	Grant and Loan Payments Lacked Certain Edit Checks and Other Key Controls

Education disburses grant and loan payments by electronic funds transfer and processes these payments in GAPS. We found that Education’s student aid application processing system lacks an automated edit check that would identify students that were much older than expected. These tests included searches for a single SSN associated with two or more dates of birth, grants to recipients in excess of statutory limits, and searches for invalid SSNs. During our analysis of the third party draft payment process, we identified several internal control weaknesses, including inadequate computer systems application controls, poor segregation of duties, and inadequate audit trails. Specifically, as we discussed in our April 3, 2001, testimony, Education (1) circumvented a system’s application control designed to avoid duplicate payments by adding a suffix to the invoice/voucher number when the system indicates that an invoice/voucher number has already been used; (2) allowed 21 of the 49 Education employees who could issue third party drafts to do so without involving anyone else; and (3) lacked adequate audit trails, such as a trigger log, to identify changes made to the list of approved vendors. During our analysis of the purchase card payment process, we identified internal control weaknesses, including inadequate computer systems application controls, lack of supervisory review, and improper authorization of transactions. Based on these weaknesses and information gathered from Education IG reports, we designed tests to identify potentially improper payments made with government purchase cards.
Why GAO Did This Study

GAO and the Department of Education's Office of Inspector General have issued many reports in recent years on the Department's financial management problems, including internal control weaknesses that put the Department at risk for waste, fraud, abuse, and mismanagement. In an April 2001 assessment of the internal control over Education's payment processes and the associated risks for improper payments, GAO identified four broad categories of internal control weaknesses: poor segregation of duties, lack of supervisory review, inadequate audit trails, and inadequate computer systems' applications controls. This testimony discusses how these weaknesses make Education vulnerable to improper payments in grant and loan payments, third party drafts, and government purchase card purchases.

What GAO Found

GAO found that Education's student aid application processing system for grants and loans lacks an automated edit check that would identify potentially improper payments from students who were much older than expected, a single social security number associated with two or more dates of birth, grants to recipients in excess of statutory limits, and searches for invalid social security numbers. GAO also found problems with Education's third party draft system. Specifically, Education (1) circumvented a system's application control designed to avoid duplicate payments by adding a suffix to the invoice/voucher number when the system indicates that an invoice/voucher number has already been used; (2) allowed 21 of the 49 Education employees who could issue third party drafts to do so without involving anyone else; and (3) lacked adequate audit trails, such as a trigger log, to identify changes made to the list of approved vendors. GAO also found shortcomings with Education's internal controls over government purchase cards.