Context: To participate in federal student aid programs, postsecondary schools must be 1) certified by Education as eligible to participate in federal student aid programs, 2) accredited by a recognized accrediting agency— generally nongovernmental, nonprofit entities—and 3) authorized by the state in which the school is physically located. (See table 1.) FSA is responsible for ensuring that schools with access to federal student aid are eligible and capable of properly administering federal student aid funds, according to standards established by Education and authorized by the Higher Education Act. These standards include requirements for schools related to communication, personnel, policies, procedures and reporting, and adequate checks and balances in a system of internal controls, among others. FSA is also responsible for conducting ongoing financial oversight of schools that receive federal student aid. This includes reviewing annual financial statement audits to assess a school’s financial responsibility and providing additional oversight to schools that do not meet financial responsibility standards outlined in the Higher Education Act. Schools that participate in federal student aid programs generally are required to submit annual compliance audits. The compliance audit provides information that FSA can use to assess the school’s administration of federal student aid programs and to identify schools that require additional oversight because they do not fully comply with federal student aid administrative requirements. The OIG is required to assess the quality of school compliance audits and selects a sample to review each year. The OIG reviews the audit documentation to ensure that it supports the auditor’s opinions and that the audit results are reliable. According to agency guidance, FSA staff should refer compliance audits to the OIG for a quality review if they have any concerns about the quality of the audits. Both FSA and OIG officials stated that the OIG has primary responsibility for issues related to audit quality. When a school first applies to be certified to administer federal student aid, FSA will either approve the school for provisional certification— generally for 1 year—or deny certification (see fig. 1). Once a school is approved for initial certification and applies for recertification, FSA will provisionally or fully recertify the school, or deny certification. According to FSA procedures, FSA uses provisional certification for initial, or first time, applicants, as well as schools that are applying for recertification. Provisional certification is the only approval status available to new schools. In addition, FSA may decide to recertify a school provisionally if it determines that a school has not fully complied with federal student aid requirements. FSA prohibits provisionally certified schools from opening new campus locations or offering new programs without approval from FSA, and provisionally certified schools that are denied recertification have a less substantive appeals process than fully certified schools. Further, recertified schools in provisional status are subject to more FSA oversight than schools that are fully certified. FSA procedures allow for some discretion in determining for how long to certify a school. Provisional recertification generally lasts 1 to 3 years, while full recertification generally lasts 4 to 6 years. Education’s FSA regional staff draw information from a variety of sources during the certification process to assess a school’s capability to administer federal student aid. According to FSA documents, regional staff are to review information collected from schools and third parties, such as annual compliance audits conducted by independent auditors, among other information sources. FSA staff responsible for different functional areas, such as financial and compliance audits, accreditation status, and student loan default rates, compile and review information on schools, according to FSA procedures. FSA officials told us that these staff meet to discuss any potential program eligibility issues and to ensure that all information relevant to a school is considered before making a certification decision. FSA’s certification procedures outline some of the key information that regional staff should assess, some of which is relevant to both initial and recertification decisions, and some of which is specific to each type of certification process (see fig. 2). Documents and policies provided by schools: FSA regional staff are directed to review documents submitted by schools, including school catalogs, and certain school policies—such as admissions and student refund policies—that are relevant to assessing administrative capability. Proof of accreditation: School accreditors are responsible for applying and enforcing standards to help ensure that the education offered by schools is of sufficient quality to achieve program objectives. Accreditation of schools, which generally includes a site visit, takes place on a cycle that may range from every few years to as many as 10 years. Proof of state authorization: States are responsible for authorizing schools to offer postsecondary education and respond to student complaints. The process for approving schools varies from state to state and may include on-site visits. Audited financial statements: FSA regional staff are directed to review information in audited financial statements to assess schools’ financial health. Schools are required to have annual audited financial statements issued by an independent certified public accountant or a government auditor. Self-reported school data: FSA regional staff are instructed to review data on continual student enrollment in eligible academic programs and student withdrawal rates. Pre-certification review and school outreach: FSA staff are responsible for contacting school personnel to verify the school’s application information and discuss relevant policies, procedures, and other materials relevant to administering federal student aid. FSA visits to newly certified schools: After schools first apply and are provisionally certified, Education requires FSA regional staff to contact them within 3 months and schedule an on-site school visit. Schools cannot administer federal student aid until they are certified, so FSA has limited information on how newly certified schools are administering federal student aid programs. School visits provide FSA