Student and Exchange Visitor Program: DHS Can Take Additional Steps to Manage Fraud Risks Related to School Recertification and Program Oversight

As of March 2018, more than 1.2 million foreign students in the United States were enrolled in 8,774 schools certified by SEVP. ICE is responsible for managing SEVP, which certifies schools to enroll foreign students. Various ICE offices have a role in preventing, detecting, and responding to potential fraud in the program. GAO was asked to review potential vulnerabilities to fraud in SEVP. GAO examined, among other things, the extent to which ICE (1) implemented controls to address fraud risks in the school certification and recertification processes and (2) implemented fraud risk controls related to DSO training.

GAO analyzed ICE policies and documentation, including fraud risk guidance and procedures for school certification and recertification; analyzed 2013 through 2017 recertification data; and interviewed officials from five ICE field offices that GAO selected based on their experience investigating program fraud. GAO also interviewed officials from 17 selected schools located near these ICE field offices. This is a public version of a sensitive report that GAO issued in November 2018. Information that DHS deemed sensitive has been omitted.

The Department of Homeland Security's (DHS) U.S. Immigration and Customs Enforcement (ICE) has identified several fraud risks to the Student and Exchange Visitor Program (SEVP). As shown in the figure below, these include risks associated with school owners and designated school officials (DSO) who help ICE oversee students in the program. These fraud risks may occur as schools apply to become SEVP-certified, accept foreign students, and apply for recertification every 2 years.

ICE has implemented controls to address fraud risks related to school certification, but long-standing delays in recertifying these schools exacerbate fraud risks. By statute and regulation, ICE must conduct recertification reviews every 2 years to ensure that schools continue to meet program requirements—an important fraud risk control. Between 2013 and 2017, ICE recertified about 12,900 schools. However, according to ICE officials, they have been unable to meet the 2-year time frame and, as of June 2018, had 3,281 recertification petitions waiting for review. To help manage its queue, ICE has lengthened the period between recertification reviews by extending schools' certification expiration dates by 180 days, which is inconsistent with its regulation and may allow fraudulent schools to operate longer without detection. Although ICE is taking steps to increase resources for recertification, it is unclear whether these steps will ensure recertification is conducted consistently with ICE regulations.

ICE relies on DSOs to, among other things, update and maintain foreign-student data in ICE's foreign-student information system and report suspected fraud to ICE. However, ICE does not provide DSOs with training that addresses fraud risks to the program. In June 2018, ICE officials stated that they plan to develop this fraud training for DSOs, but do not have documented plans or timelines for when it would be completed. By developing these plans, the agency would be better positioned to ensure that DSOs receive the training needed to address potential fraud in the program.

GAO is making seven recommendations, including that ICE (1) notify schools 180 days prior to the 2-year certification expiration date, as required, and evaluate whether additional resources for recertification are needed, and (2) develop a plan to implement fraud-specific training for DSOs. ICE concurred with all of GAO's recommendations.

As of March 2018, more than 1.2 million foreign students in the United  States were enrolled in 8,744 schools approved to participate in the  Department of Homeland Security’s (DHS) Student and Exchange Visitor  Program (SEVP). DHS’s U.S. Immigration and Customs Enforcement  (ICE) is responsible for managing SEVP, which certifies schools  authorized to enroll foreign students in academic and vocational  programs, and oversees such schools and students. We previously  reported that foreign students bring needed skills to an increasingly  knowledge-based economy and make other valuable contributions to  society, but have also reported on fraud risks posed by SEVP-certified  schools and foreign students in the United States.

In our 2011 and 2012 reports on student visas, we identified instances in  which fraudulent schools exploited the U.S. immigration system by  knowingly reporting to SEVP that foreign students were fulfilling their  immigration status requirements, such as maintaining a full course load,  when they were not attending school or were attending intermittently. In  addition, we reported that terrorist attacks in the United States have  pointed to the need for close monitoring and oversight of foreign  students. For example, one of the September 11, 2001, terrorists  entered the country on a student visa and subsequently attended flight  schools. We also found that ICE had not developed a process to identify  and analyze program risks. Further, we found that ICE did not  consistently implement internal controls to verify schools’ legitimacy and  eligibility, such as independently verifying state licensure and  accreditation documentation, during initial SEVP certification and once  schools begin accepting foreign students. In our 2012 report, we  recommended that ICE take actions to improve the identification and  assessment of risks in SEVP and to consistently implement procedures  for ensuring schools meet the criteria for SEVP certification, among other  things. ICE concurred with the recommendations and, in response, took  action to address them, such as by developing and institutionalizing a  risk-management process and improving controls over the program.  Appendix I presents additional details on the recommendations in our  2012 report and actions taken by ICE to address those recommendations.

SEVP and the Counterterrorism and Criminal Exploitation Unit (CTCEU),  within ICE, have a role in preventing, detecting, and responding to  potential fraud in SEVP. Regarding certified schools, SEVP develops  and implements controls to monitor school compliance with the program,  including controls designed to prevent and detect potential fraud; provides  support to the schools; and conducts reviews to assess schools’  continued eligibility to enroll foreign students. In addition, SEVP is  responsible for the oversight of foreign students while they are in the  United States to ensure that they comply with the terms of their admission  into the country. SEVP does so, in part, by approving individuals  nominated by their employing schools to serve as Designated School  Officials (DSO). DSOs are responsible for entering and maintaining  students’ complete information in a timely manner, such as by entering  information on courses of study and attendance in ICE’s Student and  Exchange Visitor Information System (SEVIS). In addition, CTCEU is  responsible for, among other things, combating the criminal exploitation of  the foreign-student visa system, including through coordination with  SEVP. In this role, CTCEU tracks, coordinates, and oversees criminal  investigations in response to potential cases of fraud in the program.

You asked us to review potential vulnerabilities to fraud in SEVP. This  report examines efforts that ICE has taken since our 2012 report to  address fraud risks. Specifically, we examine the extent to which ICE has  taken steps to strengthen its management of fraud risks in SEVP,  implemented controls to address fraud risks in the school certification  and recertification processes, and  implemented fraud risk controls related to the eligibility, suitability, and  training of DSOs.

This report is a public version of a sensitive report that we issued on  November 20, 2018, which included sensitive information related to SEVP  internal controls used to help prevent and identify noncompliance or fraud  in the program. The sensitive report also discussed some planned  actions to improve these internal controls, some of which DHS deemed to  be sensitive and must be protected from public disclosure. This public  report omits the information that DHS deemed to be sensitive including  some details associated with (1) the oversight of schools during the  certification and recertification process, (2) our covert testing of SEVP  certification internal controls, and (3) current and planned actions to  oversee DSOs. Although the information provided in this report is more  limited, it addresses the same objectives and uses the same methodology  as the sensitive report.

To evaluate the extent to which ICE has taken steps to strengthen its  management of fraud risks, we analyzed documentation ICE officials  provided regarding risks, vulnerabilities, and past cases of SEVP-related  fraud. We reviewed documentation such as ICE’s Risk Assessment  Model and Framework and information on schools that ICE has identified  as potentially noncompliant or fraudulent. We compared ICE’s fraud risk  management practices to GAO’s A Framework for Managing Fraud Risks  in Federal Programs (Fraud Risk Framework), which provides a  comprehensive set of key components and leading practices that serve  as a guide for agency managers to use when developing efforts to  combat fraud in a strategic, risk-based way. We also used agency data  on certified schools as of September 2017 to conduct a “network  analysis”—a quantitative approach to identifying and graphically  representing potentially unknown relationships among individuals or  organizations—to determine whether ICE could use this technique to help  identify connections between potentially fraudulent actors in the program.  To further validate this information, we conducted additional research  using investigative databases and public information to try to verify the  instances identified in our analysis.

To evaluate the extent to which ICE has implemented controls to address  fraud risk in the school certification and recertification processes, we  reviewed documentation describing ICE’s certification and recertification  controls and analyzed ICE-provided recertification data. Specifically, we  assessed ICE’s standard operating procedures, adjudicator guidance,  training materials, and other guidance to determine whether the  certification and recertification controls described in these documents  addressed the high-risk indicators ICE has identified. We also compared  ICE’s controls in these areas to GAO’s Standards for Internal Control in  the Federal Government (Federal Internal Control Standards) related to  risk management, as well as principles of the Fraud Risk Framework.

We also conducted covert testing of SEVP’s internal control activities  related to the school certification process. Specifically, we submitted  certification petitions and conducted other covert investigative work for  three fictitious schools and petitioned to obtain SEVP certification. For the  first school, among other things, we submitted incomplete documentation  to SEVP. For the second school, among other things, we submitted  complete documentation, but we did not schedule a site visit as directed  by SEVP. Site visits are visits to the petitioning school by SEVP staff to,  among other things, interview school officials and review the facilities. For  our third school, among other things, we completed the petition for  certification and submitted it to SEVP, and participated in a site visit with  SEVP officials using a rented space as a fictitious school location. For all  three petitions, we used publicly available information to construct our  scenarios. We also used publicly available hardware, software, and  materials to produce counterfeit or fictitious documents, which we  submitted, as appropriate for our testing. We then documented any  actions taken by SEVP on the submitted petitions, such as requests to  provide additional supporting documentation, among other potential  actions. Results for all three covert tests, while illustrative, cannot be  generalized to the full population of petitioners.

To determine the extent to which ICE has implemented fraud risk controls  related to the eligibility, suitability, and training of DSOs, we analyzed  documentation on DSO eligibility, current and planned DSO background  checks, and DSO roles and requirements, including training. We  assessed the implementation of these controls against criteria in Federal  Internal Control Standards and the Fraud Risk Framework. Also, we  reviewed documentation on the current and planned DSO background  checks, including existing procedures for DSO vetting and initial  requirements and a draft policy for future enhancements to such checks.  We compared these documents to leading practices for project planning  in the Project Management Institute’s A Guide to the Project Management  Body of Knowledge. We also compared these documents to our  Schedule Assessment Guide.

In addition, to address each objective, we interviewed officials from  SEVP’s Risk Management Support, School Certification, Policy, Analysis  and Operations Center, and Field Representative Units to discuss their  involvement in addressing fraud risk. We also interviewed ICE’s  Homeland Security Investigations Special Agents (ICE agents) from  headquarters and 5 of ICE’s 26 field offices, a process that allowed us to  obtain their perspectives on fraud risks in the program. We selected  these offices based on their experience in investigating previous cases of  school or student-related fraud, among other considerations. In addition,  we interviewed eight SEVP field representatives whose areas of  responsibility include California, New Jersey, and New York to gather  information on representatives’ roles and activities identifying and  reporting potential school and student-related fraud or noncompliance.  We selected these representatives based on their proximity to the ICE  field offices we visited.

