HOUSTON COMMUNITY COLLEGE

Internal Audit Plan

Fiscal Year 2025

Approved by Board of Trustees August 21, 2024

Internal Audit Plan Fiscal Year 2025
Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (IA) will conduct during fiscal year 2025. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act. Time is built into the Plan for IA to be responsive to board and management concerns.
A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2025. The plan includes time for reviewing the integrity and validity of assessments and information provided on the top 10 risks identified in HCC’s ERM Assessment.

Plan Development Methodology

The HCC audit universe is developed through HCC’s ERM Assessment Program (239 risks assessed). The High Risk Audit Candidates are updated in Attachment I based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (22 interviews), 3) consultants use
4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) 2024 KPMG Internal Audit Key Risk, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan includes some hours for transitioning to the new Global Internal Audit Standards that go into effect in January 2025.
Internal Audit Available Time
Total Hours (7 staff * 260 days *8 hours)	14,560	100%	
Less: Staff Vacancies	0	0%	
Estimated Vacation, Holiday, Sick, and Other	2,968	20%	
Training	840	6%	
Various Meetings & Departmental Administration	2,660	18%	
Total Hours Available for Audits & Other Projects	8,092	56%	
Description of Project Types

Operational: These are projects in which some activity or other management assertion is evaluated so that improvements to operating efficiency and effectiveness can be made. These can also be projects in which the object is to develop new information on an activity so that management can use that information in their decision-making process.
Compliance: Reviews focused on ensuring compliance with regulations and HCC policies.
Advisory Services: Consulting projects that improve management of risks, add value, and improve the organization’s operations, including special projects requested by the Board or management, participating in HCC committees and task forces, and providing investigation services.
Administrative: Administrative projects within the department such as performing enterprise risk assessments, preparing the next fiscal year’s audit plan, performing quality assurance, preparing the Annual Audit Report, newsletters, and lunch & learns.
Observation action plan follow-ups: These are on-going status reviews on the resolution of deficiencies identified in past audits to ensure management completed action plans.

FY 2025 Internal Audit Plan
No.	Project	Description	Hours	
Operational Audit Projects	
24-O-2	*Student Mental Health	Review HCC's program for addressing student mental health issues, BITAT processes, and plans to address Human Trafficking risk mitigation.	480	
25-O-1	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery including compliance with regulations and HCC policies.
Additionally, IA will attend and observe the annual disaster recovery exercise.	480	
25-O-2	IT Systems Audit	Review HCC IT systems access. Employee offboarding will be a focus. An effective offboarding process is important for several reasons including: ensuring that access to HCC systems, data, and physical assets (like laptops or building access cards) is promptly revoked, significantly reducing the risk of unauthorized access and potential security breaches. Patch levels for systems will also be reviewed.	640	
Compliance Audit Projects	
23-C-2	*Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures. The new regulations are effective March 2025.	480	
23-C-3	*Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures. The new rules were to be effective August 1, 2024; however, lawsuits in progress will affect some of the provisions from going into effect.	480	
25-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews.	320	
25-C-1-1	Northwest College	Safety & environmental legal policy compliance.	240	
25-C-1-2	Southeast College	Safety & environmental legal policy compliance.	240	
25-C-1-3	Southwest College	Safety & environmental legal policy compliance.	240	
25-C-2	Procurement Processing	Review the process propriety and for compliance with government regulations and HCC policies.	640	
25-C-3	Payments Processing	Review the process propriety and for compliance with government regulations and HCC policies.	640	
Advisory Services Projects	
25-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice.	240	
25-S-2	Special Projects & Examinations	Responsive to provide services as required.	240	
25-S-3	ERM Top 10 Risks Baseline Assessment	Review for integrity and validity of assessments and information.	640	
25-S-3-1	Enrollment & Funding Model			
25-S-3-2	Campus Security			
25-S-3-3	IT Systems Access/Cyber Security/Data Recovery			
25-S-3-4	Deferred Maintenance			
25-S-3-5	Post Pandemic "New Normal"/competition/ Changing market			
25-S-3-6	Title IX/VAWA/SB 212/SB 17			
25-S-3-7	Minors on Campus			
25-S-3-8	Behavioral Intervention & Threat Assessment			
25-S-3-9	Website Accessibility (Section 508)			
25-S-3-10	Policing			

FY 2025 Internal Audit Plan (Cont’d)

No.	Project	Description	Hours	
Administrative Projects	
25-A-1	FY 2026 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning.	720	
25-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement.	320	
25-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA.	320	
25-A-4	FY 2025 Annual Audit Report	Compile and prepare State required annual audit report.	40	
25-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans.	80	
25-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	160	
25-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	80	
25-A-8	Global Internal Audit Standards Transition	IA transitioning to the new Institute of Internal Auditors “Global Internal Audit Standards” that are effective January 2025.	80	
Observation Action Plan Follow-ups	
25-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	292	
* Carry-over/continued projects from FY 2024 Internal Audit Plan	

