Student and Exchange Visitor Program: DHS Needs to Assess Risks and Strengthen Oversight Functions
Highlights
What GAO Found
U.S. Immigration and Customs Enforcement (ICE) has not developed a process to identify and analyze program risks since assuming responsibility for the Student and Exchange Visitor Program (SEVP) in 2003, in accordance with internal controls standards and risk management guidance. Within ICE, officials from SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), which tracks, coordinates, and oversees school fraud investigations, have expressed concerns about the fraud risks posed by schools that do not comply with requirements. Investigators said that identifying and assessing risk factors, such as the type of school, are critical to addressing potential vulnerabilities posed across the more than 10,000 SEVP-certified schools. However, SEVP does not have processes to (1) evaluate prior and suspected cases of school noncompliance and fraud and (2) obtain and assess information from CTCEU and ICE field offices on school investigations and outreach events. For example, ICE reported that it has withdrawn at least 88 schools since 2003 for non-compliance; however, ICE has not evaluated schools’ withdrawals to determine potential trends from their noncompliant actions because case information is not well-organized, according to SEVP officials. Without a process to analyze risks, it will be difficult for ICE to provide reasonable assurance that it is addressing high-risk vulnerabilities and minimizing noncompliance.
ICE has not consistently implemented existing controls, in accordance with internal control standards and fraud prevention practices, to verify schools’ legitimacy and eligibility during initial SEVP certification and once schools begin accepting foreign students. Specifically, ICE officials do not consistently verify certain evidence initially submitted by schools in lieu of accreditation. In addition, ICE does not maintain records to document SEVP-certified schools’ ongoing compliance. GAO found that 30 of a randomly-selected sample of 48 SEVP-certified school case files lacked at least one piece of required evidence, such as proof of school officials’ citizenship or permanent residency. ICE was unable to produce 2 of the 50 case files. ICE officials noted that some files were missing because they were lost or destroyed when the Department of Homeland Security (DHS) took over the program from the former Immigration and Naturalization Service; moreover, ICE officials cannot quantify how many files are missing. Without verification of evidence and complete case files, ICE cannot provide reasonable assurance that schools were initially and continue to be eligible for certification. Further, ICE policies require that SEVP-certified flight schools offering flight training have specific Federal Aviation Administration (FAA) certifications; however, GAO found that approximately 167 of 434 (or 38 percent) SEVP-certified flight schools do not have the required certifications as of December 2011. The Border Security Act required recertification for all SEVP-certified schools by May 2004 and every 2 years thereafter to monitor schools’ continued program eligibility. SEVP officials stated that they rely on recertification to verify schools’ eligibility; however, SEVP began the first recertification cycle in May 2010 and, as of March 2012, has recertified 1,870 (or 19 percent) of certified schools. Implementing procedures to monitor state licensing and accreditation status for all types of schools and addressing flight schools that lack required FAA certification could better position ICE to reduce the risk of fraud and noncompliance.
Why GAO Did This Study
As of January 2012, more than 850,000 active foreign students were in the United States enrolled at over 10,000 U.S. schools. ICE, within DHS, is responsible for managing SEVP and certifying schools to accept foreign students. GAO was asked to review ICE’s fraud prevention and detection procedures for SEVP. This report examines the extent to which ICE has (1) identified and assessed risks in SEVP and (2) developed and implemented policies and procedures to prevent and detect fraud during the initial school certification process and once schools begin accepting foreign students. GAO analyzed documents, such as ICE’s SEVP procedures, and tested recordkeeping controls by selecting a random sample of 50 SEVP-certified schools and reviewing case files. GAO interviewed officials from SEVP, CTCEU, and 8 of 26 ICE field offices, selected based on a mix of factors, including school fraud investigations and referrals from CTCEU. While the results of the case file reviews and interviews cannot be generalized, they provided insights about SEVP.
Recommendations
GAO recommends that ICE, among other things, identify and assess program risks; consistently implement procedures for ensuring schools eligibility; address missing school case files; and establish target time frames for notifying flight schools that lack required FAA certification that they must re-obtain FAA certification. DHS concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| United States Immigration and Customs Enforcement | To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should develop and implement a process to identify and assess risks in SEVP, including (1) evaluating prior and suspected cases of school noncompliance and fraud to identify potential trends, and (2) obtaining and assessing information from CTCEU and ICE field office investigative and outreach efforts. |
In June 2012, we reported on U.S. Immigration and Customs Enforcement's (ICE) fraud prevention and detection procedures for the Student and Exchange Visitor Program (SEVP) (GAO-12-572). During the course of our review, we found that ICE had not developed a process to identify and analyze program risks since assuming responsibility for SEVP in 2003. Specifically, SEVP did not have processes to (1) evaluate prior and suspected cases of school noncompliance and fraud and (2) obtain and assess information from investigators on school investigations and outreach events. For example, ICE reported that it had withdrawn at least 88 schools since 2003 for non-compliance; however, ICE had not evaluated schools' withdrawals to determine potential trends from their noncompliant actions because case information was not well-organized, according to SEVP officials. Consequently, we recommended that ICE develop and implement a process to identify and assess risks in SEVP. In April 2014, SEVP released a two volume report detailing the program's risk management methodology and process. In this report, SEVP outlined steps taken to identify and assess risks, including evaluating prior cases of non-compliance and gathering information from criminal investigators. In September 2014, SEVP provided additional information about actions taken to institutionalize the new risk management process. These actions should help provide ICE with reasonable assurance that it is addressing high-risk vulnerabilities and minimizing noncompliance in SEVP. As a result, this recommendation is closed as implemented.
