While Consular Affairs’  controls are consistent with accepted control standards, we found that  some of the controls were not always being followed at the posts we  visited. Internal Controls Are in Place, and Many Are Either New or Have Been Reinforced

To prevent the issuances of nonimmigrant visas to unqualified applicants,  Consular Affairs has strengthened its efforts to limit employee access to  automated systems that issue visas and has taken steps to ensure that visa  applicants cannot predict which officers will interview them. Each  year, posts are required to issue a report certifying their compliance with  internal controls, including routine inventory counts of controlled items,  established referral policies and procedures, and supervisory reviews of  visa refusals and issuances. Internal Controls Not Fully and Consistently Implemented

Consular Affairs has established and reinforced a system of internal  controls, described above, designed to reduce visa malfeasance risks;  however, we found that the controls were not being fully and consistently  implemented. Two posts, for example, reported  reviewing controlled items, but did not note whether they were  reconciled. Documented Cases of Visa Malfeasance

Between 2001 and 2004, Diplomatic Security substantiated through  investigation 28 cases of U.S. employee visa malfeasance that resulted in  various actions. Several factors impede visa malfeasance  investigations, including differences in U.S. and foreign laws, investigative  techniques, and other issues. The  following are examples of visa malfeasance or alleged visa malfeasance  and how lack of strict compliance with internal controls may have been a  contributing factor in creating an environment where the malfeasance  could take place. Established internal controls make it more difficult for an employee to  commit visa malfeasance. State has established a system of internal  controls. Finally, U.S. investigators  cannot obtain a U.S. search warrant to search the offices or residences  overseas of employees, which, according to Justice and Diplomatic  Security officials, affects their ability to gather evidence in malfeasance  cases. Improve State’s existing mechanisms to combat visa malfeasance. This  could be accomplished by (1) improving the software available to the  Vulnerability Assessment Unit to automatically sort data to identify and  analyze abnormalities in post visa issuance statistics that could be an  indication of malfeasance and (2) enhancing the investigative case  tracking systems used by the Bureau of Diplomatic Security in order to  better identify trends and vulnerabilities in the visa process for use by  investigators and consular managers. These data covered 2001 to 2004 because this was  the most recent information available. To determine how State and Justice interact to investigate suspicious  activity and allegations of employee malfeasance, we interviewed officials  from State’s Bureaus of Consular Affairs and Diplomatic Security, and  Justice’s Criminal Division, Public Integrity Section, and the Executive  Office for United States Attorneys.
Why GAO Did This Study

Issuing a U.S. visa to a foreign citizen in exchange for money or something of value is a crime that can facilitate entry into the United States of unqualified persons, including those who may wish to do our country harm. Internal controls make it difficult for an employee to commit visa malfeasance without being detected, but, despite these safeguards, visa malfeasance does occur. GAO examined (1) State's internal controls to prevent nonimmigrant visa malfeasance and if they are being implemented and (2) visa malfeasance cases from 2001-2004 and factors cited by State and the Department of Justice (Justice) that contributed to visa malfeasance and affected investigations and prosecutions.

What GAO Found

State has a set of internal controls to prevent visa malfeasance and has taken actions to improve them; however, these internal controls are not being fully and consistently implemented by the posts we visited. While State's controls are consistent with accepted control standards, we found noncompliance with required supervisory oversight at 6 of the 11 posts we visited. This included failure to inventory items used to issue visas, review visa decisions, and follow State's procedures when issuing visas for applicants referred by officers within the post. Lack of full compliance with internal controls increases vulnerability to visa malfeasance. State recently established two headquarters entities to monitor post visa operations. While stronger oversight should help strengthen compliance with internal controls, State has not developed automated software to sort and analyze abnormalities in visa issuances that could indicate potential malfeasance. The Bureau of Diplomatic Security substantiated 28 visa malfeasance cases between 2001 and 2004 involving U.S. employees. The suspects were fired, chose to resign, or were arrested. State investigators could not tell us how many opened cases were referred to Justice for possible prosecution because they had not been routinely collecting that information. In fact, their case records did not permit investigators to identify malfeasance trends or consular managers to identify internal control weaknesses needing attention. Justice's Public Integrity Section successfully prosecuted 10 U.S. government employees. State Diplomatic Security and Justice officials noted that their investigations and prosecutions were impeded by constraints on evidence gathering. Additionally, investigators can not obtain U.S. search warrants to search consular officer's offices or residences overseas. Justice and State are discussing the possibility of pursuing legal changes and other means to address these constraints.