program requirements. SEVP officials acknowledged that mandatory training could help reduce the number of unintentional violations by DSOs who may not adequately understand the program’s regulations, thus allowing SEVP staff to focus their monitoring efforts on schools and individuals who may be engaged in intentional noncompliance and fraud. In June 2018, ICE officials told us that they recently received internal agreement to require all new DSOs to complete training prior to gaining full access to SEVIS once the officials release a new version of their DSO training program. However, SEVP officials could not provide documentation on their plans, including time frames for completing the revised DSO-training program, whether to require DSO training, or how they will track DSO compliance. Federal Internal Control Standards calls for agencies to demonstrate a commitment to competence, including recruiting, developing, and retaining competent individuals. Further, it recommends that agencies establish expectations of competence for key roles, including possessing the necessary knowledge, skills, and abilities, and training individuals appropriately. Without mandatory training and a process to verify that training is completed, SEVP does not have reasonable assurance that DSOs are familiar with, and understand, their roles and responsibilities as outlined in program regulation. SEVP’s voluntary DSO training emphasizes student and school compliance with program rules and the DSOs’ responsibilities to enter and maintain complete and accurate information in SEVIS in a timely manner but does not address fraud risks to the program, including previously identified fraud schemes or trends. According to ICE officials, some DSOs may receive fraud-specific training from ICE agents through the Project Campus Sentinel initiative; however, these visits are limited to a small portion of certified schools each year. During a Project Campus Sentinel visit, ICE guidance states that an ICE agent will meet with DSOs and provide information on how to detect potential fraud, including student visa exploitation and national security vulnerabilities. In addition, ICE guidance encourages ICE agents to remind DSOs to contact them when they encounter these instances. In fiscal year 2017, ICE officials reported that ICE agents visited 400 of the more than 18,000 SEVP- certified school campuses in existence at that time. According to ICE officials, the agency can only conduct a limited number of Project Campus Sentinel visits to schools each year due to competing investigative priorities. The DSOs we spoke with varied in their understanding of the role they should play in identifying and reporting fraud to SEVP. Specifically, DSOs at 8 of 17 schools told us they did not receive training on SEVP-related fraud risks or could not identify SEVP-provided, fraud-specific training. For example, DSOs at one school told us that there is confusion among DSOs about their role to prevent and report fraud and that this issue has been discussed at past training events and conferences. Specifically, they stated that there is some confusion over the difference between fraud and noncompliance. According to these DSOs, they are responsible for addressing issues of noncompliance, but they do not actively look for SEVP-related fraud. A DSO from another school told us she interprets the DSO role as providing program oversight, including oversight related to fraud, and that she previously reported an instance of potential student fraud to ICE when she encountered suspicious immigration paperwork. In addition, DSOs at another school told us that they were not aware of any training related to fraud risks within SEVP but noted that guidance about fraud trends or potential red-flag indicators could be useful. The Fraud Risk Framework identifies training as one way of demonstrating an agency’s commitment to combating fraud. Training and education intended to increase fraud awareness among stakeholders, managers, and employees serves as a preventive measure to help create a culture of integrity and compliance within the agency. Specifically, the Fraud Risk Framework discusses leading practices for training and education, including communicating responsibilities for implementing fraud controls and details on how and where to report fraud. In addition, increasing awareness of fraud schemes, including red flags and risk indicators, through training and education can serve a preventive purpose by helping create a culture of integrity and compliance within the program and can enable managers, employees, and stakeholders with responsibility for implementing aspects of the program to better detect potential fraud. According to ICE officials, DSOs can serve as the front line against SEVP-related fraud, and they provide a significant portion, if not the majority, of fraud-related tips. In June 2018, ICE officials told us that, in response to discussions that we had during our review, they plan to incorporate fraud training into the revised DSO training. However, because ICE officials just recently made that decision, they had not yet developed documented plans for this training or timelines for when it would be completed. While agreeing to incorporate fraud training into the revised DSO training is a good first step, the development and execution of those plans will be needed to strengthen fraud controls. Until ICE develops and implements a plan for fraud-specific DSO training, ICE will not have reasonable assurance that this training will be delivered and DSOs will have the information they need to address fraud within the program. Through SEVP, ICE oversees over 1.2 million foreign students at nearly 9,000 SEVP-certified schools