|
| United States Immigration and Customs Enforcement | To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should, once a risk assessment process is in place, conduct an analysis of how to allocate SEVP's resources based on risk and use the results of that analysis in making resource allocation decisions. |
In June 2012, we reported on U.S. Immigration and Customs Enforcement's (ICE) fraud prevention and detection procedures for the Student and Exchange Visitor Program (SEVP) (GAO-12-572). During the course of our review, we found that ICE had not conducted an analysis to assess how to allocate resources based on risk to help ensure that SEVP resources are targeted to the highest-risk program activities. Specifically, we found that in February 2012, SEVP's Director realigned the organization into two main divisions; however, SEVP had not conducted a resource analysis or considered risk information to support this reorganization. Consequently, we recommended that ICE conduct an analysis of how to allocate SEVP's resources based on risk and use the results of that analysis in making resource allocation decisions. In April 2014, SEVP released a two-volume report detailing the program's risk management methodology and process. Specifically, in the report, SEVP outlined the program's efforts to develop a framework, which uses a risk-based approach to inform the identification, prioritization, and management of noncompliant and potentially noncompliant SEVP-certified schools. In June 2015, SEVP provided additional information on a workload analysis that the program completed to help identify the resources required to meet mission objectives, including compliance activities. These actions should help provide ICE with reasonable assurance that it is using resources in a cost-effective manner to help address the program's highest risk activities.
|
| United States Immigration and Customs Enforcement | To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should consistently implement procedures for ensuring schools' eligibility, including consistently verifying "in lieu of" letters. |
According to the Student and Exchange Visitor Program (SEVP), adjudicators have been verifying all letters in lieu of accreditation since December 2012 during the school initial certification and recertification processes. In May 2015, SEVP updated its Adjudicators Manual with specific actions they must take to consistently verify evidence provided by schools, including "in lieu of letters," in accordance with our recommendation. Consistent verification of these letters could help ICE ensure that schools are legitimate and detect potential fraud early in the certification process.
|
| United States Immigration and Customs Enforcement |
Priority Rec.
To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should establish a process to identify and address all missing school case files, including determining the magnitude of the problem; obtaining required documentation for schools whose case files are missing evidence, as appropriate; and taking necessary compliance actions. |
In July 2013, SEVP completed its assessment of all SEVP-certified schools that were missing case files, and found that 392 school files were missing original records required for initial and/or continued eligibility in the program. Of the 392 schools, 128 had been previously withdrawn so their school case files could not be restored; SEVP determined that it needed to recover the remaining 264 school case files. SEVP is using its recertification process to restore the information required in these case files. As we reported in June 2012, ICE should have started the first round in 2002 and completed the first round of recertification in May 2004. We reported that ICE initiated the first round of recertification in May 2010 and estimated that it would complete the process in May 2012. As of April 2016, SEVP expected to complete the first round of recertification after processing approximately 40 outstanding school recertification applications. SEVP officials stated that they planned to complete the remaining recertifications by the end of August 2016. In October 2016, SEVP officials reported and provided supporting documentation demonstrating that they completed the first round of recertification on all schools. This step will help provide ICE with reasonable assurance that schools were initially and continue to be legitimate and eligible for SEVP certification.
|
| United States Immigration and Customs Enforcement |
Priority Rec.
To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should develop and implement a process to monitor state licensing and accreditation status of all SEVP-certified schools. |
SEVP developed a continuous process for verifying schools' state licensing and accreditation status that was finalized in the Adjudicator Field Manual in September 2014 and updated in May 2015. Since December 2012, SEVP has been monitoring state licensing and accreditation status of certified schools through the recertification process that is to occur biannually. To fully address this recommendation, SEVP needed to complete the first round of recertification. As of April 2016, SEVP expected to complete the first round of recertification after processing approximately 40 outstanding school recertification applications. SEVP officials stated that they planned to complete the remaining recertifications by the end of August 2016. In October 2016, SEVP officials reported and provided supporting documentation demonstrating that they completed the first round of recertification on all schools. This step will help provide ICE with reasonable assurance that schools were initially and continue to be legitimate and eligible for SEVP certification.
|
| United States Immigration and Customs Enforcement |
Priority Rec.