As part of our site visits, we also interviewed DSOs at 17 SEVP-certified  schools on their roles, responsibilities, and training. We selected these  officials because, as of September 2017, they represented a group of  officials from SEVP-certified schools of various types and sizes and were  located in proximity to our selected ICE field-office locations. As we did  not select a probability sample of ICE field offices, field representatives,  or DSOs to interview, the information from these individuals cannot be  generalized but provided us with useful insights into previous cases of  known or suspected fraud or noncompliance and the role of both the field  representatives and the DSOs. Appendix II presents more detail about  our scope and methodology.

The performance audit upon which this report is based was conducted  from May 2017 to November 2018 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. This  report is also based on related investigative work conducted from  September 2017 to September 2018 in accordance with standards  prescribed by the Council of the Inspectors General on Integrity and  Efficiency.

Student Visa and School Certification Process

Foreign students interested in studying in the United States must first be  admitted to an SEVP-certified school or university before applying for a  nonimmigrant visa at a U.S. embassy or consulate overseas to authorize  travel to the United States. A visa holder must present himself or herself  for inspection at a U.S. port of entry by an officer with DHS’s U.S.  Customs and Border Protection to determine admissibility.  Nonimmigrants, including foreign students, are permitted to enter the  United States for an authorized period of stay.

Schools seeking to enroll foreign students on F and M visas must pay an  application fee and petition for SEVP certification by submitting an  electronic certification petition and supporting documentation to ICE through SEVIS. Among other things, SEVIS assists ICE in tracking and  providing oversight of foreign students—while they are approved to study  in SEVP-certified U.S. educational institutions—and their accompanying  dependents. Figure 1 outlines the steps required for schools seeking to  obtain and maintain SEVP certification and the process for foreign  nationals to pursue a course of study in the United States.

More specifically, during the initial certification process, a school must  provide ICE, specifically SEVP’s School Certification Unit (Certification  Unit), with evidence of the school’s legitimacy (or bona fides) and  eligibility. Such evidence includes the following: proof of any requisite licensure or approval by an appropriate state- level licensing or approving agency; proof of accreditation by an accrediting agency recognized by the  Department of Education, if accreditation is required or otherwise  claimed;

DSO’s attestation statement that he or she is familiar, and intends to  comply, with program rules and regulations for admission under, and  maintenance and change of, nonimmigrant student status; and  confirmation by the school that it is eligible for certification, among  other things (willful misstatements in a school certification petition may  constitute perjury); and

DSOs’ proof of U.S. citizenship or lawful permanent residency.

In addition, petitioning schools must generally submit a school catalog or  written statement including certain information with respect to the  qualifications of teaching staff, and attendance and grading policies,  among other things. However, the requirement for a school catalog or  written statement is not applicable to a public school or school system, a  school accredited by a Department of Education–recognized accrediting  agency, or a secondary school operated by or as part of such an  accredited school. Moreover, an institution of higher education that is  not a public educational institution or system, or not accredited by a  recognized accrediting body, must provide evidence “in lieu of” meeting  those criteria. Such evidence must show either that the school of higher  learning confers recognized degrees upon its graduates or its credits  have been and are unconditionally accepted by at least three public or  accredited institutions of higher education.

Schools nominate individuals to serve as DSOs, who act as liaisons  between foreign students, the DSOs’ employing school, and federal  government agencies. DSOs support school compliance with record- keeping, reporting, and other requirements, and provide  recommendations to foreign students regarding the maintenance of their  immigration status. In addition to entering and maintaining complete  information on students in SEVIS in a timely manner, DSOs are  responsible for using SEVIS to submit their school’s certification petition  and update the information, as necessary. To demonstrate eligibility,  DSOs must, among other things, provide to ICE statements certifying  their familiarity and intent to comply with the program rules and  regulations relating to the requirements for nonimmigrant students’  admission, maintenance of status, and change of status, and  requirements for school approval. ICE’s regulations provide that willful  misstatements in certification and recertification submissions may  constitute perjury.

Once ICE has received a complete petition from a school seeking SEVP  certification, staff from SEVP’s Field Representative Unit are to conduct a  site visit to the school, including each instructional site foreign students  will attend, to interview school officials and review the facilities. After  receiving all necessary evidence and a site-visit report from the field  representatives, ICE staff in the Certification Unit analyze the  documentation, determine the school’s eligibility, and certify those  schools that they determine meet all of the program’s requirements.

Further, DHS is required to conduct a review, every 2 years, of certified  schools’ continued eligibility and compliance with the program’s  requirements. To be eligible for recertification, an SEVP-certified school  must demonstrate at the time of filing that it remains eligible for  certification and has complied during its previous period of certification or  recertification with record-keeping, retention, reporting, and other program  requirements. During the recertification process, the Certification Unit  requires schools to submit the same type of evidence that was required  for certification, including, among other things, proof of state licensing and  accreditation and DSO attestation statements and citizenship  documentation. The Certification Unit also evaluates how the school has  ensured that its foreign-student records are accurate and in compliance with statutory record-keeping requirements. However, site visits are not  required for recertification.

The Enhanced Border Security and Visa Entry Reform Act of 2002 states  that a material failure of an SEVP-certified school to comply with the  record-keeping and reporting requirements to receive foreign students  shall result in the suspension for at least 1 year, or termination, of the  school’s approval to receive such students. SEVP’s Analysis and  Operations Center (Compliance Unit) conducts ongoing monitoring of  SEVP-certified schools for compliance with these regulatory record- keeping and reporting requirements, as well as schools’ continued  eligibility for certification. Under federal regulation, SEVP can deny an  SEVP-certified school’s recertification petition or, subsequent to out-of- cycle review, withdraw certification if the school or its programs are no  longer eligible for certification. Denial of recertification or withdrawal on  notice as a result of out-of-cycle review may be for any valid and  substantive reason, including failure to comply with record-keeping and  reporting requirements, willful issuance by a DSO of a false statement, or  not operating as a bona fide institution of learning, among other bases.

Fraud Risk-Management Leading Practices and Requirements

According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Federal internal control standards  call for agency management officials to assess the internal and external  risks their entities face as they seek to achieve their objectives. The  standards state that, as part of this overall assessment, management  should consider the potential for fraud when identifying, analyzing, and  responding to risks. Risk management is a formal and disciplined  practice for addressing risk and reducing it to an acceptable level. In  July 2015, we issued the Fraud Risk Framework, which provides a  comprehensive set of key components and leading practices that serve  as a guide for agency managers to use when developing efforts to  combat fraud in a strategic, risk-based way. The Fraud Risk Framework  describes leading practices in four components: commit, assess, design  and implement, and evaluate and adapt, as depicted in figure 2.

The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires the Office of Management and Budget (OMB), in  consultation with the Comptroller General of the United States, to  establish guidelines for federal agencies to create controls to identify and  assess fraud risks and design and implement antifraud control activities.  The act further requires OMB to incorporate the leading practices from  the Fraud Risk Framework in the guidelines. In July 2016, OMB published  guidance about enterprise risk management and internal controls in  federal executive departments and agencies. Among other things, this  guidance affirms that managers should adhere to the leading practices  identified in the Fraud Risk Framework. Further, the act requires federal  agencies to submit to Congress a progress report each year for 3  consecutive years on the implementation of the controls established  under OMB guidelines, among other things.

ICE Has Strengthened Fraud Risk Management for SEVP but Has Not Fully Developed a Fraud Risk Profile or Employed Certain Data Tools That Can Help Guide Its Efforts

ICE Has Taken Steps to Enhance Fraud Risk Management

ICE developed a risk-assessment framework and other tools to assist in  its efforts to manage fraud risks to SEVP. For example, in 2014, ICE  began developing an SEVP Risk Assessment Model and Framework,  which provides an overview of how SEVP identifies, assesses, responds  to, and reports on identified internal and external risks to the program.  Specifically, SEVP’s Risk Assessment Model and Framework—which  was updated several times between 2014 and 2017—discusses  categories of fraud risks to the program, including fraud associated with  schools, DSOs, and students. Moreover, in 2014, ICE developed a Risk  Assessment Tool for SEVP that uses data from SEVIS records to identify  potential fraud and other noncompliance issues among certified schools.  The tool prioritizes different risk indicators—such as the proportion of the  school that consists of foreign students—and ranks schools by risk level.  SEVP officials stated that schools identified as high risk receive additional  administrative review by the Compliance Unit. According to SEVP officials  and documentation we reviewed, ICE has continued to update and refine  the tool since 2014 to improve its effectiveness in helping to identify  program risks, including fraud risks.

Through these and its oversight efforts, ICE has identified various fraud  risks in SEVP; such risks may take various forms, including immigration  benefit fraud, which involves the willful or knowing misrepresentation of  material facts for the purpose of obtaining an immigration benefit, such as  a nonimmigrant student status, without lawful entitlement. According to  ICE documentation we reviewed and officials we spoke to, the fraud risks  to the program generally fall into four broad categories: schools, students,  DSOs, and third-party brokers, who are individuals engaged in the fee- or  commission-based recruitment of foreign students, among other activities.  Figure 3 illustrates the types of fraud that may occur in these four  categories during different stages of a certified school’s involvement in  the program, as we identified in ICE documentation and through our  interviews with ICE officials.

For specific examples of fraud risks that ICE has identified in SEVP, see  figure 4.

ICE has also taken steps since 2012 to strengthen its fraud risk- management efforts in response to our prior recommendations. For  example, in our 2012 report on SEVP risks, we found that, among other  things, ICE did not have a process to assess risks in SEVP and did not  consistently implement existing internal controls for determining school  eligibility. To address this and other findings, we made eight  recommendations to enhance ICE’s ability to assess program risks,  prevent and detect school certification fraud, and improve the controls  over SEVP. ICE took action that addressed these eight recommendations  and has developed various tools designed to strengthen its fraud risk- management efforts (see app. I).

Further, ICE has taken steps to improve collaboration and coordination to  enhance fraud risk management between SEVP and CTCEU, the unit  within ICE responsible for managing criminal investigations. More  specifically, ICE has embedded agents within SEVP’s Compliance Unit,  and these agents help provide law-enforcement expertise within the unit  and act as liaisons with ICE agents located in the field to provide  information and support ongoing criminal investigations. According to a  senior ICE official with CTCEU, the embedded agents have helped  streamline processes and provide expertise to aid administrative and  investigative efforts. Figure 5 shows the process for coordination between  CTCEU and SEVP.