with an opportunity to collect additional information about a provisionally certified school’s ability to administer federal student aid. Some FSA regional staff we interviewed told us that on-site visits to newly certified schools provide valuable first-hand information about whether these schools are administering federal student aid in accordance with program requirements. If FSA regional staff find that a school is having difficulties administering federal student aid, FSA procedures direct regional staff to assist schools by providing clarification and guidance on federal student aid policies, recommending additional training for school officials, and helping schools develop a plan to track and report on their corrective actions, among other things. Compliance audits: FSA staff are directed to review information in compliance audits to determine if schools are complying with specific federal student aid requirements. Generally, compliance audits are required to be conducted annually by an independent auditor, and submitted with the school’s audited financial statements. Program reviews: FSA regional staff are also responsible for conducting program reviews, usually on site, which evaluate school compliance with federal requirements and can provide more in-depth information on schools than compliance audits, according to some FSA staff we interviewed. Generally, FSA selects schools for program reviews that it considers to be at risk for noncompliance, according to Education documents. FSA conducts approximately 250 to 300 program reviews per year, according to FSA documentation. FSA staff from all four of our selected regional offices told us they consider results from any recent program review in decisions about recertification and noted that such information, when available, is valuable for assessing schools’ administrative capability. Education data: FSA regional office staff are also directed to review data on student loan default rates. From calendar years 2006 through 2017, FSA approved most schools applying for certification to receive federal student aid, according to Education data. From 2006 through 2017, FSA approved 89 percent of schools new to administering federal student aid for provisional certification and denied 11 percent of schools overall (see fig. 3). Denial rates for initial certification were 11 percent for public and for-profit schools and 14 percent for nonprofit schools. For more information on 2006-2017 school certification outcomes by year, see appendix I. FSA regional staff responsible for reviewing school applications told us that schools are denied initial certification for issues such as a lack of accreditation, not offering eligible programs for federal student aid, or not meeting other statutory eligibility requirements. For example, FSA staff said that for-profit and vocational schools that apply for initial certification are required to provide an eligible program continuously for 2 years prior to their initial application. FSA staff may also advise schools that do not meet basic eligibility requirements not to apply, which could result in fewer initial certification denials overall. In addition, FSA staff said they often work with schools to address compliance problems, for example, by providing guidance on revising school policies that do not meet requirements, so that the schools are able to meet FSA’s certification requirements. From 2006 through 2017, 76 percent of schools applying for recertification were fully recertified, 21 percent were provisionally recertified, and 3 percent were denied recertification. Sixty-six percent of for-profit schools were fully recertified, 28 percent were provisionally recertified, and 6 percent were denied. In comparison, 86 percent of public schools were fully recertified, 14 percent were provisionally recertified, and fewer than 1 percent were denied. Nonprofit schools had rates similar to public schools, with 80 percent fully recertified, 18 percent provisionally recertified, and 2 percent denied (see fig 4). FSA staff from all four of our selected regional offices told us that they typically deny recertification when a school no longer meets eligibility requirements, such as losing accreditation, or when there is significant evidence of serious issues or massive wrongdoing, such as fraud. For example, managers in one regional office told us they denied recertification for a school because they had evidence that the school was accepting students without valid high school diplomas and referring them to diploma mills to boost enrollment. Staff in two FSA regional offices told us that they can also choose to fully recertify a school for shorter periods of time if they uncover issues related to administrative capability. For example, one regional staff member told us that when they found a school’s default rate for one federal student loan program had been high for the prior 3 years, the regional office decided to shorten the school’s full recertification period from 6 to 4 years, to allow FSA staff to review the school again sooner. FSA staff from all four of our selected regional offices told us that they provisionally certify schools for a variety of reasons, including when a school submits a late compliance audit or when a recent compliance audit indicates that a school could potentially have significant problems. Generally, schools in provisional certification status are subject to additional monitoring by FSA compared to schools that have been fully certified. For example, Education officials said that if they have concerns about a provisionally certified school’s student withdrawal rate, they can add provisional conditions requiring the school to submit monthly enrollment rosters for review. Staff in two FSA regional offices told us that in other cases, if they have concerns about how a school is administering federal student aid or suspected fraud, they can put a school on provisional status and conduct a program review to collect more detailed information on compliance with federal requirements. Education data also show that most schools remain in provisional status the first time they are recertified—62 percent from 2006 to 2017. In contrast, FSA staff fully recertified over three-quarters of schools that applied for recertification a second time during the same time period (see table 2). For more information on first and second recertification outcomes by school sector, see appendix II. We found