across more than 18,000 campuses. Past instances of fraud and noncompliance in the program have resulted in ICE taking some steps to address fraud risks in the program, such as developing a Risk Assessment Model and Framework. However, ICE does not have a fraud risk profile that identifies all of SEVP’s fraud risks, discusses the likelihood of those risks, assesses related controls, and identifies the agency’s tolerance for risk. Such a fraud risk profile would help ICE more effectively assess whether additional internal controls or changes to policies or regulations are needed. Moreover, ICE has not yet fully employed the use of data analytics, such as network analysis, to help it identify potentially fraudulent schools before they become certified to enroll foreign students and help it better use its administrative and investigative resources. ICE has also made improvements to its processes for certifying and recertifying SEVP schools and monitoring DSOs—all of which can help reduce the risk of fraud in the program. However, ICE continues to delay the recertification process by initiating the school recertification reviews after the 2-year certification expiration date, which is not consistent with ICE regulations. Further, ICE has not included an assessment of residual risks posed by the current recertification queue—as a part of the fraud risk profile previously noted—and as a result does not have a full understanding of the risks associated with schools awaiting recertification. Although DSOs play an important role in helping ICE oversee students in the program, ICE has recognized they can pose fraud risks to the program. However, ICE does not routinely verify DSO-submitted eligibility information and DSO suitability for participation in SEVP, and therefore does not have reasonable assurance that only eligible and suitable DSOs are participating in the program. Finally, ICE has not developed or implemented mandatory and fraud-specific training to improve DSOs’ compliance with program requirements and aid its efforts to detect fraud in the program. We are making the following seven recommendations to ICE: The Director of ICE should develop a fraud risk profile that aligns with identifies inherent fraud risks affecting the program, assesses the likelihood and impact of inherent fraud risks, determines fraud risk tolerance, and examines the suitability of existing fraud controls and prioritizes residual fraud risks, including residual risks posed by the recertification queue. (Recommendation 1) The Director of ICE should build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. (Recommendation 2) As ICE works to complete its efforts to hire additional SEVP adjudicators, the Director of ICE should begin notifying certified schools 180 days prior to, and requiring submission of complete recertification petitions by, the 2-year certification expiration date, consistent with regulation, and evaluate whether additional resources are needed. (Recommendation 3) The Director of ICE should, as practicable, verify the eligibility information provided to establish the immigration or citizenship status of lawful permanent residents and naturalized U.S. citizens, as well as U.S.-born citizens, who have been nominated or renominated to serve as DSOs. (Recommendation 4) The Director of ICE should develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. (Recommendation 5) The Director of ICE should implement mandatory DSO training and verify that the training is completed. (Recommendation 6) The Director of ICE should complete the development and implementation of its plans for mandatory fraud-specific training for DSOs. (Recommendation 7) We provided a draft of this report to DHS for its review and comment. In its written comments, reproduced in appendix V, DHS concurred with our recommendations and described specific steps it plans to take in response to all seven of our recommendations. DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Rebecca Shea at (202) 512-6722 or shear@gao.gov or Rebecca Gambler at (202) 512-8777 or gamblerr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. Table 1 contains information on the eight recommendations that we made to U.S. Immigration and Customs Enforcement (ICE) in our 2012 report, and ICE’s actions to address them. We closed each of these recommendations as implemented. This report is a public version of a sensitive report that we issued on November 20, 2018, which examined the efforts that U.S. Immigration and Customs Enforcement (ICE) has taken since our 2012 report to address fraud risks, including the extent to which ICE has (1) taken steps to strengthen its management of fraud risks in the Student and Exchange Visitor Program (SEVP), (2) implemented controls to address fraud risks in the school certification and recertification processes, and (3) implemented fraud risk controls related to the eligibility, suitability, and training of Designated School Officials (DSO).The sensitive report included information related to SEVP internal controls used to help prevent and identify noncompliance or fraud in the program. The sensitive report also discussed some planned actions to improve these internal controls, some of which the Department of Homeland Security (DHS) deemed to be sensitive and must be protected from public disclosure. This public report omits the information that DHS deemed to be sensitive including details associated with (1) the oversight of schools during the certification and recertification process, (2) our covert testing of SEVP certification internal controls, and (3) current and planned actions to oversee DSOs. Although the information provided in this report is more limited, it addresses the same