Further, ICE officials with CTCEU stated they have acquired specialized  software tools to manage fraud tips and to conduct open-source and  related research on certified schools suspected of acting fraudulently. To  help identify and prioritize leads, ICE officials stated that they use a  software tool to efficiently help review and prioritize tips received through  ICE’s tip line, which gathers tips from the general public on suspicious or  potential criminal activity. To aid investigations of schools, ICE explored  the use of another specialized software to aid the review of online social  media associated with schools or individuals, among other things.

In addition, changes to SEVIS have aided ICE’s efforts to manage fraud  risks in the program. In 2008, ICE initiated an effort to modernize SEVIS  to address identified system vulnerabilities, such as the inability to  capture detailed school data that would allow the detection of patterns  and anomalies that could indicate fraud. Although SEVIS modernization is  not yet complete, changes made in the system have helped to improve  system usability and the ability to identify suspected fraud in the program,  according to program officials. For example, system edit checks  implemented in 2015 and 2016 to verify user-entered names and  addresses have enhanced data quality by helping to identify and prevent  likely data-entry errors. SEVP officials also stated that improved data  quality can help make it easier to distinguish potential fraud from  unintentional data-entry errors. ICE officials we spoke to and related  documentation we reviewed stated that SEVIS modernization efforts may  include additional functionality, such as the ability to create person-centric  records for each student.

ICE Does Not Have Some Components of a Fraud Risk Profile Needed to Fully Assess and Manage Fraud Risks

Although ICE has developed a Risk Assessment Model and Framework  and taken other action to improve fraud risk management in SEVP, ICE  has not fully developed and implemented a “fraud risk profile” that would  help guide its efforts. According to our Fraud Risk Framework, an  effective antifraud entity tailors the approach for carrying out fraud risk  assessments to its programs. This approach allows an agency to,  among other things, develop a fraud risk profile that  identifies the inherent fraud risks affecting the program, assesses the likelihood and effect of each type of fraud risk that the determines the agency’s tolerance for certain types or levels of fraud  risks in the program, examines the suitability of existing controls for each fraud risk, and documents the program’s fraud risk profile.

Effective managers of fraud risks use this profile to help decide how to  allocate resources to respond to fraud risks. Further, Federal Internal  Control Standards require managers to respond to identified risks.  Appendix III provides additional information on the key elements in the  fraud risk-assessment process including the development of a fraud risk  profile.

Our assessment of SEVP’s Risk Assessment Model and Framework  found that while it describes the program’s approach for managing fraud  risks, it does not include all of the key elements of a fraud risk profile:

First, SEVP’s Risk Assessment Model and Framework identifies three  broad categories of inherent fraud risks that affect the program (those  posed by schools, DSOs, and students), but does not include all risks  that the program or its stakeholders have identified, such as the risk of  third-party brokers. As noted previously, ICE agents and program  officials identified brokers as a risk to the program because brokers  have helped facilitate school and student fraud and misused or stolen  student funds in the past. However, according to ICE officials with  SEVP, SEVP’s Risk Assessment Model and Framework was not  designed to define all of the risks posed to SEVP.

Second, while SEVP’s Risk Assessment Model and Framework  assesses the potential effect of its risk posed by students, schools,  and DSOs, it does not discuss the likelihood of the risk’s occurrence.  For example, the Risk Assessment Model and Framework contains a  narrative outlining the potential negative consequences of each of the  three broad risk categories but does not address the likelihood of  those risks occurring. According to SEVP officials, SEVP’s Risk  Register helps identify and determine the likelihood of identified  program risks. However, our review of the Risk Register found that it  is used to track program-wide risks and does not identify or discuss  specific fraud risks. Further, these officials stated that many of the  components in a fraud risk profile are included in SEVP’s Risk  Assessment Tool, but this tool was developed to prioritize the review  of SEVP-certified schools that have potential compliance issues and  was not designed to address all SEVP fraud risks such as the risks  posed by students or brokers. Using information on the likelihood of  risk occurrence can help managers decide how to allocate resources.  For example, managers can use this information to make decisions to  allocate resources to addressing fraud risks that are most likely to  occur or have relatively high impact.

Third, SEVP’s Risk Assessment Model and Framework does not  assess the agency’s tolerance for all fraud risks to the program. For  example, while SEVP officials stated that students represent a  significant risk to the program, they have not fully assessed the extent  of risks associated with student fraud or the agencies’ tolerance for it.  In October 2017, the SEVP Director stated that SEVP was just  beginning to get a better understanding of student risks, but had not  done an assessment of their likelihood and tolerance. However, SEVP  officials acknowledged the importance of fully assessing student risks  because of the challenges that can be associated with detecting,  preventing, and responding to student fraud.

Fourth, SEVP’s Risk Assessment Model and Framework does not  examine the suitability of existing fraud controls or prioritize all  residual risks that remain after inherent risks have been mitigated by  existing control activities. We found that, while the Risk Assessment  Model and Framework discusses different internal controls and tools  used to prioritize and address risks in the school certification and  recertification process, such as the Risk Assessment Tool, it does not  explicitly identify any internal controls or tools used to prioritize or  address student risks. In addition, the Risk Assessment Model and  Framework does not identify and prioritize residual fraud risks that  ICE has flagged as being vulnerabilities to the program. According to  ICE agents in four field offices and officials in the Compliance Unit,  limitations to SEVP’s ability to prevent some schools that present  fraud risks from obtaining certification or continuing to participate in  the program after fraud risks have been identified represent residual  risks to the program. For example, officials in the Compliance Unit  stated that certified schools that have been accredited through an  accrediting body recognized by the Department of Education  generally represent a lower fraud risk, but ICE has still experienced  noncompliance and cases of fraud with these schools. At one point  several fraud cases were tied to the same accrediting body. In  another example of a potential residual risk to the program, ICE field  agents stated that potentially fraudulent schools may continue to  operate during criminal investigations, which can take several years to  investigate and prosecute. During the investigation, schools may  remain in operation and continue to enroll foreign students, provided  their certification is not withdrawn through other administrative  actions. As one example, ICE’s investigation into Prodee  University—a case that involved hundreds of students—began in  2011, but warrants were not issued until 2015. The school continued  to operate and accept foreign students during the 4-year investigation,  creating residual risk to the program during these years.

According to SEVP’s Director, the program has not developed a fraud risk  profile that fully addresses all identified risks because the program has  not yet developed the maturity needed to manage its risks in this way, but  she noted that doing so could be a good next step in the process. Without  a fraud risk profile consistent with leading practices—which identifies all fraud risks, discusses the likelihood of those risks, assesses the agency’s  risk tolerance, and determines the suitability of related controls—ICE  cannot ensure it has taken all necessary actions to address SEVP risks.

ICE Is Exploring the Use of Data Analytics to Aid Fraud Detection in SEVP

ICE is exploring the use of better data analytics to help detect fraud in  SEVP but has not yet employed techniques, like network analysis, to help  detect and prevent fraud prior to certification. ICE officials with SEVP  stated that they are exploring the use of additional data-analytics tools to  help mitigate fraud in the program, including tools that can perform  network analysis. However, these efforts are in their early stages and  have been limited to conversations between program staff. While  previously noted efforts to improve SEVIS may also include additional  data analytics to mitigate fraud, these efforts have remained underway  since 2008. Agency officials told us they recognize that better analytic  tools can help them detect and prevent fraud in the certification process  and are seeking additional resources to support this effort. According to  agency documentation, SEVP awarded a contract in September 2018 to  help establish a data-governance framework within SEVP. Among other  things, the contract will examine the tools, skill sets, and number of  people needed to support the data-related needs for SEVP, to include  operational data and analytics. According to agency officials, SEVP plans  to award a contract in the first quarter of fiscal year 2019 to provide better  data-analytics support.

Data-analytics approaches, such as network analysis, have the potential  to enable ICE to identify high-risk schools prior to initial certification, thus  allowing SEVP to apply increased oversight, as needed, during the  adjudication process. Network analysis involves a quantitative approach  for analyzing, summarizing, and graphically representing complex  patterns of relationships among individuals or organizations. Such a  technique is useful for identifying associations, such as between schools  with current or past administrative and criminal concerns and those  schools seeking certification. Information about the connections and  relationships among schools—developed through network analysis—may  then provide leads in reviews and investigations in the certification and  recertification processes, which are important controls for preventing  fraudulent schools from entering and remaining in the SEVP program.  ICE field agents with two of five field offices we visited stated that it can  be challenging to identify fraudulent schools as compared to legitimate  ones during the initial certification of schools. For example, agents  familiar with one investigation stated that after ICE began investigating a  school for suspected fraud, the owner tried to establish another school,  which was only identified because of a lead provided through interviews  conducted during the investigation. Further, because tools such as the  Risk Assessment Tool use data analytics, but rely on information  collected from current SEVP-certified schools, it can be difficult to identify  schools with fraud concerns before they are certified to participate in the  program.

Using a network approach in our analysis of 2,439 SEVP-certified  schools, we identified 11 connections that could raise fraud concerns.  Specifically, we conducted a network analysis utilizing both public and  proprietary information associated with certified schools as of September  2017. We obtained basic information on these schools from ICE, such as  school names and addresses. We also used public records associated  with these schools related to businesses and people, such as past and  current executives. Using this information and freely available public  software, we identified relationships among certified schools that ICE had  previously identified as having potential compliance or fraud concerns  and other certified schools that did not have such concerns. For example,  in 11 connections, we identified instances in which an executive appeared  to have been employed by a school under active criminal investigation or  administrative review who was either previously or later employed by a  different school not under investigation or review. Moreover, for 2 of the  11 connections, we found additional derogatory information associated  with executives tied to SEVP-certified schools that could raise fraud  concerns. For instance, one executive had employment terminated from a  previous school and was under investigation for misappropriating school  funds for personal use. While these connections do not prove fraud or  noncompliance, they do provide information about potential risks, which  can inform the prioritization of administrative and investigative resources  during certification.

ICE currently has limited ability to identify associations among schools  with potential fraud concerns before they are certified to participate in the  program. According to our Fraud Risk Framework, federal managers  should design and implement specific control activities to prevent and  detect fraud. These control activities can include data analytics, among  other things, and should emphasize fraud prevention to the extent  possible. A network approach provides the capability to better prevent  and detect fraud by identifying potentially fraudulent schools before they  are certified by SEVP and by detecting associations that pose a fraud risk  among those already certified.

