As of March 2018, more than 1.2 million foreign students in the United States were enrolled in 8,774 schools certified by the Student and Exchange Visitor Program (SEVP). The U.S. Immigration and Customs Enforcement (ICE) is responsible for managing SEVP, which certifies schools to enroll foreign students. Various ICE offices have a role in preventing, detecting, and responding to potential fraud in the program. GAO was asked to review potential vulnerabilities to fraud in SEVP. GAO examined, among other things, the extent to which ICE (1) implemented controls to address fraud risks in the school certification and recertification processes and (2) implemented fraud risk controls related to DSO training. GAO analyzed ICE policies and documentation, including fraud risk guidance and procedures for school certification and recertification; analyzed 2013 through 2017 recertification data; and interviewed officials from five ICE field offices that GAO selected based on their experience investigating program fraud. The Department of Homeland Security's (DHS) U.S. Immigration and Customs Enforcement (ICE) identified several fraud risks to the Student and Exchange Visitor Program (SEVP). ICE has implemented controls to address fraud risks related to school certification, but long-standing delays in recertifying these schools exacerbate fraud risks. By statute and regulation, ICE must conduct recertification reviews every 2 years to ensure that schools continue to meet program requirements-- an important fraud risk control. Between 2013 and 2017, ICE recertified about 12,900 schools. However, according to ICE officials, they have been unable to meet the 2-year time frame and, as of June 2018, had 3,281 recertification petitions waiting for review. To help manage its queue, ICE has lengthened the period between recertification reviews by extending schools' certification expiration dates by 180 days, which is inconsistent with its regulation and may allow fraudulent schools to operate longer without detection. GAO is making seven recommendations, including that ICE (1) notify schools 180 days prior to the 2-year certification expiration date, as required, and evaluate whether additional resources for recertification are needed, and (2) develop a plan to implement fraud-specific training for DSOs. ICE concurred with all of GAO's recommendations.