objectives and uses the same methodology as the sensitive report. For our first objective, to evaluate the extent to which ICE has taken steps to strengthen its management of fraud risks in SEVP, we assessed actions ICE, particularly SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), have taken since 2012 to design and implement controls to address fraud in the postsecondary, vocational, and English language school certification and recertification process. We reviewed documents including regulations, processes and procedures, and guidance related to fraud risk management, school certification, and recertification processes, and the role of DSOs. We evaluated the extent to which ICE’s practices were consistent with Standards for Internal Control in the Federal Government and GAO’s A Framework for Managing Fraud Risks in Federal Programs. In particular, we analyzed ICE documentation, such as standard operating procedures, policy statements, and guidance for adjudicators to determine how ICE’s processes and systems identify and assess risk in SEVP, including the SEVP Risk Assessment Model and Framework, Risk Assessment Tool, Risk Register, and other internal guidance. In addition, we reviewed information from ICE’s current SEVP administrative, watch, and criminal investigative cases and analyzed information on past cases of SEVP fraud, including indictments. Also, we interviewed ICE officials within SEVP to evaluate the extent to which the program has taken steps to strengthen its management of fraud risks since 2012. We met with senior officials from SEVP, including SEVP’s Director and management of the Risk Management Support Team, School Certification Unit (Certification Unit), Analysis and Operations Center (Compliance Unit), Policy Team, and Field Representative Unit. We interviewed officials from ICE’s Office of the Principal Legal Advisor to discuss regulatory priorities and legal authorities related to fraud prevention and detection. We also interviewed officials from ICE’s Identity Benefit Fraud Unit and Domestic Operations to discuss their roles in SEVP-related fraud prevention. In addition, we met with officials from CTCEU headquarters, including the Student and Exchange Visitor Information System Exploitation Section and criminal investigators from 5 of the 26 ICE field offices to discuss past cases of SEVP-related fraud and steps taken to identify and prioritize fraud risk. We visited ICE field offices in Washington, D.C.; Los Angeles and San Francisco, California; Newark, New Jersey; and New York, New York. We selected these locations based on a mix of criteria, including the following characteristics: (1) number of ongoing investigations of certified schools; (2) reported previous and current experience investigating SEVP-related fraud; (3) number of field representatives assigned to or located near the field office; and (4) number of schools that were located proximate to the field office and that were either pending recertification, as of July 2017, or have been recertified since August 2016. As we did not select a probability sample of ICE field offices to interview, the results of these interviews cannot be generalized to all of ICE’s 26 field offices. However, the interviews provided us with perspectives of ICE officials responsible for conducting school fraud investigations, including their views on the process SEVP has established for certifying and monitoring schools, fraud, and national security vulnerabilities related to foreign students, and any challenges field offices have faced in their investigations. We conducted a network analysis utilizing both public and proprietary information associated with currently certified schools to determine the potential to utilize additional data analytics to aid fraud risk-management efforts in SEVP. To develop this analysis, we identified a list of schools that, as of July 2017, had been identified by ICE as either being under active criminal investigation or subject to additional oversight or administrative action due to compliance concerns. We also selected a list of SEVP-certified postsecondary schools without such identified concerns as of September 2017. We restricted our set of schools to those with at least 20 foreign students as of September 2017. In total, 2,439 schools comprising 170 with concerns and 2,269 without such concerns were analyzed. We then used an outside vendor to provide public and proprietary information such as descriptive information associated with these schools including addresses, businesses, and past executives. Using these data, we used network-analysis techniques to identify connections between both those schools with criminal or compliance concerns and schools without such identified concerns. We determined whether each of the postsecondary schools without compliance concerns were linked to any of those with compliance concerns via executive employment. Specifically, we identified instances in which an official associated with a school with criminal or compliance concerns was associated with another school not identified as having those concerns. The underlying logic behind this focus was that schools associated with an official linked to a school of concern may potentially indicate the need for further review of possible criminal or compliance concerns. To further validate this information, we conducted additional research using investigative databases and the Internet to try to verify the instances identified in our analysis such as by ensuring the time frames of the connection appeared relevant or to verify the identity of individuals and schools involved. While such connections are not proof of criminal or compliance problems, they may potentially be indicative of