ICE Has Processes for School Certification and Ongoing Compliance Monitoring, but Long- Standing Delays in Recertifying Schools Pose Fraud Risks

ICE has processes in place for school certification, recertification, and  ongoing compliance monitoring, and has taken steps to improve school  certification controls since our 2012 report. We also found that ICE  followed its established procedures and specifically identified GAO’s  fraudulent petitions or otherwise took appropriate steps to prevent the  petitions from moving forward in the process during our three  independent covert tests of SEVP internal controls over the school  certification process. However, the agency continues to face long- standing delays in conducting recertification reviews every 2 years to  ensure that SEVP-certified schools continue to meet program  requirements—one of its important fraud risk controls. As a result of these  delays, ICE has a queue of recertification petitions awaiting adjudication,  which creates additional fraud risks to the program if higher-risk schools  continue to operate pending recertification. However, the agency has not  assessed the magnitude of these risks.

ICE Assesses Schools’ Initial and Continued Eligibility to Enroll Foreign Students through the Certification and Recertification Processes and Ongoing Compliance Monitoring

ICE’s certification and recertification processes are designed to assess  schools’ initial and continued eligibility to enroll foreign students and, as  previously discussed, once a school is certified, ICE is to monitor its  continued program eligibility. SEVP-certified schools are to undergo  recertification reviews every 2 years (see fig. 6).

Initial certification: As previously discussed, to be eligible for SEVP  certification, a petitioning school must establish at the time of filing that it  is a bona fide institution of learning or other recognized place of study that  possesses the necessary facilities, personnel, and finances to conduct,  and is in fact engaged in, instruction in recognized courses. SEVP  officials stated that they address potential fraud risks during the initial  certification process by verifying the schools’ information and  documentation through web-based research and a site visit to interview  the school’s DSO and observe the school’s facilities. According to SEVP  officials and guidance, as of October 2016, field representatives are  responsible for conducting and documenting site visits for certifications.  When conducting the visits, field representatives are to gather evidence  on school eligibility for certification, review the facilities, and interview  personnel nominated on the petition to become DSOs. They may also  report back any anomalies or areas of concerns they may notice for  further vetting by the compliance unit. SEVP received approximately  2,000 certification petitions from fiscal years 2013 through 2017. See  figure 7 for details on the number of approved and denied petitions during  this period.

ICE has implemented several controls to address fraud risks in the school  certification process since our 2012 report on SEVP program risks, but  long-standing delays in the recertification process create additional fraud  risks. In particular, ICE strengthened its processes for verifying and  monitoring schools’ accreditation and states’ licensing statuses. For  example, since December 2012, SEVP adjudicators are to verify all “in  lieu of” letters during the school’s initial-certification and recertification  processes. In May 2015, SEVP developed a continuous process for  verifying schools’ state licensing and accreditation status and updated its  Adjudicator’s Manual with specific actions adjudicators must take to  consistently verify evidence provided by schools, including “in lieu of”  letters and states’ licensing documentation. In addition, SEVP took steps  to ensure that all flight schools had the appropriate Federal Aviation  Administration certification.

Recertification: To be eligible for recertification, an SEVP-certified  school must demonstrate at the time of filing that it remains eligible for  certification and has complied during its previous period of certification or  recertification with record-keeping, retention, reporting, and other program  requirements. SEVP received approximately 14,000 recertification  petitions from fiscal years 2013 through 2017. See figure 8 for details on  the number of approved and denied petitions during this period.

The recertification process is an important fraud risk control, according to  ICE officials, since they may determine that some certified schools are  potentially noncompliant during the recertification process. For example,  SEVP denied 105 recertification petitions from fiscal year 2013 through  fiscal year 2017. On the basis of our review of recertification denial data,  the majority of denials were due to the school’s abandoning its petition for  recertification by not responding to SEVP’s request for further  information. Appendix IV provides additional details on the withdrawal  and denial of certification and recertification petitions as outlined in  federal statute and regulation. For the remaining schools, SEVP issued a  formal recertification denial notice for a variety of reasons, including those  that highlight fraud risks in the program, such as  improper issuance of Forms I-20, including the issuance of forms to  foreign students who will not be enrolled in or carry a full course of  study;

DSO conduct did not comply with program regulations; willful issuance by a DSO of a false statement;  failure to timely report school or course of study information, including  material changes; and  failure to maintain the accreditation or licensing necessary to qualify  graduates as represented in the school’s Form I-17.

Ongoing compliance monitoring: The Enhanced Border Security and  Visa Entry Reform Act of 2002 provides that SEVP-certified schools are  to comply with record-keeping and reporting requirements to enroll  nonimmigrant students. Between schools’ initial certifications and their  subsequent recertification reviews, ICE uses a variety of mechanisms to  monitor ongoing compliance with program requirements and mitigate  fraud risks. For example:

SEVP deployed its first group of field representatives in 2014. As of  June 2018, ICE had 57 field representatives across 60 different  geographic areas of responsibility nationwide. According to SEVP  guidance, field representatives are to act as direct liaisons between  SEVP and certified schools and are to try to meet with all certified  schools in their territory at least once per year if the school has foreign  students enrolled, or once every 2 years if no foreign students are  enrolled. According to SEVP officials, the field representatives are to  have a customer-service focus and assist DSOs in adhering to  program requirements and, as a result, do not have law-enforcement  or investigative responsibilities. However, if field representatives learn  of potential fraud while visiting a school, they are to document and  send this information to SEVP headquarters. All of the eight field  representatives we interviewed reported that they primarily have a  customer-service role but have also identified and reported suspected  fraud to SEVP headquarters. For instance, one representative stated  that she reported a language school because its stated level of  student enrollment did not appear to correspond with the number of  students in class during her visits to the school.

SEVP adjudicators are to verify and adjudicate changes that occur at  an SEVP-certified school that require an update to the school’s Form  I-17 petition information in SEVIS. These changes include the  school’s name, location, or new areas of study offered, among  others. According to Certification Unit officials, adjudicators review  information from both SEVP’s risk tools and field-representative  school-visit reports when adjudicating updates to identify any  indications of noncompliance or fraud that need to be further reviewed  and researched by the Compliance Unit.

Compliance Unit staff are to vet tips provided by external parties (such  as DSOs from other schools) or internal stakeholders (such as field  representatives or Certification Unit adjudicators) to determine  whether they indicate the need to open an administrative or criminal  investigation on the school. Compliance Unit staff may also identify  schools for additional monitoring. The Compliance Unit is also  responsible for extracting and analyzing data from SEVIS on an  ongoing basis, including data related to certified schools and foreign  students suspected of noncompliance and fraud, among other things.  According to ICE officials, staff are responsible for researching  schools with high-risk scores provided by the Risk Assessment Tool.

ICE may conduct an out-of-cycle review of a school at any time to  help determine whether the school is complying with its reporting and  record-keeping requirements and to ensure the school’s continued  eligibility for SEVP certification. ICE may initiate an out-of-cycle  review as a result of receiving information regarding potential  noncompliance or fraud. The out-of-cycle review process may include  a review of student records, a request for the submission of  documentation to verify accreditation, a request for proof of state  licensure, or a request for any other required evidence that  establishes a school’s continued eligibility for SEVP certification. ICE  officials stated that they may, pending the result of this review, issue a  remedial action plan to the school describing the areas of  noncompliance, such as correcting student records, that the school is  required to address to maintain its program eligibility. If, upon  completion of an out-of-cycle review, SEVP determines that a certified  school has failed to sustain eligibility or has failed to comply with the  record-keeping, retention, reporting, and other requirements, SEVP  will institute withdrawal proceedings by serving the school a notice of  intent to withdraw SEVP certification. At the conclusion of  withdrawal proceedings, a school found to be ineligible for continued  SEVP certification as a result of an out-of-cycle review will receive a  notice of withdrawal (see app. IV for additional information on the  withdrawal process).

ICE Followed Its Procedures during Three GAO Covert Tests of ICE’s School Certification Controls

ICE followed established procedures during our three covert tests of the  internal controls over the SEVP school certification process by either  successfully identifying GAO’s fraudulent petitions or by taking  appropriate steps to prevent the petitions from moving forward in the  process. Therefore, we did not identify any significant deficiencies during  our testing of these controls. We submitted certification petitions and  conducted other covert investigative work for three fictitious schools, all of  which have differing certification requirements. Using these schools, GAO  agents applied for SEVP certification.

For one of the fictitious schools, we tested SEVP certification controls that  require schools to submit complete documentation by submitting an  application for the school that was missing several of the required  documents. Consistent with its procedures, ICE flagged our petition as  incomplete and sent us a notification stating that our petition was  canceled because we failed to submit all supporting evidence as outlined  in the regulations.

For our second school, we tested SEVP controls requiring schools to  schedule and complete a site visit conducted by an SEVP field  representative, by submitting a completed petition, but avoiding the site  visit and requesting that our paperwork move forward without it. SEVP’s  field representative subsequently notified us that our petition would not  move forward until a site visit was performed.

For our third fictitious school, we submitted an application, and  participated in a site visit with SEVP officials. We tested SEVP controls  related to verifying application documentation, and whether SEVP site-  visit officials followed established procedures for the site visit. The field  representative toured the facilities and interviewed GAO agents posing as  school officials. During its review of our petition, ICE took steps to verify  our school’s information and discovered that documentation we submitted  was fictitious. As a result, SEVP officials subsequently referred our school  to ICE agents for further investigation, consistent with ICE policies and  procedures. Upon learning that ICE followed its documented internal  control processes, we concluded our covert testing.

Long-Standing Delays in Recertifying Schools Create Additional Fraud Risks in SEVP

ICE faces long-standing challenges in conducting school recertification on  a 2-year basis consistent with statute and regulation, which may allow  potentially fraudulent schools to operate for a longer period without  detection. The Enhanced Border Security and Visa Entry Reform Act of  2002 states that DHS must conduct compliance reviews every 2 years,  during which ICE reviews a school’s records to verify that it continues to  comply with program-eligibility requirements. ICE began the first  recertification cycle in May 2010—8 years after the enactment of the  statutory requirement for periodic review of SEVP-certified schools. As of  March 2012—nearly 10 years after statutory enactment—ICE reported  that it had recertified approximately 19 percent of certified schools. In  October 2016, ICE reported that it had completed its first round of  recertification (in other words, all existing certified schools had been  recertified at least one time) and had used recertification to address a  number of issues, including gathering missing data for some school  records.

ICE has continued to recertify schools. However, Certification Unit  officials told us that, while recertification should be conducted every 2  years, ICE has been unable to meet a 2-year time frame for all certified  schools. ICE has been extending schools’ certification expiration dates  since officials began recertifying schools in 2010, according to  Certification Unit officials, to provide additional time for adjudicating  recertification petitions. According to ICE regulations, schools should be  notified 180 days before their certification expiration date and must file a  completed petition for recertification by such date, which is 2 years from  the date of their previous SEVP certification or the recertification  expiration date. However, as described in figure 9, SEVP has been  extending schools’ certification expiration dates by 180 days beyond the  2-year mark as defined in ICE’s regulation. Under this process, schools  must submit their complete petition and supporting documentation to  SEVP within 180 days after the 2-year mark.