that FSA generally relies on compliance audits as the only annual on-site review to determine how schools applying for recertification administer federal student aid. The audits provide direct information collected by independent auditors from school visits and file reviews examining how schools administer federal student aid and comply with program requirements. For example, OIG audit guidance directs auditors to check whether schools are distributing federal student aid to eligible students and accurately calculating student loan amounts. FSA officials and staff from all four of our selected regional offices said that compliance audits are a key source of information they use to assess a school’s administrative capability. Officials from Education’s OIG said that the quality of information in compliance audits varies substantially and depends on the auditor. The OIG has found quality problems in some of the compliance audits it selects—based on auditor and school risk factors—for its annual quality control reviews. Because the OIG selects higher risk audits to review, its reviews are more likely to detect problems, and OIG officials said they cannot make any conclusions about the overall prevalence of quality problems in compliance audits. However, our analysis of OIG quality review data found that of the 739 compliance audits reviewed by the OIG from fiscal years 2006 through 2017, the OIG passed 23 percent (173) and failed 59 percent (436). An additional 18 percent (130) passed with deficiencies. For example, across the 41 compliance audits it reviewed in fiscal year 2016, the OIG identified 264 quality deficiencies with the auditor’s work, according to our analysis of quality reviews provided by the OIG. The most frequently cited issues in these 41 audits were: reporting (24 audits), such as lack of evidence that the auditor tested whether the school correctly reported student enrollment status; student eligibility (20 audits), such as lack of evidence that the auditor verified student school attendance; and administrative capability (19 audits), such as lack of evidence that the auditor determined whether the accreditor had been notified about a change in school ownership within 10 days. FSA officials also identified quality issues with the compliance audits of some schools. FSA headquarters officials and staff we interviewed in several regional offices said they have seen schools with significant program review findings that had not been identified in annual compliance audits. FSA staff said they have referred some compliance audits to the OIG for quality reviews when they have had questions about the thoroughness of an audit. We also found a couple of examples in our review of school certification documents in which the findings identified in a school’s compliance audit were different from the findings identified by FSA in a program review of the same school covering the same time period. In one case, FSA staff said they probably would have fully recertified the school if they had relied solely on the compliance audit. Instead, they used the program review to determine that the school should be provisionally recertified. Compliance audits and program review findings are based on a sample of student records, and FSA staff said some differences in findings might be explained by differences in the records reviewed. FSA and OIG officials cited several issues that can affect the quality of compliance audits. FSA and OIG officials we interviewed said that some auditors conducting compliance audits have insufficient training in federal student aid, which contributes to audit quality problems. OIG staff also said that even if an auditor meets the general training hour requirements for auditors, the training content may not be relevant for federal student aid audits. In addition, FSA and OIG officials said some schools— particularly smaller schools—tend to hire less experienced auditors in order to save money, often resulting in poor quality audits. FSA officials in most selected regional offices said that additional training on federal student aid for auditors who are new to or unfamiliar with federal student aid could help improve audit quality. FSA and the OIG recently have taken steps to address audit quality and the information available to FSA staff when making certification decisions. These efforts include: Training for auditors: The OIG has taken steps to enhance training offered to auditors of schools’ administration of federal student aid and is exploring opportunities to provide additional training. In December 2017, the OIG and the American Institute of Certified Public Accountants cosponsored training for auditors on the OIG’s 2016 revised guide for audits of for-profit schools, and other topics related to auditing federal student aid. The training included discussion of common audit quality issues and areas of highest risk. According to an OIG official, about 200 auditors attended, and after the event, the American Institute of Certified Public Accountants and the OIG posted a recording of the training to their websites to make it available to additional auditors. In addition, OIG officials said they maintain an email account—listed on the OIG website—through which auditors can ask questions and receive responses. In March 2018, the OIG posted frequently asked questions and answers to the website. Timeliness of OIG quality reviews: Both FSA and OIG officials said that the OIG has recently renewed efforts to issue compliance audit quality reviews more quickly, after several years in which staffing shortages and other issues led to some delayed quality reviews. Guidance to schools on selecting an auditor: OIG officials said that at the 2017 FSA training conference for school financial aid staff, they presented to more than 400 participants about factors schools should consider when hiring an auditor. For example, they suggested that schools verify the licenses of certified public accountants, ask about the types of engagements an auditing firm has conducted, request and check references, check for any actions that may have been taken against a firm, and ask whether the auditor has been subject to a previous review by the OIG or another agency. FSA officials said they expected to invite the OIG to present at future FSA conferences, and OIG officials said they were seeking additional opportunities to share information on auditor selection with schools, including a planned