them. This is a diagnostic that has been used in other fraud-related network research. For our second objective, to evaluate the extent to which ICE has implemented controls to address fraud risks in the school certification and recertification processes, we assessed documentation describing SEVP’s school certification and recertification controls, interviewed headquarters and selected field-office ICE officials, and analyzed agency-provided recertification data. Specifically, we assessed SEVP’s standard operating procedures, including its Adjudicator’s Manual, training materials, and other guidance to determine whether the certification and recertification controls described in these documents addressed the high-risk indicators ICE identified in its Risk Assessment Tool. We used this analysis to determine any potential noncompliance and fraud vulnerabilities in these controls. We also assessed SEVP’s controls in these areas against Standards for Internal Control in the Federal Government related to risk management, as well as principles of the Framework for Managing Fraud Risks in the Federal Government. Additionally, we interviewed ICE officials in SEVP’s Certification Unit, which is responsible for adjudicating certification and recertification petitions, and the Compliance Unit, which is charged with monitoring schools for ongoing compliance with regulatory record-keeping and reporting requirements. To understand how ICE Homeland Security Investigations agents in the field offices work with officials in SEVP and the CTCEU to investigate school fraud, we conducted semistructured interviews with ICE agents in five field offices. We also interviewed ICE officials from SEVP’s Field Representative Unit as well as eight field representatives assigned to or located near the selected field offices to gather information on the representatives’ roles and activities in identifying and reporting potential school fraud. Further, we conducted covert testing of SEVP’s internal control activities related to the school certification process. Specifically, we submitted certification petitions and conducted other covert investigative work for three fictitious schools, each of which are subject to particular petition requirements. For one of the fictitious schools, we tested SEVP certification controls that require schools to submit complete documentation by submitting a petition for the school that was missing several of the required documents. For our second school, we tested SEVP controls requiring schools to schedule and complete a site visit conducted by an SEVP field representative, by submitting a completed petition for the accredited business school, but avoiding the site visit and requesting that our paperwork move forward without it. For our third fictitious school, we submitted a petition and participated in a site visit with SEVP officials, using a rented space as a fictitious school location. We tested SEVP controls related to verifying petition documentation, and whether SEVP site-visit officials followed established procedures for the site visit. For all three petitions, we used publicly available information to construct our scenarios. We then documented any actions taken by SEVP on the submitted petitions, such as completeness checks, investigative steps, adjudication decisions or requests to provide additional supporting documentation, among other things. Results for all three covert tests, while illustrative, cannot be generalized to the full population of petitions. For our third objective, to determine the extent to which ICE implemented fraud risk controls related to the eligibility and suitability of DSOs, we assessed guidance, training, and policies related to DSOs. Specifically, we reviewed regulations for DSO eligibility and SEVP guidance and standard operating procedures to determine whether supporting evidence provided to meet these requirements is being verified, including the Field Representative Unit’s Site Visit Standard Operation Procedure and the Certification Unit’s Adjudicator’s Manual. We evaluated the extent to which ICE’s practices for verifying eligibility were consistent with the Framework for Managing Fraud Risks in the Federal Government. In addition, we reviewed the current and planned documentation and procedures on ICE’s existing and planned background checks, including the existing documentation for DSO vetting against relevant databases, initial requirements for planned biometric screening, and a draft policy document for the planned checks. To gather additional perspectives, we interviewed ICE officials in headquarters and selected field offices. We also interviewed selected DSOs in the field. We identified leading practices for project planning in the Project Management Institute’s A Guide to the Project Management Body of Knowledge. In addition, we reviewed the best practices associated with developing and maintaining a reliable, high-quality schedule in the GAO Schedule Assessment Guide. In assessing current training and oversight for DSOs, we examined guidance, policies, and procedures for the SEVP Field Representative Unit and CTCEU’s Project Campus Sentinel. We assessed the implementation of these controls against criteria in Standards for Internal Control in the Federal Government and A Framework for Managing Fraud Risks in Federal Programs. We reviewed DSO training materials, including the Online Training for DSOs and the Study in the States website. To determine how ICE identifies fraud risk associated with DSOs, the controls in place for addressing and mitigating these risks, and its efforts to identify potential vulnerabilities in its controls, we met with ICE officials at headquarters and five selected field offices, as