Student and Exchange Visitor Program: DHS Can Take Additional Steps to Manage Fraud Risks Related to School Recertification and Program Oversight
Fast Facts
Are some U.S. schools fraudulently certifying that their foreign students are currently enrolled and attending classes?
We previously reported on fraud in the Student and Exchange Visitor Program such as "sham" schools that help students get visas to live in the U.S. without requiring that they attend classes. In some cases these "sham" schools have included major fraud schemes involving hundreds of students. This could damage the integrity of the program.
Though the Department of Homeland Security has improved program oversight, we now recommend that it further enhance controls over schools and school employees to help mitigate fraud.
Raid on a Fraudulent Student and Exchange Visitor Program School
Photo of a policeman entering an office with a sign on the door that says "Prodee University."
Highlights
What GAO Found
The Department of Homeland Security's (DHS) U.S. Immigration and Customs Enforcement (ICE) has identified several fraud risks to the Student and Exchange Visitor Program (SEVP). As shown in the figure below, these include risks associated with school owners and designated school officials (DSO) who help ICE oversee students in the program. These fraud risks may occur as schools apply to become SEVP-certified, accept foreign students, and apply for recertification every 2 years.
Key Areas of Potential Fraud in the Student and Exchange Visitor Program (SEVP)
ICE has implemented controls to address fraud risks related to school certification, but long-standing delays in recertifying these schools exacerbate fraud risks. By statute and regulation, ICE must conduct recertification reviews every 2 years to ensure that schools continue to meet program requirements—an important fraud risk control. Between 2013 and 2017, ICE recertified about 12,900 schools. However, according to ICE officials, they have been unable to meet the 2-year time frame and, as of June 2018, had 3,281 recertification petitions waiting for review. To help manage its queue, ICE has lengthened the period between recertification reviews by extending schools' certification expiration dates by 180 days, which is inconsistent with its regulation and may allow fraudulent schools to operate longer without detection. Although ICE is taking steps to increase resources for recertification, it is unclear whether these steps will ensure recertification is conducted consistently with ICE regulations.
ICE relies on DSOs to, among other things, update and maintain foreign-student data in ICE's foreign-student information system and report suspected fraud to ICE. However, ICE does not provide DSOs with training that addresses fraud risks to the program. In June 2018, ICE officials stated that they plan to develop this fraud training for DSOs, but do not have documented plans or timelines for when it would be completed. By developing these plans, the agency would be better positioned to ensure that DSOs receive the training needed to address potential fraud in the program.
Why GAO Did This Study
As of March 2018, more than 1.2 million foreign students in the United States were enrolled in 8,774 schools certified by SEVP. ICE is responsible for managing SEVP, which certifies schools to enroll foreign students. Various ICE offices have a role in preventing, detecting, and responding to potential fraud in the program. GAO was asked to review potential vulnerabilities to fraud in SEVP. GAO examined, among other things, the extent to which ICE (1) implemented controls to address fraud risks in the school certification and recertification processes and (2) implemented fraud risk controls related to DSO training.
GAO analyzed ICE policies and documentation, including fraud risk guidance and procedures for school certification and recertification; analyzed 2013 through 2017 recertification data; and interviewed officials from five ICE field offices that GAO selected based on their experience investigating program fraud. GAO also interviewed officials from 17 selected schools located near these ICE field offices. This is a public version of a sensitive report that GAO issued in November 2018. Information that DHS deemed sensitive has been omitted.
Recommendations
GAO is making seven recommendations, including that ICE (1) notify schools 180 days prior to the 2-year certification expiration date, as required, and evaluate whether additional resources for recertification are needed, and (2) develop a plan to implement fraud-specific training for DSOs. ICE concurred with all of GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| United States Immigration and Customs Enforcement | The Director of ICE should develop a fraud risk profile that aligns with leading practices and (1) identifies inherent fraud risks affecting the program, (2) assesses the likelihood and impact of inherent fraud risks, (3) determines fraud risk tolerance, and (4) examines the suitability of existing fraud controls and prioritizes residual fraud risks, including residual risks posed by the recertification queue. (Recommendation 1) |
The Department of Homeland Security (DHS) U.S. Immigration and Customs Enforcement (ICE) oversees foreign students and the schools they attend through the Student and Exchange Visitor Program (SEVP). In March 2019 we reported that ICE had taken steps to address fraud risks in the program, such as developing a Risk Assessment Model and Framework. However, we found that ICE did not have a fraud risk profile that fully aligns with leading practices in GAO's Fraud Risk Framework. In response, we recommended that ICE develop a fraud risk profile that aligns with leading practices and identified all of SEVP's fraud risks, discussed the likelihood of those risks, assessed related controls, and identified the agency's tolerance for risk. In May 2020, ICE completed a fraud risk profile to strengthen fraud risk management in SEVP. By developing, maintaining, and using its profile to inform fraud risk management activities, ICE will be better positioned to prioritize and respond to evolving fraud risks to SEVP.