Attachment I

FY 2025
High Risk Audit Candidates

Risk Category	Risk Area	Risk Factors	Internal & External Audit and  Consultant Coverage	

Financial	

Enrollment & Funding Model	
New state funding model based on “Credentials of Value”. Decline in enrollment, increased tuition discounting reducing income, competitive market for students increasing cost to attract students, increasing costs to support student success.	24-S-2-3 State Funding & Student Enrollment Information
20-O-1 Enrollment Trellis Foundation Huron Consulting Kennedy & Company	

Public Safety	

Campus Security & Safety	Campus safety standards, door locking (classrooms and exterior), new hire security/emergency response training, responsibility for interior routine security, staffing of remote/low utilization areas, operating hours, open campus access, student and employee badging enforcement, campus safety committees, surveillance
camera standards, access, usage, intra building communication systems.	24-S-2-2 Security Program Dashboard Updates Berkeley Research Group –
security & safety program review 19-S-3 Campus Security	

Technology	

IT Systems Access/ Cyber Security/ Data Recovery	

System access privileges (initial, change in person's status, terminations), access security (user id/password/biometric), security, policy, performance audit/review, application across platforms, ease of use.	24-O-1 IT Disaster Recovery Rapid 7 – pen testing
23-C-2 PCI Data Security Standard 22-O-2 IT Cyber & Data Security and Governance
22-O-3 IT Disaster Recovery 21-O-2 IT Active Directory & Windows Server
19-O-3 IT Disaster Recovery-BCP 18-O-3 PS Applications Controls
17-3 IT Cyber and Data Security	

Financial	

Deferred Maintenance	

Identification/prioritization of maintenance, adequate budget, efficient maintenance/preventative maintenance program, maintenance tracking/reporting.	22-O-1 Deferred Maintenance 2019 Jacobs Engineering Facilities Assessment
24-S-2-4 Facilities and Property Information
AGCM - construction project management	

Students	
Post Pandemic “New Normal”/Competition/ Changing Market	Pandemic impact on education. Response to competition (for-profit universities, foreign universities, on-line learning, accelerated learning, curriculum enhancements, improved facilities, high schools and two-year colleges, etc.), appreciation/adjustment to educational
competitors from various sectors and directions, institutional need for clear differentiation, a demonstrable value proposition, organizational	24-S-2-7 Annual THECB Analysis 20-O-1 Enrollment
Trellis Foundation Huron Consulting Kennedy & Company	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and  Consultant Coverage	
		flexibility, financial strength, ability to overcome procedural inertia/inward focus/market insensitivity, growing interest in education in the trades, short-term intensive training (boot camps). Changing demographics (population of target age groups), strong competition for students by other institutions; veterans, marketing/outreach to potential applicants, admissions/enrollment process, academic advising, counseling services, availability of courses/affordable
housing, location as an impediment (urban vs suburban/rural, region, etc), need for CRM, and AI.		

Gender-Related Issues	

Title IX/ VAWA/ SB 212/SB 17	

Title IX compliance, sexual assault, equal athletic opportunity for men/women in sports. Efforts to combat sexual assault by creating new cultural norms on campus. Applicability to events "off campus" or involving individuals not part of the campus community. Dept. of Education exemptions to religious institutions. SB 212 mandatory reporting requirements. SB 17 new state DEI regulations compliance.	24-S-2-6 Complaints Grievance Process Information
24-C-2 SB 17
23-C-3 Title IX New Regulations THECB HB-1735 review
21-C-4 Title IX New Regulations 21-C-5 SB 212
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory Acts Compliance	

Public Safety	

Minors on Campus	Identifying minors on campus in formal and informal programs, early college, or as guests (outreach programs, athletics, camps, summer programs, faculty guests, etc.). Injury in hazardous environments such as laboratories, Inappropriate or lack of supervision; Legally
required mandatory reporting of specified events and related training of some or all institution employees.		

Students	Behavioral Intervention & Threat Assessment	Behavioral Intervention Teams, Management of Student Misconduct, Threat identification and follow up. Plans to address Human Trafficking risk mitigation.	24-O-2 Student Mental Health 19-O-1 Student Behavioral Intervention	
Local, State and Federal Regulation	Website Accessibility (Section 508)	Section 508 (TAC 213) compliance, maintenance of posted materials, training of faculty and staff on accessibility standards, 3rd party
vendor compliance and monitoring, section 508 grievance process, 508 coordinator, classroom software/display/technology accessibility.	19-C-2 Web Content Accessibility Guidelines (implementing CR2 REGULATION and OCR
Agreement)	

Community	

Policing	Firearms, arrest authority, coordination between College and local police, training (diversity, crowd control), oversight and external review, undercover work, campus versus community policing, prisoner control, confiscated property control, community outreach and education, timely and appropriate call response, adequate staff,
"blue phones," incident reporting, statistics capture and reporting, communication and communication media.	Clery Reports Berkeley Research Group –
security & safety program review 19-S-3 Campus Security
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory
Acts Compliance