On December 9, 2008, the U.S. Department of Education (Department) published in the Federal Register (73 FR 74805) final regulations amending the Family Educational Rights and Privacy Act (FERPA). The Department did not include in the final regulations proposed amendments concerning the disclosure of education records without consent to State auditors. We are seeking further public comment to help us develop guidance or new regulations on the issue, and will provide guidance on a case-by-case basis in the interim.

Background. The Notice of Proposed Rulemaking (NPRM), 73 FR 15573 (March 24, 2008), proposed to establish in § 99.35(a)(3) that "State auditors" may have access to education records, without consent, in connection with an "audit" of Federal or State supported education programs under the exception to the written consent requirement for authorized representatives of "State and local educational authorities." See 34 CFR §§ 99.31(a)(3)(iv) and 99.35. In the NPRM, we proposed to define the term "State auditor" broadly, in § 99.3, as "a party under any branch of government with authority and responsibility under State law for conducting audits." The NPRM also proposed that the term "audit" in § 99.35(a)(3) would be limited to "testing compliance with applicable laws, regulations, and standards." The proposed regulations were consistent with previous guidance issued by the Family Policy Compliance Office (FPCO), which is available on its website at http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/univak052305.html.

Commenters supported including State auditors under the "audit or evaluation" exception in FERPA. However, all but one of the commenters on this proposed change disagreed strongly with the proposed definition of "audit" because it did not include the broader concept of evaluations. In general, the commenters said that this definition was too narrow and would prevent State auditors from conducting performance audits (i.e., evaluations of program efficiency and effectiveness) and other services that they routinely provide in accordance with professional auditing standards, including the U.S. Comptroller's Government Auditing Standards (GAGAS). See www.gao.gov/govaud/ybk01.htm.

Legislative history indicates that Congress amended the statute in 1979 to "correct an anomaly" in which the existing exception to the consent requirement for "State educational authorities" in 20 U.S.C. § 1232g(b)(3) was interpreted to preclude State auditors from obtaining access to education records for audit purposes. See preamble to the NPRM (73 FR 15577). The amendment is ambiguous, however, because the amended statutory language in 20 U.S.C. § 1232g(b)(5) refers only to "State and local educational officials"; therefore, the proposed regulations sought to clarify that this exception includes "State auditors." Due to the breadth of this inclusion, however, the proposed regulations also sought to limit access to education records by State auditors by narrowing the definition of "audit."

Discussion. As explained in the preamble to the final regulations (73 FR 74812), we share the commenters' concerns about preventing State auditors from conducting activities that they routinely perform under applicable auditing standards. However, without the narrow definition of "audit" as proposed in § 99.35(a)(3), we are concerned about the potential breadth of the term "State auditor," particularly given the ambiguous nature of the statutory support for these disclosures, which we discussed in the NPRM, and the lack of detail in legislative history explaining which among many possible officials, offices, committees, and staff in executive and legislative branches of State government should be considered "State auditors." These include officials with titles such as State Auditor; Auditor General; State Comptroller or Controller; State Treasurer; Legislative Auditor; Examiner of Public Accounts; Legislative Program Evaluation Office; Department of Public Finance and Administration; State Board of Accounts; Chief Financial Officer; Office of Treasury & Fiscal Services; Legislative Services Agency; Legislative Budget Office; Senate Post Audit & Oversight Committee; Sunset Advisory Commission; and Secretary of State – Audit Division. We note that some States do not have an official or office with the title "State Auditor," and certain "audit" functions (including performance audits under GAGAS) are performed by other offices, such as the State Comptroller, the Comptroller of the Treasury, or the Department of Legislative Audit.

We note further that the range of functions and responsibilities assigned to these officials and offices varies considerably and may include: acting as general accountant for the State; keeping track of all fund and appropriation balances of all State agencies; acting as disbursing officer for various funds; paying the State's bills and employees; conducting post-audits of all financial transactions and accounts kept by State government agencies, or all State government agencies except the legislature; performing the State's annual "Single Audit" under Federal law; reporting to the governor and/or legislature on all receipts and disbursements and all taxes and revenues collected and paid into the treasury; maintaining records of all State property and assets; determining whether public entities are making wise and effective use of their resources, including public money, personnel, property, equipment, and space; reporting to the legislature potential problems related to the effectiveness and performance of State programs; determining whether State programs should be eliminated; determining whether public entities are complying with applicable laws, regulations, and governmental accounting and financial and reporting standards; defining standards and procedures for accounting and budgeting; conducting financial, compliance, performance, contract, information technology, and investigative audits; assessing security of the State's information technology systems; overseeing audits conducted by independent audit firms of all local government entities; certifying revenue estimates in support of municipal bond issuances; conducting special fraud audits throughout local government as requested; and overseeing expenditures of local governments.

Given this range of offices, titles and functions, we are seeking public comments to help us develop a definition of "State auditor" consistent with the limited legislative history available for the 1979 statutory amendments that allows disclosure of education records without consent to "State and local educational officials" in connection with the audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. Input received will help us formulate future guidance or rulemaking on the matter.

Questions for Public Comment. We invite you to respond to the following specific questions and encourage you to bring any other thoughts and comments on this matter to our attention:

• What official or office is considered the State auditor in your State, what are their responsibilities, and what auditing standards do they follow?
• Does your State have more than one State auditor?
• What functions and responsibilities are unique to the State auditor in your State? For example, is the State auditor the official or office that is solely responsible for the performance of external financial audits on a Statewide basis?
• Do other officials and offices in your State perform any of the same duties as the State auditor? If so, please identify those officials and offices and explain the duties they have in common with the State auditor.
• Do local auditors perform any of the same duties or otherwise support the work of the State auditor? Under what circumstances do local auditors need access to personally identifiable information from education records?
• Which officials and offices in your State should be considered a "State auditor" under the "audit or evaluation" exception in FERPA? Please explain the reasons for your recommendation.
• Should the definition include only State auditors who follow GAGAS, or some other professional auditing standards? Please explain the reasons for your recommendation.
• Which officials and offices should be excluded under your proposed definition and why?
• How should "audit" be defined and why?

Please submit your comments and suggestions on this general topic only to FERPA.Auditor@ED.Gov. Although you will not receive a response to your comments, you are encouraged to provide your name, affiliation, and contact information. For inquiries related to other FERPA topics, please contact FPCO at FERPA@ED.gov.