To ensure compliance with  FCC rules, USAC has periodically selected beneficiaries to audit. For our review of the design of E-rate’s internal control structure, we  classified the control activities into three broad areas: (1) processing  applications for discounted service and making funding commitment  decisions, (2) processing invoices requesting reimbursement, and (3)  monitoring the effectiveness of internal controls through audits of schools  and libraries. We found that FCC and USAC have established a number of  internal controls in each of these three areas. Processing Applications and Making Funding Commitment Decisions

E-rate’s internal control structure centers around USAC’s complex,  multilayered, Program Integrity Assurance (PIA) application review  process. This increasing complexity, in turn, has led USAC to expand the E-rate  program’s internal control structure over time to address program  complexity and to address risks to the program as they became apparent. Although USAC has performed financial reporting and fraud risk  assessments, USAC has not conducted a robust risk assessment of the E- rate program and, consequently, may not be efficiently using its resources  to reasonably target program risks. This internal  control structure, however, was not designed on the basis of a robust risk  assessment of the E-rate program. To date, FCC has not directed USAC to undertake a robust  risk assessment that would involve a critical examination of the entire E- rate program to determine whether modifications to business practices  and internal controls are necessary to cost-effectively address  programmatic risks. Automated Invoice Review Process May Not Appropriately Target Risk

The internal control structure around the E-rate invoicing process is more  limited than the structure around the application review process, but it is  again not clear that the controls in place appropriately target risks. Audit Findings Are Not Effectively Considered in Assessing Internal Controls of the E-rate Program

Although FCC and USAC use the results of beneficiary audits to identify  and report beneficiary noncompliance, they have not effectively used the  information gained from audits to assess and modify the E-rate program’s  internal controls. Of those 64 beneficiaries, 36 had repeat audit findings of the  same program rule violation, such as those that we previously mentioned,  in each of the audited years. We also found that FCC and USAC do not have documented and approved  policies and procedures for the beneficiary audit process. Policies and procedures could also contribute positively  to a systematic process for considering audit results when assessing the  program’s internal controls and in identifying opportunities for  modifications to existing controls. Recommendations for Executive Action

To improve internal controls over the E-rate program, we recommend that  the Federal Communications Commission take the following four actions:    conduct a robust risk assessment of the E-rate program;    based on the findings of the risk assessment, conduct a thorough  examination of the overall design of E-rate’s internal control structure to  ensure that the procedures and administrative resources related to  internal controls are aligned to provide reasonable assurance that program  risks are appropriately targeted and addressed; implement a systematic approach to assess internal controls that  appropriately considers the results of beneficiary audits and that is  supported by a documented and approved set of policies and procedures;  and   develop policies and procedures to periodically monitor the internal  control structure of the E-rate program, including evaluating the costs and  benefits of internal controls, to provide continued reasonable assurance  that program risks are targeted and addressed. In its written comments, FCC agreed with our recommendations. (2) Does the design of the E-rate program’s internal  control structure appropriately consider program risks? Specifically, we  reviewed the design of the program’s key internal controls for (1)  processing applications and making funding commitments, (2) processing  invoices requesting reimbursement, and (3) monitoring the effectiveness  of internal controls through audits of schools and libraries. A comprehensive  assessment focused on the E-rate program would consider the existing  design of the E-rate program as a whole, including the roles of FCC,  USAC, beneficiaries, and service providers; whether the design and  mix of preventive and detective controls already in place for the E-rate  program are appropriate; and whether the program lacks internal  controls that are needed.
Why GAO Did This Study

Since 1998, the Federal Communications Commission's (FCC) Schools and Libraries Universal Service Support Mechanism--commonly known as the "E-rate" program--has been a significant federal source of technology funding for schools and libraries. FCC designated the Universal Service Administrative Company (USAC) to administer the program. As requested, GAO examined the system of internal controls in place to safeguard E-rate program resources. This report discusses (1) the internal controls FCC and USAC have established and (2) whether the design of E-rate's internal control structure appropriately considers program risks. GAO reviewed the program's key internal controls, risk assessments, and policies and procedures; assessed the design of the internal control structure against federal standards for internal control; and interviewed FCC and USAC officials.

What GAO Found

FCC and USAC have established many internal controls for the E-rate program's core processes: (1) processing applications and making funding commitment decisions, (2) processing invoices requesting reimbursement, and (3) monitoring the effectiveness of internal controls though audits of schools and libraries that receive E-rate funding (beneficiaries). E-rate's internal control structure centers around USAC's complex, multilayered application review process. USAC has expanded the program's internal control structure over time to address the program's complexity and to address risks as they became apparent. In addition, USAC has contracted with independent public accountants to audit beneficiaries to identify and report beneficiary noncompliance with program rules. The design of E-rate's internal control structure may not appropriately consider program risks. GAO found, for example, that USAC's application review process incorporates a number of different types and levels of reviews, but that it was not clear whether this design was effectively and efficiently targeting resources to risks. Similarly, GAO found no controls in place to periodically check the accuracy of USAC's automated invoice review process, again making it unclear whether resources are appropriately aligned with risks. While USAC has expanded and adjusted its internal control procedures, it has never conducted a robust risk assessment of the E-rate program's core processes, although it has conducted risk assessments for other purposes, such as financial reporting. A risk assessment involving a critical examination of the entire E-rate program could help determine whether modifications to business practices and the internal control structure are needed to appropriately address the risks identified and better align program resources to risks. The internal control structure--once assessed and possibly adjusted on the basis of the results of a robust risk assessment--should then be periodically monitored to ensure that the control structure does not evolve in a way that fails to appropriately align resources to risks. The results of beneficiary audits are used to identify and report on E-rate compliance issues, but GAO found that the information gathered from the audits has not been effectively used to assess and modify the E-rate program's internal controls. As a result, the same rule violations have been repeated each year for which beneficiary audits have been completed. For example, of 64 beneficiaries that had been audited more than once over a 3-year period, GAO found that 36 had repeat audit findings of the same rule violation. GAO found that the current beneficiary audit process lacks documented and approved policies and procedures. Without such policies and procedures, management may not have the assurance that control activities are appropriate and properly applied. Documented and approved policies and procedures could contribute positively to a systematic process for considering beneficiary audit findings when assessing the E-rate program's internal controls and in identifying opportunities to modify existing controls.

What GAO Recommends

GAO recommends that FCC conduct a robust risk assessment of the E-rate program, conduct a thorough examination of the overall design of E-rate's internal control structure, implement a systematic process to assess internal controls that appropriately considers beneficiary audit findings, and establish procedures to periodically monitor controls. FCC agreed with GAO's recommendations.