presentation to an association of postsecondary schools. FSA working group: FSA recently established a working group to update its guidance to FSA staff on how to coordinate with the OIG to address compliance audits with quality problems. Among other topics, the working group has consulted with the OIG about how schools are made aware of the OIG’s findings regarding the quality of their audits. FSA officials said that OIG officials have provided input and feedback on FSA’s proposed changes to the guidance. Audit guide revisions: In addition, OIG and FSA staff told us they expected the OIG’s 2016 revisions to the for-profit school audit guide to improve the quality of compliance audits for those schools. They said that because the revised guide clarified some issues that were confusing to auditors in the previous guide issued in 2000, auditors might be better able to implement the guidance. The audit guide revisions include more testing and reporting requirements, clarified procedures, and guidance on issues such as fraud reporting and coordinating financial and compliance audits. The 2016 revisions first applied to audits for fiscal years beginning after June 30, 2016, and FSA began receiving those audits at the end of 2017. In addition, although the OIG’s 2016 revisions only apply to audits of for-profit schools, FSA officials said they planned to establish a working group to consider improvements to audit guidance for public and nonprofit schools. FSA and OIG efforts to address audit quality could help ensure that compliance audits provide accurate and reliable information on school administrative capability for Education’s recertification decisions. We provided a draft of this report to Education for review and comment. Education’s Office of Inspector General provided technical comments, which we considered and incorporated as appropriate. Education did not provide other comments on the report. We are sending copies of this report to the appropriate congressional committees; the Secretary of Education; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (617) 788-0534 or emreyarrasm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. In addition to the contact named above, Michelle St. Pierre (Assistant Director), Kristy Kennedy (Analyst-in-Charge), Edward Bodine, Marissa Jones, and Mark Ward made significant contributions. Also contributing to this report were Susan Aschoff, Deborah Bland, Nagla’a El-Hodiri, Monika Gomez, Sheila R. McCoy, Jessica Orr, Mimi Nguyen, John Mingus, Rhiannon Patterson, Monica Savoy, Benjamin Sinoff, and Rosemary Torres Lerma.

Answer: Education provided over $122 billion in grants, loans and work study funds to help students pay for college at about 6,000 schools in fiscal year 2017. Education is responsible for certifying that these schools are eligible for and capable of properly administering federal student aid funds. Schools are required to submit an annual compliance audit that provides information on schools' administrative capability, which Education considers in its school certification decisions. GAO was asked to review Education's process for certifying schools to receive federal student aid. This report examines (1) how Education certifies schools to administer federal student aid and how frequently schools are approved and denied certification; and (2) the role of compliance audits in the certification process and what, if any, steps Education has taken to address the quality of the audit information. GAO analyzed data on school certification outcomes for calendar years 2006-2017 (when GAO determined data were most reliable); reviewed data and reports summarizing Education's reviews of compliance audit quality for fiscal years 2006-2017; reviewed a non-generalizable sample of 21 school certification decisions from fiscal years 2015 and 2016, selected for a mix of decisions, school characteristics, and geographic regions; examined relevant federal laws, regulations, policy manuals and guidance; and interviewed Education officials. The Department of Education (Education) is responsible for evaluating a variety of information to determine whether a postsecondary school should be certified to administer federal student aid programs, and agency data show that it approves most schools that apply. Education procedures instruct regional office staff to review school policies, financial statements, and compliance audits prepared by independent auditors, among other things. Education can certify schools to participate in federal student aid programs for up to 6 years, or it can provisionally certify them for less time if it determines that increased oversight is needed—for example, when a school applies for certification for the first time or when it has met some but not all requirements to be fully certified. In calendar years 2006 through 2017, Education fully or provisionally approved most schools applying for initial or recertification to receive federal student aid (see figure). Note: Schools applying for certification for the first time and approved are placed in provisional certification. In deciding whether to certify schools, Education particularly relies on compliance audits for direct information about how well schools are administering federal student aid, and Education's offices of Federal Student Aid and Inspector General have taken steps to address audit quality. The Inspector General annually selects a sample of compliance audits for quality reviews based on risk factors, such as auditors previously cited for errors. In fiscal years 2006 through 2017, 59 percent of the 739 selected audits received failing scores. Audits that fail must be corrected; if not, the school generally must repay federal student aid covered by the audit. Because higher risk audits are selected for review, Inspector General officials said they cannot assess the overall prevalence of quality problems in compliance audits. These two Education offices have taken steps to improve audit quality. For example, the Inspector General offered additional training to auditors on its revised 2016 audit guide and provided guidance to schools on hiring an auditor, while Federal Student Aid created a working group to strengthen its procedures for addressing poor quality compliance audits. Education's efforts to address audit quality could help ensure that these audits provide reliable information for school certification decisions. GAO is not making recommendations in this report.