Student and Exchange Visitor Program: DHS Needs to Assess Risks and Strengthen Oversight Functions

What GAO Found

U.S. Immigration and Customs Enforcement (ICE) has not developed a process to identify and analyze program risks since assuming responsibility for the Student and Exchange Visitor Program (SEVP) in 2003, in accordance with internal controls standards and risk management guidance. Within ICE, officials from SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU), which tracks, coordinates, and oversees school fraud investigations, have expressed concerns about the fraud risks posed by schools that do not comply with requirements. Investigators said that identifying and assessing risk factors, such as the type of school, are critical to addressing potential vulnerabilities posed across the more than 10,000 SEVP-certified schools. However, SEVP does not have processes to (1) evaluate prior and suspected cases of school noncompliance and fraud and (2) obtain and assess information from CTCEU and ICE field offices on school investigations and outreach events. For example, ICE reported that it has withdrawn at least 88 schools since 2003 for non-compliance; however, ICE has not evaluated schools’ withdrawals to determine potential trends from their noncompliant actions because case information is not well-organized, according to SEVP officials. Without a process to analyze risks, it will be difficult for ICE to provide reasonable assurance that it is addressing high-risk vulnerabilities and minimizing noncompliance.

ICE has not consistently implemented existing controls, in accordance with internal control standards and fraud prevention practices, to verify schools’ legitimacy and eligibility during initial SEVP certification and once schools begin accepting foreign students. Specifically, ICE officials do not consistently verify certain evidence initially submitted by schools in lieu of accreditation. In addition, ICE does not maintain records to document SEVP-certified schools’ ongoing compliance. GAO found that 30 of a randomly-selected sample of 48 SEVP-certified school case files lacked at least one piece of required evidence, such as proof of school officials’ citizenship or permanent residency. ICE was unable to produce 2 of the 50 case files. ICE officials noted that some files were missing because they were lost or destroyed when the Department of Homeland Security (DHS) took over the program from the former Immigration and Naturalization Service; moreover, ICE officials cannot quantify how many files are missing. Without verification of evidence and complete case files, ICE cannot provide reasonable assurance that schools were initially and continue to be eligible for certification. Further, ICE policies require that SEVP-certified flight schools offering flight training have specific Federal Aviation Administration (FAA) certifications; however, GAO found that approximately 167 of 434 (or 38 percent) SEVP-certified flight schools do not have the required certifications as of December 2011. The Border Security Act required recertification for all SEVP-certified schools by May 2004 and every 2 years thereafter to monitor schools’ continued program eligibility. SEVP officials stated that they rely on recertification to verify schools’ eligibility; however, SEVP began the first recertification cycle in May 2010 and, as of March 2012, has recertified 1,870 (or 19 percent) of certified schools. Implementing procedures to monitor state licensing and accreditation status for all types of schools and addressing flight schools that lack required FAA certification could better position ICE to reduce the risk of fraud and noncompliance.