|
| United States Immigration and Customs Enforcement | The Director of ICE should build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. (Recommendation 2) |
The Department of Homeland Security (DHS) U.S. Immigration and Customs Enforcement (ICE) oversees foreign students and the schools they attend through the Student and Exchange Visitor Program (SEVP). In March 2019 we reported that ICE had taken steps to address fraud risks in the program, such by exploring the use of better data analytics to help detect fraud. However, we found that ICE had not fully employed the use of data analytics, such as network analysis, to help it identify potentially fraudulent schools before they become certified to enroll foreign students and help it better use its administrative and investigative resources. In response we recommended that the Director of ICE build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. In May 2021, ICE provided documentation indicating that it had implemented a framework using an existing contract to request network analysis for schools or school officials that present a risk to the program. By strengthening oversight of schools and their officials, ICE will have better assurances of those participating in the program.
|
| United States Immigration and Customs Enforcement | As ICE works to complete its efforts to hire additional SEVP adjudicators, the Director of ICE should begin notifying certified schools 180 days prior to, and requiring submission of complete recertification petitions by, the 2-year certification expiration date, consistent with regulation, and evaluate whether additional resources are needed. (Recommendation 3) |
In April 2020, SEVP began taking steps to address our recommendation including hiring additional adjudicators. In September 2020, SEVP stated and provided documentation indicating that it had completed actions necessary to require submission of complete recertification petitions every 2 years. By addressing our recommendation, ICE will have better assurances that it is leveraging the recertification process effectively to identify and respond to potential fraud risks to the program, including those risks associated with allowing a fraudulent school to operate for a longer period.
|
| United States Immigration and Customs Enforcement | The Director of ICE should, as practicable, verify the eligibility information provided to establish the immigration or citizenship status of lawful permanent residents and naturalized U.S. citizens, as well as U.S.-born citizens, who have been nominated or renominated to serve as DSOs. (Recommendation 4) |
In August 2020, ICE stated that SEVP does not have a tenable way to verify birth certificates issued in the United States and territories. To address the recommendation, SEVP began providing select adjudicators with access to the U.S. Citizenship and Immigration Service's Person Centric Query System to check data provided regarding lawful permanent resident status for nominated or renominated DSOs. By conducting additional verification, SEVP will have additional assurances that only eligible and suitable DSOs are participating in the program.
|
| United States Immigration and Customs Enforcement | The Director of ICE should develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. (Recommendation 5) |
The Department of Homeland Security (DHS) U.S. Immigration and Customs Enforcement (ICE) oversees foreign students and the schools they attend through the Student and Exchange Visitor Program (SEVP). In March 2019 we reported that ICE had taken steps to address fraud risks in the program, such by exploring the use of better data analytics to help detect fraud. However, we found that ICE has not implemented comprehensive background checks on DSO nominees prior to approving them to carry out the DSOs' reporting, record-keeping, and other functions. In response, we recommended that the Director of ICE develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. In February 2021, ICE provided documentation indicating that it had executed and implemented a contract with an outside vendor to aid the execution, monitoring and control of DSO background checks. Additionally, ICE officials provided documentation that the information collected through these checks was reviewed during weekly reporting to aid adjudication decisions. By strengthening its background checks of DSOs, ICE will have better assurances that only suitable DSO's participate in the program.
|
| United States Immigration and Customs Enforcement | The Director of ICE should implement mandatory DSO training and verify that the training is completed. (Recommendation 6) |
In August 2024, ICE officials stated that a contract had been awarded to develop DSO training to meet GAO's recommendation. The officials stated that the training would be mandatory, and that compliance would be tracked. Documentation provided by ICE described the different planned training modules, which are expected to be made available in phases. These actions partially address our recommendation, and we will continue to monitor actions the agency has taken in response to this recommendation.
|
| United States Immigration and Customs Enforcement | The Director of ICE should complete the development and implementation of its plans for mandatory fraud-specific training for DSOs. (Recommendation 7) |
In August 2024, ICE officials stated that a contract had been awarded to develop fraud-specific DSO training to meet GAO's recommendation. Documentation provided by ICE described the different planned training modules, including fraud-specific components. The trainings are expected to be made available in phases. These actions partially address our recommendation, and we will continue to monitor actions the agency has taken in response to this recommendation.
|