Extending certification expiration dates increases the period between  each recertification review, resulting in a decrease in the number of  recertification reviews conducted in a given time frame, as shown in the  hypothetical example of two schools in figure 10.

For instance, if SEVP initially certified a school in January 2016, by  providing an extension SEVP is setting the school’s certification expiration  date to July 2018—2 years and 180 days after the initial certification—as  opposed to 2 years after the initial certification, which would be consistent  with ICE regulations. After receiving the school’s documentation,  Certification Unit staff need time to review and adjudicate the petition. If  this school submits a complete petition to SEVP in June 2018—1 month  before its revised expiration date—SEVP staff may and do take additional  time, depending on the facts and circumstances of the specific petition,  beyond the revised expiration date to adjudicate the petition. SEVP  officials stated that, if necessary, they can further extend the certification  expiration date to accommodate the time needed for their review. For  instance, SEVP may not adjudicate this school’s petition until December  2018. Once SEVP completes its adjudication in December 2018, the  school’s new certification expiration date would be June 2021 (2 years  and 180 days after December 2018). Thus, rather than potentially being  able to complete two rounds of recertification during this 5-year period  consistent with ICE regulation, SEVP would recertify the school only  once.

As we reported in 2012, according to SEVP officials, ICE delayed the  recertification process until after SEVIS was deployed in 2003 and the  program fee was increased in 2008 to support hiring additional staff.  Further, with regard to resources, ICE officials stated that they are cross- training adjudicative staff across all of their program areas to help  address the recertification workload, and creating regional adjudication  teams with assigned territories similar to the field representatives’  territories to allow the adjudicators to work with the same schools  throughout the school’s participation in the program. In addition, in  February 2018, SEVP’s Director stated that ICE was expecting to hire  additional adjudicators for a total of 10. In July 2018, ICE identified the  need to increase initial certification fees and add a new recertification fee  to, among other things, hire additional adjudicators to address longer  recertification processing times. Specifically, ICE stated that, at present  staffing levels, SEVP is able to process 1,939, or 44 percent, of the  required annual projected 4,400 recertification cases.

ICE’s actions to allocate additional resources to the recertification process  are a step in the right direction toward addressing its recertification  delays. However, it is unclear whether these actions alone will be  adequate to address the delays. As of June 2018, ICE officials told us  that there were 3,281 recertification petitions that needed to be  adjudicated. As previously discussed, recertification reviews are an  important fraud risk control because they are one of ICE’s primary means  of reviewing each school’s data and identifying potential school  noncompliance and fraud, especially since an out-of-cycle review may not  be conducted for each school. As Federal Internal Control Standards  state, management should: (1) establish and operate activities to monitor  the internal control system and evaluate the results, and (2) identify,  analyze, and respond to risks related to achieving the defined  objectives. By not requiring schools to submit their petitions within the  180-day period prior to the 2-year expiration date, as required by  regulation, ICE has limited assurance it is leveraging the recertification  process effectively to identify and respond to potential fraud risks to the  program, including those risks associated with allowing a fraudulent  school to operate for a longer period. ICE’s plan to increase the number  of SEVP adjudicators may help it meet the 2-year recertification  requirement, but without monitoring and evaluating the efficacy of these  actions, ICE will not have reasonable assurance it can effectively manage  the recertification process and associated fraud risks.

ICE Does Not Assess Residual Risk Posed by Schools in Its Recertification Queue

As previously discussed, ICE’s queue of recertification petitions awaiting  adjudication creates additional fraud risks to the program if higher-risk  schools continue to operate pending recertification. However, ICE has not  assessed the magnitude of such risks.

As of June 26, 2018, ICE had 3,281 recertification petitions in a queue for  review, according to SEVP officials, petitions that ICE adjudicates in the  order in which they were filed. As discussed, ICE uses a variety of  mechanisms to monitor schools’ ongoing compliance with program  requirements and mitigate fraud risks. In addition, ICE assesses and  considers schools’ risks during the adjudication process for recertification.  Specifically, according to SEVP’s recertification standard operating  procedures, case analysts in the Certification Unit are to review the  recertification packages once submitted to determine whether they are  complete and prepare them for adjudication. Further, SEVP officials  stated that the Certification Unit staff use an assessment of the school’s  risk to help prioritize further analysis and review efforts. When  adjudicating recertification petitions, adjudicators are to confirm that they  have assessed the school’s risk and whether any identified risks have  previously led to any further action, according to Certification Unit  officials. If case analysts determine that compliance issues are present  (e.g., the school has closed or the school has made updates to the Form  I-17 that are awaiting adjudication), they are to notify their supervisors.  For higher-risk schools, Certification Unit officials stated that adjudicators  may request more detailed evidence from schools as part of  recertification, consistent with their standard operating procedures, than  they would for lower-risk schools to help make more efficient use of the  resources in this unit.

These processes have helped SEVP consider and address potential risks  during the recertification process. However, SEVP has not determined  risks posed by schools in its recertification queue and, according to  Certification Unit officials, does not prioritize the review of schools’  recertification petitions in its queue based on risk. As previously noted,  ICE is required to conduct periodic reviews every 2 years to determine  SEVP-certified schools’ continued program eligibility and compliance.  The statute governing recertification does not, by its terms, preclude ICE  from considering a school’s relative risk as part of the compliance review  process. However, SEVP’s Director and Certification Unit officials stated  that a recertification process that prioritizes reviews based on school risk  would not be particularly helpful or add value in addressing school  compliance concerns because the officials already have a number of  mechanisms they can use, as previously discussed, to address potential  noncompliance, including conducting out-of-cycle reviews of high-risk  schools.

Although ICE considers schools’ risk-related information during the  adjudication process and may identify noncompliant or potentially  fraudulent schools through ongoing monitoring activities, ICE has not  determined the extent to which there are residual fraud risks posed by  schools in the recertification queue that ICE has identified as higher-risk  than other schools awaiting recertification. According to GAO’s Fraud  Risk Framework, managers should rank residual fraud risks in order of  priority, using the likelihood and impact analysis, as well as risk tolerance,  to help decide how to allocate resources to respond to residual fraud  risks, all of which is documented in a fraud risk profile. As previously discussed, a fraud risk profile (1) identifies the inherent fraud risks  affecting the program, (2) assesses the likelihood and effect of each type  of fraud risk that it has identified, (3) determines the agency’s tolerance  for certain types or levels of fraud risks in the program, and (4) examines  the suitability of existing controls for each fraud risk. Given SEVP’s long- standing delays in recertifying schools, without an assessment of residual  risks posed by the recertification queue—as part of its fraud risk profile,  as previously noted—ICE cannot ensure that it is effectively addressing  the risks posed by higher-risk schools awaiting recertification, a situation  that does not help further strengthen ICE’s fraud risk-management efforts  in SEVP.

ICE Has Implemented Controls That Mitigate Fraud Risks Related to the Eligibility, Suitability, and Training of DSOs, but Weaknesses Exist

ICE has identified fraud risks related to DSOs and implemented controls  to mitigate these risks, but weaknesses exist in four key areas: (1)  verification of information provided by DSOs in support of their eligibility,  (2) background checks, (3) mandatory compliance training, and (4) fraud- risk training. Prior to approval of schools’ nomination of individuals to  serve as DSOs, these nominees must meet eligibility requirements and  pass a criminal-background check, but weaknesses exist in both of these  controls. In addition, once ICE approves prospective DSOs, it has  controls for oversight and training; however, this training is not mandatory  and does not address fraud risks.

ICE Does Not Routinely Verify DSO-Submitted Eligibility Information in Support of Their Immigration or Citizenship Status

ICE has eligibility requirements for school employees seeking to serve as  DSOs at SEVP-certified schools, as discussed earlier, but does not  routinely verify DSO-submitted eligibility information in support of their  immigration or citizenship status. According to ICE regulations, to be  eligible to participate as a DSO, an individual must be a regularly  employed member of the school administration whose office is located at  the school and must meet two primary eligibility criteria. First, a DSO’s  compensation may not include commissions for recruitment of foreign  students. To verify that requirement, a field representative is to interview  a school’s principal DSO during an initial certification site visit, and ask whether any prospective DSOs receive compensation from commissions  for recruitment of foreign students. In addition, a field representative is to  review the school’s website for recruitment-related activities and evaluate  the DSO’s job title and position description, according to ICE officials.

Second, DSOs must be U.S. citizens or lawful permanent residents, but  the Certification Unit does not routinely verify the evidence provided to  meet this eligibility requirement. Specifically, DSOs are to submit  documentation during the school’s certification or recertification process— such as a passport, birth certificate, Permanent Resident Card or Alien  Registration Receipt Card, or copy of naturalization/citizenship  certificate—as evidence of their U.S. citizenship or lawful permanent  resident status. The Certification Unit is to review this documentation to  verify that the biographic details match the information provided on the  school’s Form I-17. According to ICE officials, if the Certification Unit  suspects that a prospective DSO’s documentation may not be valid, it will  send the information to the Compliance Unit for additional review.

However, neither the Certification Unit nor the Compliance Unit routinely  verify the information reported by DSOs in support of their immigration or  citizenship status because they do not have access to the type of  information needed to independently verify this information for all  prospective DSOs, according to ICE officials. Certification Unit officials  told us that verifying information on naturalized U.S. citizens and lawful  permanent residents would be beneficial. They said that they have  previously asked for access to information, such as other DHS databases  that contain information on naturalized U.S. citizens or lawful permanent  residents, to strengthen their process for determining the eligibility of  prospective DSOs. However, they have yet to receive access to this  information. In addition, verifying eligibility information for U.S.-born  citizens would also be valuable, but is more difficult than for naturalized  U.S. citizens or lawful permanent residents, according to ICE officials.  This is because ICE does not collect DSOs’ Social Security numbers— key information necessary to verify U.S. citizenship—in part because  SEVIS does not have the necessary security features needed to collect  and house those data, and adding those features would be costly. In June  2018, ICE management officials stated that they were reviewing  databases that may be useful to verify DSOs’ self-reported eligibility  information but did not provide any additional support or documentation of  those plans or a time frame for completing this review.