To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should establish target time frames for notifying SEVP-certified flight schools that lack required FAA certification that they must re-obtain FAA certification. |
In December 2012, SEVP clarified its policy on flight training providers to require that flight schools have FAA Part 141 or 142 certification to be eligible to enroll foreign students. In July 2013, SEVP identified 469 SEVP-certified schools with a flight component to determine their FAA Part 141/142 certification status. In particular, SEVP identified 185 of the 469 schools as standalone flight schools. As of May 2014, SEVP had made progress in recertifying those standalone schools with the proper FAA certifications and issuing Notices of Intent to Withdraw to those schools that were not in compliance with FAA certification or other recertification requirements. According to SEVP, it planned to recertify the remaining standalone schools through SEVP's first round of recertification. As of April 2016, SEVP expected to complete the first round of recertification after processing approximately 40 outstanding school recertification applications. SEVP officials stated that they planned to complete the remaining recertifications by the end of August 2016. In October 2016, SEVP officials reported and provided supporting documentation demonstrating that they completed the first round of recertification on all schools. Completing this step will better position ICE to reduce the risk of fraud and ensure all flight schools' legitimacy and eligibility.
|
| United States Immigration and Customs Enforcement | To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should revise the standard operating procedure that governs coordination among SEVP, CTCEU, and ICE field offices to specify what information to share among stakeholders during criminal investigations. |
In June 2012, we reported on U.S. Immigration and Customs Enforcement's (ICE) fraud prevention and detection procedures for the Student and Exchange Visitor Program (SEVP) (GAO-12-572). During the course of our review, we found that weaknesses in managing and sharing information on SEVP-certified schools among ICE stakeholders hindered the agency's efforts to prevent and detect school certification fraud. The standard operating procedure governing coordination between SEVP, the Counterterrorism and Criminal Exploitation Unit (CTCEU), and ICE field offices did not specifically state what information should be shared during an investigation. SEVP officials stated that they may conduct administrative activities on schools that were not known to be under investigation because CTCEU and field office investigators had not routinely shared information regarding which schools were under investigation. Consequently, we recommended that the Assistant Secretary of ICE revise the standard operating procedure that governed the communication and coordination process between SEVP, CTCEU, and ICE field offices to more specifically delineate what information to share among stakeholders during a criminal investigation. In January 2013, SEVP and CTCEU approved the agency's changes to the standard operating procedures in accordance with our recommendation. Specifically, the revised procedures requires both SEVP and CTCEU to regularly check the Treasury Enforcement and Communication System (TECS), as well as CTCEU's open case log and SEVP's compliance case log, for inclusion of schools. When a school is listed, SEVP and CTCEU will inform and coordinate with each other to ensure that SEVP will not compromise any criminal investigation by taking administrative action. Additionally, the revised procedure provides guidance on criminal investigators' requests for support. SEVP will support CTCEU and investigators in collecting evidence for criminal investigations through the analysis of relevant SEVIS data and records collected from the school over the course of any administrative investigation. The revised procedure also details the minimal communication requirements of CTCEU during the course of an investigation where full information sharing may not be possible. Revising the standard operating procedure governing coordination during investigations to more specifically detail what information SEVP, CTCEU, and ICE field offices should share during a criminal investigation has better positioned ICE to conduct criminal investigations without being compromised by administrative actions.
|
| United States Immigration and Customs Enforcement | To enhance ICE's ability to assess program risks, prevent and detect school certification fraud, and improve the controls over SEVP, the Assistant Secretary of Immigration and Customs Enforcement should establish criteria for referring cases of a potentially criminal nature from SEVP to CTCEU. |
In June 2012, we reported on U.S. Immigration and Customs Enforcement's (ICE) fraud prevention and detection procedures for the Student and Exchange Visitor Program (SEVP) (GAO-12-572). During the course of our review, we found that ICE's standard operating procedure governing coordination between SEVP, the Counterterrorism and Criminal Exploitation Unit (CTCEU), and ICE field offices directs SEVP to refer allegations or leads revealing possible criminal violations to CTCEU in a timely manner but did not include criteria for determining certain noncompliant activity becomes potentially criminal. SEVP officials stated that the program had not previously shared its compliance case log or other information regarding the program's compliance monitoring activities with CTCEU because the unit had never asked for such information. According to officials at all eight ICE field offices that we interviewed, referrals of schools that may exhibit criminal behavior within the offices' area of responsibility would prove useful in that agents could better target these potentially fraudulent schools for further review or investigation. Consequently, we recommended that the Assistant Secretary of ICE establish criteria for referring cases of potentially criminal nature from SEVP to CTCEU. In January 2013, SEVP and CTCEU approved the agency's changes to the standard operating procedures in accordance with our recommendation. Specifically, the revised procedures requires that SEVP share all administrative or noncompliance cases, including those that may be potentially criminal, with CTCEU on at least a monthly basis through email or monthly reoccurring coordination meetings. Establishing criteria for sharing all cases, including administrative or potentially criminal, with CTCEU has better positioned ICE to adhere to existing requirements of referring criminal cases to CTCEU for investigation.
|