Are some U.S. schools fraudulently certifying that their foreign students are currently enrolled and attending classes?
We previously reported on fraud in the Student and Exchange Visitor Program such as "sham" schools that help students get visas to live in the U.S. without requiring that they attend classes. In some cases these "sham" schools have included major fraud schemes involving hundreds of students. This could damage the integrity of the program.
Raid on a Fraudulent Student and Exchange Visitor Program School
Photo of a policeman entering an office with a sign on the door that says "Prodee University."
What GAO Found
The Department of Homeland Security's (DHS) U.S. Immigration and Customs Enforcement (ICE) has identified several fraud risks to the Student and Exchange Visitor Program (SEVP). As shown in the figure below, these include risks associated with school owners and designated school officials (DSO) who help ICE oversee students in the program. These fraud risks may occur as schools apply to become SEVP-certified, accept foreign students, and apply for recertification every 2 years.
Key Areas of Potential Fraud in the Student and Exchange Visitor Program (SEVP)
ICE has implemented controls to address fraud risks related to school certification, but long-standing delays in recertifying these schools exacerbate fraud risks. By statute and regulation, ICE must conduct recertification reviews every 2 years to ensure that schools continue to meet program requirements—an important fraud risk control. Between 2013 and 2017, ICE recertified about 12,900 schools. However, according to ICE officials, they have been unable to meet the 2-year time frame and, as of June 2018, had 3,281 recertification petitions waiting for review. To help manage its queue, ICE has lengthened the period between recertification reviews by extending schools' certification expiration dates by 180 days, which is inconsistent with its regulation and may allow fraudulent schools to operate longer without detection. Although ICE is taking steps to increase resources for recertification, it is unclear whether these steps will ensure recertification is conducted consistently with ICE regulations.
ICE relies on DSOs to, among other things, update and maintain foreign-student data in ICE's foreign-student information system and report suspected fraud to ICE. However, ICE does not provide DSOs with training that addresses fraud risks to the program. In June 2018, ICE officials stated that they plan to develop this fraud training for DSOs, but do not have documented plans or timelines for when it would be completed. By developing these plans, the agency would be better positioned to ensure that DSOs receive the training needed to address potential fraud in the program.
Why GAO Did This Study
As of March 2018, more than 1.2 million foreign students in the United States were enrolled in 8,774 schools certified by SEVP. ICE is responsible for managing SEVP, which certifies schools to enroll foreign students. Various ICE offices have a role in preventing, detecting, and responding to potential fraud in the program. GAO was asked to review potential vulnerabilities to fraud in SEVP. GAO examined, among other things, the extent to which ICE (1) implemented controls to address fraud risks in the school certification and recertification processes and (2) implemented fraud risk controls related to DSO training.
GAO analyzed ICE policies and documentation, including fraud risk guidance and procedures for school certification and recertification; analyzed 2013 through 2017 recertification data; and interviewed officials from five ICE field offices that GAO selected based on their experience investigating program fraud. GAO also interviewed officials from 17 selected schools located near these ICE field offices. This is a public version of a sensitive report that GAO issued in November 2018. Information that DHS deemed sensitive has been omitted.
GAO is making seven recommendations, including that ICE (1) notify schools 180 days prior to the 2-year certification expiration date, as required, and evaluate whether additional resources for recertification are needed, and (2) develop a plan to implement fraud-specific training for DSOs. ICE concurred with all of GAO's recommendations.
Recommendations for Executive Action
|United States Immigration and Customs Enforcement||1. The Director of ICE should develop a fraud risk profile that aligns with leading practices and (1) identifies inherent fraud risks affecting the program, (2) assesses the likelihood and impact of inherent fraud risks, (3) determines fraud risk tolerance, and (4) examines the suitability of existing fraud controls and prioritizes residual fraud risks, including residual risks posed by the recertification queue. (Recommendation 1)|
|United States Immigration and Customs Enforcement||2. The Director of ICE should build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. (Recommendation 2)|
|United States Immigration and Customs Enforcement||3. As ICE works to complete its efforts to hire additional SEVP adjudicators, the Director of ICE should begin notifying certified schools 180 days prior to, and requiring submission of complete recertification petitions by, the 2-year certification expiration date, consistent with regulation, and evaluate whether additional resources are needed. (Recommendation 3)|
|United States Immigration and Customs Enforcement||4. The Director of ICE should, as practicable, verify the eligibility information provided to establish the immigration or citizenship status of lawful permanent residents and naturalized U.S. citizens, as well as U.S.-born citizens, who have been nominated or renominated to serve as DSOs. (Recommendation 4)|
|United States Immigration and Customs Enforcement||5. The Director of ICE should develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. (Recommendation 5)|
|United States Immigration and Customs Enforcement||6. The Director of ICE should implement mandatory DSO training and verify that the training is completed. (Recommendation 6)|
|United States Immigration and Customs Enforcement||7. The Director of ICE should complete the development and implementation of its plans for mandatory fraud-specific training for DSOs. (Recommendation 7)|