As outlined in our Fraud Risk Framework, as part of an effective antifraud  strategy, managers should take steps to verify reported information,  particularly self-reported data. Specifically, managers can benefit from  conducting data matching to verify key information, including self-reported  data and information necessary to determine eligibility, using government  or third-party sources to verify data electronically. Until ICE routinely  verifies the eligibility information submitted by prospective DSOs in  support of their immigration or citizenship status, particularly for  naturalized U.S. citizens and lawful permanent residents, ICE will not be  able to ensure that it is preventing ineligible individuals, including those  who represent a fraud risk, from becoming DSOs and providing them with  access to SEVIS to maintain student records.

ICE Plans for More- Comprehensive Vetting of Prospective DSOs’ Suitability for the Position Remain Incomplete

ICE has taken some initial steps to strengthen the process for vetting  prospective DSOs but has not implemented comprehensive background  checks on DSO nominees prior to approving them to carry out the DSOs’  reporting, record-keeping, and other functions. ICE officials told us that  they have been working since December 2016 to develop a plan to  conduct comprehensive background checks on prospective DSOs to  address past concerns about DSO vetting. Specifically, in 2011, ICE  expressed concerns that DSOs, who were not required to undergo background checks, were responsible for maintaining updated information  of foreign students in SEVIS.

According to ICE officials, they have taken initial steps to address these  concerns by implementing criminal-background checks on prospective  DSOs. Specifically, in May 2017, ICE started conducting background  checks on all school employees nominated to be DSOs at the time of  petitioning for initial SEVP certification or whenever a school requests to  add a new DSO. For these types of checks, ICE officials within CTCEU  are to review the prospective DSO’s biographic information from both the  Form I-17 and the proof of U.S. citizenship or immigration status  documentation received by the school. After ICE officials in CTCEU  complete this check, they are to forward the findings to SEVP for review.  If SEVP determines that a prospective DSO is unsuitable for participation  in the program, ICE officials in SEVP are to send a notice of rejection to  the nominating school. From April 2017 to March 2018, ICE screened  approximately 4,750 prospective DSOs and identified 68 individuals with  a criminal history. ICE rejected the nomination of 15 of these prospective  DSOs, because, for example, they had criminal histories that included  instances of identity theft, fraud in obtaining U.S. citizenship, and  conspiracy, among other crimes. ICE officials stated that certain crimes  will not necessarily disqualify a candidate, such as misdemeanors, traffic- related infractions, or other lesser crimes.

As of June 2018, ICE officials told us that they are developing a more- comprehensive background-check process to screen prospective DSOs  against additional government data sources. Specifically, ICE officials told  us that they are seeking to partner with DHS’s Transportation Security  Administration (TSA) to collect biometric information (e.g., fingerprints) on  prospective DSOs at TSA’s enrollment provider locations nationwide  during the school certification process. ICE officials stated that they  intend to provide the biometric information they collect through TSA’s  enrollment provider to ICE’s Office of Professional Responsibility (OPR),  and OPR officials will review such information to determine DSOs’  suitability. According to agency documentation, ICE’s OPR would vet  such information against data sources to screen these individuals for prior  criminal histories such as sexual misconduct, terrorist activities, and  immigration violations. According to ICE officials, they also intend to use  this process to periodically review the suitability of incumbent DSOs.

While ICE officials have told us they intend to expand the screening of  prospective DSOs, ICE does not have a documented implementation plan  that outlines how the project will be executed. The Project Management  Institute’s A Guide to the Project Management Body of Knowledge  (PMBOK® Guide) identifies standards related to project-management  processes, including the need to have documented implementation plans  describing how the project will be executed, monitored, and controlled, as  well as requirements and techniques for communication and establishing  agreements among stakeholders. In addition, GAO’s Schedule  Assessment Guide identifies best practices associated with developing  and maintaining a reliable, high-quality schedule. ICE provided us with a  draft of its revised background-check policy, talking points on its plans for  these checks, and draft requirements it shared with TSA in December  2016. However, these documents do not provide a detailed project- implementation plan to guide ICE’s effort. As of June 2018, ICE and TSA  officials have met twice in the last 2 years, and ICE officials do not have  any documents or other written details on their planned coordination with  TSA. SEVP’s Director acknowledged that SEVP will need to develop a  project plan to help guide its coordination with TSA and ICE’s OPR.  Without a documented implementation plan for this effort that outlines  how the project will be executed, monitored, and controlled, ICE does not  have reasonable assurance that it will be able to implement a more- comprehensive DSO background-check process.

ICE Has Mechanisms to Monitor and Support DSOs but Does Not Have Mandatory Training for Them

ICE has established mechanisms for monitoring SEVIS usage by  approved DSOs and providing support to DSOs to help them ensure their  schools comply with SEVP requirements but does not mandate training  for DSOs. Once DSOs are approved by SEVP, they are authorized to  make changes to student records in SEVIS and to create Forms I-20,  which enable students to apply for nonimmigrant student status. To  detect noncompliance and fraud that may be committed by DSOs during  this process, ICE has established mechanisms to monitor information  entered and identify data for computers used by DSOs through SEVIS  compliance checks, among other things. For example, according to  agency officials, ICE monitors DSO actions in SEVIS to help prevent  noncompliance and fraud.

In addition to monitoring DSOs’ use of SEVIS, ICE provides support and  training to DSOs to help ensure they can effectively update and maintain  student records in SEVIS and provide recommendations to students  regarding the maintenance of their status, according to our review of ICE  documentation and interviews with ICE and school officials. According to  program rules, DSOs are responsible for understanding SEVP regulations  related to the requirements for foreign students’ admission, maintenance  of status, and change of status and requirements for school approval. To  assist them, ICE officials and DSOs that we interviewed told us that  SEVP uses its field representatives to provide DSOs with a point of  contact for questions related to the program. According to SEVP’s internal  guidance, field representatives are expected to visit the schools within  their areas of responsibility at least once a year to provide in-person  guidance and training to DSOs. DSOs at 15 of the 17 schools we visited  stated that the field representatives were helpful, including with providing  guidance on how to comply with SEVP rules and regulations.

In addition, SEVP internal guidance encourages DSOs to take its web- based training course on the responsibilities and obligations for both  DSOs and foreign students in SEVIS. However, this course is voluntary.  According to ICE officials and field representatives, the extent to which  DSOs take the voluntary training varies—some DSOs receive additional  training beyond the voluntary SEVP training, but other DSOs do not  complete any training. ICE officials noted that the voluntary online training  may be perceived as cumbersome and that, since it is not required, many  DSOs instead reach out to field representatives or call the SEVP  Response Center to get answers to questions that are covered by  existing training materials. ICE officials also stated that they do not know  the extent to which DSOs have completed the online training because  they do not track this information. Further, the officials acknowledged that  since training is voluntary, some DSOs may not complete it before  assuming their responsibilities and gaining access to SEVIS.

ICE officials we interviewed told us they encounter problems with DSOs  complying with record-keeping requirements; however, they believe most  of these issues are a result of DSOs not understanding program rules or  their own responsibilities within the program. According to agency  documentation, in 2014 SEVP found that some DSOs were inconsistently  reporting school information in several SEVIS data fields. In addition,  SEVP’s Risk Assessment Tool includes a number of high-risk indicators  that may stem from DSO record-keeping errors within SEVIS, including  students listed as enrolled in an academic program not available at that  school (e.g., doctoral students at schools without doctorate degrees  available) and students listed as active who have long exceeded their  program’s end date or authorized employment’s end date. Errors such as  these make it difficult for ICE officials to know whether the information in  SEVIS is inaccurate due to unintentional mistakes by the DSO or whether  the school or its employees may be engaged in potential fraud. For  additional examples of potential noncompliance or fraud, see the box  below.

Potential Designated School Official Noncompliance or Fraud  Student and Exchange Visitor Program officials cited the following examples of potential  noncompliance or fraud that they have encountered, among others: the reported foreign-student enrollment listed in the Student and Exchange Visitor Information  System (SEVIS) does not seem to correspond with the number of students attending class or  the size of the school’s physical space, all enrolled foreign students listed in SEVIS are living at the same address, and students repeatedly transfer to several different schools.

Field representatives at one location we visited noted that DSOs with  multiple job responsibilities may not have time to keep up with SEVP  rules and policy updates. Similarly, DSOs at 7 of the 17 schools we spoke  with mentioned that they have multiple job responsibilities beyond their  DSO duties. In addition, SEVP officials indicated that DSOs have a high  rate of turnover, especially at small schools, and may lack the expertise to  effectively follow program requirements.

SEVP officials acknowledged that mandatory training could help reduce  the number of unintentional violations by DSOs who may not adequately  understand the program’s regulations, thus allowing SEVP staff to focus  their monitoring efforts on schools and individuals who may be engaged  in intentional noncompliance and fraud. In June 2018, ICE officials told us  that they recently received internal agreement to require all new DSOs to  complete training prior to gaining full access to SEVIS once the officials  release a new version of their DSO training program. However, SEVP  officials could not provide documentation on their plans, including time  frames for completing the revised DSO-training program, whether to  require DSO training, or how they will track DSO compliance. Federal  Internal Control Standards calls for agencies to demonstrate a  commitment to competence, including recruiting, developing, and  retaining competent individuals. Further, it recommends that agencies  establish expectations of competence for key roles, including possessing  the necessary knowledge, skills, and abilities, and training individuals  appropriately. Without mandatory training and a process to verify that  training is completed, SEVP does not have reasonable assurance that  DSOs are familiar with, and understand, their roles and responsibilities as  outlined in program regulation.

SEVP’s voluntary DSO training emphasizes student and school  compliance with program rules and the DSOs’ responsibilities to enter  and maintain complete and accurate information in SEVIS in a timely  manner but does not address fraud risks to the program, including  previously identified fraud schemes or trends. According to ICE officials,  some DSOs may receive fraud-specific training from ICE agents through  the Project Campus Sentinel initiative; however, these visits are limited to  a small portion of certified schools each year. During a Project Campus  Sentinel visit, ICE guidance states that an ICE agent will meet with DSOs  and provide information on how to detect potential fraud, including  student visa exploitation and national security vulnerabilities. In addition,  ICE guidance encourages ICE agents to remind DSOs to contact them  when they encounter these instances. In fiscal year 2017, ICE officials  reported that ICE agents visited 400 of the more than 18,000 SEVP- certified school campuses in existence at that time. According to ICE  officials, the agency can only conduct a limited number of Project  Campus Sentinel visits to schools each year due to competing  investigative priorities.