discussed above. To identify the extent to which they have DSO training and antifraud responsibilities and requirements, we interviewed selected field representatives. Furthermore, we interviewed DSOs at 17 selected certified postsecondary schools on their roles and responsibilities and training resources. We selected these officials because, as of September 2017, they constituted a group of representatives from certified schools of various types and sizes and were located in proximity to our previously selected ICE field-office locations. As we did not select a probability sample of DSOs to interview, the information we obtained from these school officials cannot be generalized. These interviews provided us with the perspectives of DSOs on their roles and responsibilities, training, and fraud risks within the program. Further, we interviewed officials from NAFSA, an association of international educators, to discuss the organization’s views on fraud risks within SEVP, and we reviewed an extract from the NAFSA Advisor’s Manual of federal regulations affecting foreign students and scholars. GAO’s A Framework for Managing Fraud Risks in Federal Programs states that, in planning the fraud risk assessment, effective managers tailor the assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process (see fig. 11). On the basis of our analysis of U.S. Immigration and Customs Enforcement (ICE) data, the Student and Exchange Visitor Program (SEVP) withdrew certification for approximately 2,600 schools during the period of fiscal years 2013 through 2017 (see fig. 12). The Enhanced Border Security and Visa Entry Reform Act of 2002 states that a material failure of an SEVP-certified school to comply with the record-keeping and reporting requirements to receive nonimmigrant students shall result in the suspension for at least 1 year, or termination, of the school’s approval to receive such students. Under federal regulation, SEVP can deny an SEVP-certified school’s recertification petition or, as a result of a subsequent out-of-cycle review, can withdraw certification, if the school or its programs are no longer eligible for certification. Denial of recertification or withdrawal on notice as a result of out-of-cycle review may be for any valid and substantive reason, including failure to comply with record-keeping and reporting requirements, willful issuance by a DSO of a false statement, or not operating as a legitimate institution, among other bases. According to SEVP officials, denials resulting from recertification reviews are often based on historical discrepancies in the DSO’s data entry, record-maintenance and Form I-20 issuance issues, or a negative change in the school’s operating status, such as a loss of state licensure. By regulation, an appeal of a notice of denial or withdrawal must be made within 15 days after service of the decision. Schools denied recertification must, according to regulations, wait at least 1 calendar year from the date of denial of recertification or withdrawal notice before being eligible to petition again for certification. If, upon the completion of an out-of-cycle review, SEVP determines that a school has failed to sustain eligibility or has failed to comply with the record-keeping, retention, reporting, or other requirements, SEVP will institute withdrawal proceedings by serving the school a notice of intent to withdraw SEVP certification. Failure of a school to respond to a notice of intent to withdraw within 30 days will result in an unappealable withdrawal of the school’s certification. At the conclusion of withdrawal proceedings, a school found to be ineligible for continued SEVP certification as a result of an out-of-cycle review will receive a notice of withdrawal. SEVP withdrew on notice approximately 211 certifications from fiscal years 2013 through 2017 (see fig. 12). If SEVP staff identify an issue during an out- of-cycle review that seems to be an error not warranting withdrawal, SEVP could issue a Remedial Action Plan to the school describing the issues it needs to address to retain its program eligibility. According to SEVP officials, once they have gathered enough evidence and made the decision to withdraw the school’s certification, SEVP can temporarily terminate the school’s ability to issue Forms I-20 to students. For example, SEVP officials explained that if a school that is otherwise in compliance lets its accreditation lapse, SEVP may revoke its authority to issue Forms I-20 until it renews its accreditation. Regarding automatic withdrawals, SEVP will serve a notice of intent to withdraw SEVP certification to the school 30 days prior to its certification expiration date if, up until that point the school has failed to file a complete petition for recertification. From fiscal year 2013 through fiscal year 2017, SEVP automatically withdrew 1,763 certifications (see fig. 12). SEVP will not accept a petition for recertification and the school will be automatically withdrawn immediately if such school has effectively relinquished its SEVP certification by not petitioning for recertification, abandoning its petition, or not submitting a complete recertification package by the certification expiration date. Certified schools can also voluntarily withdraw their certification at any time. In addition to the contacts named above, Latesha Love (Assistant Director), Kathryn Bernet (Assistant Director), Nick Weeks (Analyst-in- Charge), David Aja, David Dornisch, Gabrielle Fagan, April Gamble, Gina Hoover, Lauren Kirkpatrick, Kirsten Lauber, Barbara Lewis, Sasan J. “Jon” Najmi, Robin Nye, George Ogilvie, Ramon Rodriguez, Constance Satchell, Sabrina Streagle, Shana Wallace, and Helina Wong made key contributions to this report.