The DSOs we spoke with varied in their understanding of the role they  should play in identifying and reporting fraud to SEVP. Specifically, DSOs  at 8 of 17 schools told us they did not receive training on SEVP-related  fraud risks or could not identify SEVP-provided, fraud-specific training.  For example, DSOs at one school told us that there is confusion among  DSOs about their role to prevent and report fraud and that this issue has  been discussed at past training events and conferences. Specifically, they  stated that there is some confusion over the difference between fraud and  noncompliance. According to these DSOs, they are responsible for  addressing issues of noncompliance, but they do not actively look for  SEVP-related fraud. A DSO from another school told us she interprets the  DSO role as providing program oversight, including oversight related to  fraud, and that she previously reported an instance of potential student  fraud to ICE when she encountered suspicious immigration paperwork. In  addition, DSOs at another school told us that they were not aware of any  training related to fraud risks within SEVP but noted that guidance about  fraud trends or potential red-flag indicators could be useful.

The Fraud Risk Framework identifies training as one way of  demonstrating an agency’s commitment to combating fraud. Training and  education intended to increase fraud awareness among stakeholders,  managers, and employees serves as a preventive measure to help create  a culture of integrity and compliance within the agency. Specifically, the  Fraud Risk Framework discusses leading practices for training and  education, including communicating responsibilities for implementing  fraud controls and details on how and where to report fraud. In addition,  increasing awareness of fraud schemes, including red flags and risk  indicators, through training and education can serve a preventive purpose  by helping create a culture of integrity and compliance within the program  and can enable managers, employees, and stakeholders with  responsibility for implementing aspects of the program to better detect  potential fraud. According to ICE officials, DSOs can serve as the front  line against SEVP-related fraud, and they provide a significant portion, if  not the majority, of fraud-related tips.

In June 2018, ICE officials told us that, in response to discussions that we  had during our review, they plan to incorporate fraud training into the  revised DSO training. However, because ICE officials just recently made  that decision, they had not yet developed documented plans for this  training or timelines for when it would be completed. While agreeing to  incorporate fraud training into the revised DSO training is a good first  step, the development and execution of those plans will be needed to  strengthen fraud controls. Until ICE develops and implements a plan for  fraud-specific DSO training, ICE will not have reasonable assurance that  this training will be delivered and DSOs will have the information they  need to address fraud within the program.

Through SEVP, ICE oversees over 1.2 million foreign students at nearly  9,000 SEVP-certified schools across more than 18,000 campuses. Past  instances of fraud and noncompliance in the program have resulted in  ICE taking some steps to address fraud risks in the program, such as  developing a Risk Assessment Model and Framework. However, ICE  does not have a fraud risk profile that identifies all of SEVP’s fraud risks,  discusses the likelihood of those risks, assesses related controls, and  identifies the agency’s tolerance for risk. Such a fraud risk profile would  help ICE more effectively assess whether additional internal controls or  changes to policies or regulations are needed. Moreover, ICE has not yet  fully employed the use of data analytics, such as network analysis, to help  it identify potentially fraudulent schools before they become certified to  enroll foreign students and help it better use its administrative and  investigative resources.

ICE has also made improvements to its processes for certifying and  recertifying SEVP schools and monitoring DSOs—all of which can help  reduce the risk of fraud in the program. However, ICE continues to delay  the recertification process by initiating the school recertification reviews  after the 2-year certification expiration date, which is not consistent with  ICE regulations. Further, ICE has not included an assessment of residual  risks posed by the current recertification queue—as a part of the fraud  risk profile previously noted—and as a result does not have a full  understanding of the risks associated with schools awaiting recertification.  Although DSOs play an important role in helping ICE oversee students in  the program, ICE has recognized they can pose fraud risks to the  program. However, ICE does not routinely verify DSO-submitted eligibility  information and DSO suitability for participation in SEVP, and therefore  does not have reasonable assurance that only eligible and suitable DSOs  are participating in the program. Finally, ICE has not developed or  implemented mandatory and fraud-specific training to improve DSOs’  compliance with program requirements and aid its efforts to detect fraud  in the program.

We are making the following seven recommendations to ICE:

The Director of ICE should develop a fraud risk profile that aligns with  identifies inherent fraud risks affecting the program, assesses the likelihood and impact of inherent fraud risks, determines fraud risk tolerance, and examines the suitability of existing fraud controls and prioritizes  residual fraud risks, including residual risks posed by the  recertification queue. (Recommendation 1)

The Director of ICE should build on existing efforts to use data  analytics by employing techniques, such as network analysis, to  identify potential fraud indicators in schools petitioning for certification.  (Recommendation 2)

As ICE works to complete its efforts to hire additional SEVP  adjudicators, the Director of ICE should begin notifying certified  schools 180 days prior to, and requiring submission of complete  recertification petitions by, the 2-year certification expiration date,  consistent with regulation, and evaluate whether additional resources  are needed. (Recommendation 3)

The Director of ICE should, as practicable, verify the eligibility  information provided to establish the immigration or citizenship status  of lawful permanent residents and naturalized U.S. citizens, as well as  U.S.-born citizens, who have been nominated or renominated to serve  as DSOs. (Recommendation 4)

The Director of ICE should develop an implementation plan for the  project aimed at strengthening background checks for DSOs; that  plan should outline how the project will be executed, monitored, and  controlled. (Recommendation 5)

The Director of ICE should implement mandatory DSO training and  verify that the training is completed. (Recommendation 6)

The Director of ICE should complete the development and  implementation of its plans for mandatory fraud-specific training for  DSOs. (Recommendation 7)

We provided a draft of this report to DHS for its review and comment. In  its written comments, reproduced in appendix V, DHS concurred with our  recommendations and described specific steps it plans to take in  response to all seven of our recommendations. DHS also provided  technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Rebecca Shea at (202) 512-6722 or shear@gao.gov or Rebecca  Gambler at (202) 512-8777 or gamblerr@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on   the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VI.

Appendix I: GAO’s 2012 Recommendations on the Student and Exchange Visitor Program, and the Agency’s Response

Table 1 contains information on the eight recommendations that we made  to U.S. Immigration and Customs Enforcement (ICE) in our 2012 report,  and ICE’s actions to address them. We closed each of these  recommendations as implemented.

Appendix II: Objectives, Scope, and Methodology

This report is a public version of a sensitive report that we issued on  November 20, 2018, which examined the efforts that U.S. Immigration  and Customs Enforcement (ICE) has taken since our 2012 report to  address fraud risks, including the extent to which ICE has (1) taken steps  to strengthen its management of fraud risks in the Student and Exchange  Visitor Program (SEVP), (2) implemented controls to address fraud risks  in the school certification and recertification processes, and (3)  implemented fraud risk controls related to the eligibility, suitability, and  training of Designated School Officials (DSO).The sensitive report  included information related to SEVP internal controls used to help  prevent and identify noncompliance or fraud in the program. The  sensitive report also discussed some planned actions to improve these  internal controls, some of which the Department of Homeland Security  (DHS) deemed to be sensitive and must be protected from public  disclosure. This public report omits the information that DHS deemed to  be sensitive including details associated with (1) the oversight of schools  during the certification and recertification process, (2) our covert testing of  SEVP certification internal controls, and (3) current and planned actions  to oversee DSOs. Although the information provided in this report is more  limited, it addresses the same objectives and uses the same methodology  as the sensitive report.

For our first objective, to evaluate the extent to which ICE has taken steps  to strengthen its management of fraud risks in SEVP, we assessed  actions ICE, particularly SEVP and the Counterterrorism and Criminal  Exploitation Unit (CTCEU), have taken since 2012 to design and  implement controls to address fraud in the postsecondary, vocational, and  English language school certification and recertification process. We  reviewed documents including regulations, processes and procedures,  and guidance related to fraud risk management, school certification, and  recertification processes, and the role of DSOs. We evaluated the extent  to which ICE’s practices were consistent with Standards for Internal  Control in the Federal Government and GAO’s A Framework for  Managing Fraud Risks in Federal Programs. In particular, we analyzed  ICE documentation, such as standard operating procedures, policy  statements, and guidance for adjudicators to determine how ICE’s  processes and systems identify and assess risk in SEVP, including the  SEVP Risk Assessment Model and Framework, Risk Assessment Tool,  Risk Register, and other internal guidance. In addition, we reviewed  information from ICE’s current SEVP administrative, watch, and criminal  investigative cases and analyzed information on past cases of SEVP  fraud, including indictments.

Also, we interviewed ICE officials within SEVP to evaluate the extent to  which the program has taken steps to strengthen its management of fraud  risks since 2012. We met with senior officials from SEVP, including  SEVP’s Director and management of the Risk Management Support  Team, School Certification Unit (Certification Unit), Analysis and  Operations Center (Compliance Unit), Policy Team, and Field  Representative Unit. We interviewed officials from ICE’s Office of the  Principal Legal Advisor to discuss regulatory priorities and legal  authorities related to fraud prevention and detection. We also interviewed  officials from ICE’s Identity Benefit Fraud Unit and Domestic Operations  to discuss their roles in SEVP-related fraud prevention. In addition, we  met with officials from CTCEU headquarters, including the Student and  Exchange Visitor Information System Exploitation Section and criminal  investigators from 5 of the 26 ICE field offices to discuss past cases of  SEVP-related fraud and steps taken to identify and prioritize fraud risk.  We visited ICE field offices in Washington, D.C.; Los Angeles and San  Francisco, California; Newark, New Jersey; and New York, New York. We  selected these locations based on a mix of criteria, including the following  characteristics: (1) number of ongoing investigations of certified schools;  (2) reported previous and current experience investigating SEVP-related  fraud; (3) number of field representatives assigned to or located near the  field office; and (4) number of schools that were located proximate to the  field office and that were either pending recertification, as of July 2017, or  have been recertified since August 2016. As we did not select a  probability sample of ICE field offices to interview, the results of these  interviews cannot be generalized to all of ICE’s 26 field offices. However,  the interviews provided us with perspectives of ICE officials responsible  for conducting school fraud investigations, including their views on the  process SEVP has established for certifying and monitoring schools,  fraud, and national security vulnerabilities related to foreign students, and  any challenges field offices have faced in their investigations.

We conducted a network analysis utilizing both public and proprietary  information associated with currently certified schools to determine the  potential to utilize additional data analytics to aid fraud risk-management  efforts in SEVP. To develop this analysis, we identified a list of schools  that, as of July 2017, had been identified by ICE as either being under  active criminal investigation or subject to additional oversight or  administrative action due to compliance concerns. We also selected a list  of SEVP-certified postsecondary schools without such identified concerns  as of September 2017. We restricted our set of schools to those with at  least 20 foreign students as of September 2017. In total, 2,439 schools  comprising 170 with concerns and 2,269 without such concerns were  analyzed. We then used an outside vendor to provide public and  proprietary information such as descriptive information associated with  these schools including addresses, businesses, and past executives.  Using these data, we used network-analysis techniques to identify  connections between both those schools with criminal or compliance  concerns and schools without such identified concerns. We determined  whether each of the postsecondary schools without compliance concerns  were linked to any of those with compliance concerns via executive  employment. Specifically, we identified instances in which an official  associated with a school with criminal or compliance concerns was  associated with another school not identified as having those concerns.  The underlying logic behind this focus was that schools associated with  an official linked to a school of concern may potentially indicate the need  for further review of possible criminal or compliance concerns. To further  validate this information, we conducted additional research using  investigative databases and the Internet to try to verify the instances  identified in our analysis such as by ensuring the time frames of the  connection appeared relevant or to verify the identity of individuals and  schools involved. While such connections are not proof of criminal or  compliance problems, they may potentially be indicative of them. This is a  diagnostic that has been used in other fraud-related network research.

For our second objective, to evaluate the extent to which ICE has  implemented controls to address fraud risks in the school certification and  recertification processes, we assessed documentation describing SEVP’s  school certification and recertification controls, interviewed headquarters  and selected field-office ICE officials, and analyzed agency-provided  recertification data. Specifically, we assessed SEVP’s standard operating  procedures, including its Adjudicator’s Manual, training materials, and  other guidance to determine whether the certification and recertification  controls described in these documents addressed the high-risk indicators  ICE identified in its Risk Assessment Tool. We used this analysis to  determine any potential noncompliance and fraud vulnerabilities in these  controls. We also assessed SEVP’s controls in these areas against  Standards for Internal Control in the Federal Government related to risk  management, as well as principles of the Framework for Managing Fraud  Risks in the Federal Government. Additionally, we interviewed ICE  officials in SEVP’s Certification Unit, which is responsible for adjudicating  certification and recertification petitions, and the Compliance Unit, which  is charged with monitoring schools for ongoing compliance with regulatory  record-keeping and reporting requirements. To understand how ICE  Homeland Security Investigations agents in the field offices work with  officials in SEVP and the CTCEU to investigate school fraud, we  conducted semistructured interviews with ICE agents in five field offices.  We also interviewed ICE officials from SEVP’s Field Representative Unit  as well as eight field representatives assigned to or located near the  selected field offices to gather information on the representatives’ roles  and activities in identifying and reporting potential school fraud.

Further, we conducted covert testing of SEVP’s internal control activities  related to the school certification process. Specifically, we submitted  certification petitions and conducted other covert investigative work for  three fictitious schools, each of which are subject to particular petition  requirements.

For one of the fictitious schools, we tested SEVP certification controls that  require schools to submit complete documentation by submitting a  petition for the school that was missing several of the required  documents. For our second school, we tested SEVP controls requiring  schools to schedule and complete a site visit conducted by an SEVP field  representative, by submitting a completed petition for the accredited  business school, but avoiding the site visit and requesting that our  paperwork move forward without it.

For our third fictitious school, we submitted a petition and participated in a  site visit with SEVP officials, using a rented space as a fictitious school  location. We tested SEVP controls related to verifying petition  documentation, and whether SEVP site-visit officials followed established  procedures for the site visit.

For all three petitions, we used publicly available information to construct  our scenarios. We then documented any actions taken by SEVP on the  submitted petitions, such as completeness checks, investigative steps,  adjudication decisions or requests to provide additional supporting  documentation, among other things. Results for all three covert tests,  while illustrative, cannot be generalized to the full population of petitions.

For our third objective, to determine the extent to which ICE implemented  fraud risk controls related to the eligibility and suitability of DSOs, we  assessed guidance, training, and policies related to DSOs. Specifically,  we reviewed regulations for DSO eligibility and SEVP guidance and  standard operating procedures to determine whether supporting evidence  provided to meet these requirements is being verified, including the Field  Representative Unit’s Site Visit Standard Operation Procedure and the  Certification Unit’s Adjudicator’s Manual. We evaluated the extent to  which ICE’s practices for verifying eligibility were consistent with the  Framework for Managing Fraud Risks in the Federal Government. In  addition, we reviewed the current and planned documentation and  procedures on ICE’s existing and planned background checks, including  the existing documentation for DSO vetting against relevant databases,  initial requirements for planned biometric screening, and a draft policy  document for the planned checks. To gather additional perspectives, we  interviewed ICE officials in headquarters and selected field offices. We  also interviewed selected DSOs in the field. We identified leading  practices for project planning in the Project Management Institute’s A  Guide to the Project Management Body of Knowledge. In addition, we  reviewed the best practices associated with developing and maintaining a  reliable, high-quality schedule in the GAO Schedule Assessment Guide.

In assessing current training and oversight for DSOs, we examined  guidance, policies, and procedures for the SEVP Field Representative  Unit and CTCEU’s Project Campus Sentinel. We assessed the  implementation of these controls against criteria in Standards for Internal  Control in the Federal Government and A Framework for Managing Fraud  Risks in Federal Programs. We reviewed DSO training materials,  including the Online Training for DSOs and the Study in the States  website. To determine how ICE identifies fraud risk associated with  DSOs, the controls in place for addressing and mitigating these risks, and  its efforts to identify potential vulnerabilities in its controls, we met with  ICE officials at headquarters and five selected field offices, as discussed  above. To identify the extent to which they have DSO training and  antifraud responsibilities and requirements, we interviewed selected field  representatives. Furthermore, we interviewed DSOs at 17 selected  certified postsecondary schools on their roles and responsibilities and  training resources. We selected these officials because, as of September  2017, they constituted a group of representatives from certified schools of  various types and sizes and were located in proximity to our previously  selected ICE field-office locations. As we did not select a probability  sample of DSOs to interview, the information we obtained from these  school officials cannot be generalized. These interviews provided us with  the perspectives of DSOs on their roles and responsibilities, training, and  fraud risks within the program. Further, we interviewed officials from  NAFSA, an association of international educators, to discuss the  organization’s views on fraud risks within SEVP, and we reviewed an  extract from the NAFSA Advisor’s Manual of federal regulations affecting  foreign students and scholars.

Appendix III: Key Elements of the Fraud Risk-Assessment Process

GAO’s A Framework for Managing Fraud Risks in Federal Programs  states that, in planning the fraud risk assessment, effective managers  tailor the assessment to the program by, among other things, identifying  appropriate tools, methods, and sources for gathering information about  fraud risks and involving relevant stakeholders in the assessment process  (see fig. 11).

Appendix IV: Withdrawal or Denial of Certification or Recertification

On the basis of our analysis of U.S. Immigration and Customs  Enforcement (ICE) data, the Student and Exchange Visitor Program  (SEVP) withdrew certification for approximately 2,600 schools during the  period of fiscal years 2013 through 2017 (see fig. 12). The Enhanced  Border Security and Visa Entry Reform Act of 2002 states that a material  failure of an SEVP-certified school to comply with the record-keeping and  reporting requirements to receive nonimmigrant students shall result in  the suspension for at least 1 year, or termination, of the school’s approval  to receive such students. Under federal regulation, SEVP can deny an  SEVP-certified school’s recertification petition or, as a result of a  subsequent out-of-cycle review, can withdraw certification, if the school or  its programs are no longer eligible for certification.

Denial of recertification or withdrawal on notice as a result of out-of-cycle  review may be for any valid and substantive reason, including failure to  comply with record-keeping and reporting requirements, willful issuance  by a DSO of a false statement, or not operating as a legitimate institution,  among other bases. According to SEVP officials, denials resulting from  recertification reviews are often based on historical discrepancies in the  DSO’s data entry, record-maintenance and Form I-20 issuance issues, or  a negative change in the school’s operating status, such as a loss of state  licensure. By regulation, an appeal of a notice of denial or withdrawal  must be made within 15 days after service of the decision. Schools denied recertification must, according to regulations, wait at least 1  calendar year from the date of denial of recertification or withdrawal  notice before being eligible to petition again for certification.

If, upon the completion of an out-of-cycle review, SEVP determines that a  school has failed to sustain eligibility or has failed to comply with the  record-keeping, retention, reporting, or other requirements, SEVP will  institute withdrawal proceedings by serving the school a notice of intent to  withdraw SEVP certification. Failure of a school to respond to a notice of  intent to withdraw within 30 days will result in an unappealable withdrawal  of the school’s certification. At the conclusion of withdrawal proceedings,  a school found to be ineligible for continued SEVP certification as a result  of an out-of-cycle review will receive a notice of withdrawal. SEVP  withdrew on notice approximately 211 certifications from fiscal years 2013  through 2017 (see fig. 12). If SEVP staff identify an issue during an out- of-cycle review that seems to be an error not warranting withdrawal,  SEVP could issue a Remedial Action Plan to the school describing the  issues it needs to address to retain its program eligibility. According to  SEVP officials, once they have gathered enough evidence and made the  decision to withdraw the school’s certification, SEVP can temporarily  terminate the school’s ability to issue Forms I-20 to students. For  example, SEVP officials explained that if a school that is otherwise in  compliance lets its accreditation lapse, SEVP may revoke its authority to  issue Forms I-20 until it renews its accreditation.

Regarding automatic withdrawals, SEVP will serve a notice of intent to  withdraw SEVP certification to the school 30 days prior to its certification  expiration date if, up until that point the school has failed to file a  complete petition for recertification. From fiscal year 2013 through fiscal  year 2017, SEVP automatically withdrew 1,763 certifications (see fig. 12).  SEVP will not accept a petition for recertification and the school will be  automatically withdrawn immediately if such school has effectively  relinquished its SEVP certification by not petitioning for recertification,  abandoning its petition, or not submitting a complete recertification  package by the certification expiration date. Certified schools can also  voluntarily withdraw their certification at any time.

Appendix V: Comments from the Department of Homeland Security

Appendix VI: GAO Contacts and Staff Acknowledgments

In addition to the contacts named above, Latesha Love (Assistant  Director), Kathryn Bernet (Assistant Director), Nick Weeks (Analyst-in- Charge), David Aja, David Dornisch, Gabrielle Fagan, April Gamble, Gina  Hoover, Lauren Kirkpatrick, Kirsten Lauber, Barbara Lewis, Sasan J.  “Jon” Najmi, Robin Nye, George Ogilvie, Ramon Rodriguez, Constance  Satchell, Sabrina Streagle, Shana Wallace, and Helina Wong made key  contributions to this report.

Are some U.S. schools fraudulently certifying that their foreign students are currently enrolled and attending classes?

We previously reported on fraud in the Student and Exchange Visitor Program such as "sham" schools that help students get visas to live in the U.S. without requiring that they attend classes. In some cases these "sham" schools have included major fraud schemes involving hundreds of students. This could damage the integrity of the program.

Though the Department of Homeland Security has improved program oversight, we now recommend that it further enhance controls over schools and school employees to help mitigate fraud.