HOUSTON COMMUNITY COLLEGE

Internal Audit Annual Report Fiscal Year 2023
in Accordance with the Texas Internal Auditing Act

Prepared by Internal Audit Department
Terry Corrigan, Director Internal Audit

Table of Contents

SECTION
Internal Audit Plan for Fiscal Year 2023	I
Quality Assurance Review	II
Summary of Observations & Management Action Plans	III
List of Consulting Engagements and Non-audit Services Completed.	IV
Internal Audit Plan for Fiscal Year 2024	V
External Audit Services – Fiscal Year 2023	VI
Reporting Suspected Fraud and Abuse	VII
Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit
Annual Report, and Other Audit Information on the HCC Website	VIII

Internal Audit Plan for Fiscal Year 2023

The Board of Trustees approved the FY 2023 Internal Audit Plan on August 17, 2022. The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates are updated based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risks and Focus Areas for 2022, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

A FY 2023 Internal Audit Plan Status Report is detailed in the following table.

I

Houston Community College	Internal Audit Annual Report

FY 2023 Internal Audit Plan Status Report

Audit Projects	Project Number	
Stage	Report Issued	
Notes/Issues	
Operational Audit Projects					
*Enrollment	20-O-1	Complete	9/14/2023	Final audit report issued Thursday, 9/14/2023	
*Construction Cost Management	21-O-5	Complete	5/8/2023	Final audit report issued Monday, 5/8/2023	
*Deferred Maintenance	22-O-1	Fieldwork		Roll over to FY 2024 Plan	
*IT Cyber & Data Security and Governance	22-O-2	Complete	9/19/2023	Final audit report issued Tuesday, 9/19/2023	
Asset Management	23-O-1	Reporting		Roll over to FY 2024 Plan; 4 interim reports issued	
Compliance Audit Projects					
*Web Content Accessibility Guidelines Review	19-C-2	Implementing	N/A	On hold - program being established based on ITCA	
*Cares Act - HEERF III	21-C-1	Fieldwork		Roll over to FY 2024 Plan	
Campus Safety & Environmental Operations Management	23-C-1	Complete	N/A	Planning for all three colleges	
Northwest College	23-C-1-1	Complete	5/24/2023	Final audit report issued Wednesday, 5/24/2023	
Southeast College	23-C-1-2	Complete	5/30/2023	Final audit report issued Tuesday, 5/30/2023	
Southwest College	23-C-1-3	Complete	5/25/2023	Final audit report issued Thursday, 5/25/2023	
Payment Card Industry (PCI) Data Security Standard (DSS)	23-C-2	Not Started		Roll over to FY 2024 Plan	
Title IX	23-C-3	Not Started		Roll over to FY 2024 Plan	
Board Expenditures	23-C-4	Complete	1/24/2023	Final audit report issued Friday, 1/24/2023	
Advisory Services Projects					
*Campus Security	19-S-3	Implementing	N/A	On hold - using BRG report to help establish a program	
Committees & Task Forces	23-S-1	N/A	N/A		
Special Projects & Examinations	23-S-2	N/A	N/A		
Administrative Projects					
FY 2024 Audit Planning & ERM Assessment	23-A-1	Complete	8/2/2023	FY2024 IA Plan presented Wednesday, 8/2/2023	
TeamMate IA Management System	23-A-2	Ongoing	N/A	Continuously improving the use of TM+	
Internal Quality Assurance Review	23-A-3	Complete	8/28/2023	Final audit report issued Monday, 8/28/2023	
FY 2023 Annual Audit Report	23-A-4	Complete	10/4/2023	FY2023 annual report presented Wednesday, 10/4/2023	
External Audits Monitoring	23-A-5	Ongoing	N/A		
Lunch and Learns	23-A-6	Ongoing	N/A		
Newsletters	23-A-7	Ongoing	N/A		

I-1

Quality Assurance Review

An external quality assurance review (EQAR) was performed by Basil Woller and Associates (Basil Woller) on the Internal Audit Department in FY 2021, in compliance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards). The review was an independent validation of the assertions and conclusions made in the internal audit report “20-A-3 IA Internal Quality Assurance Review” issued by the HCC’s Internal Audit Department on June 23, 2020. Basil Woller’s report issued May 7, 2021, concurred with the Internal Audit self-assessment, that HCC’s Internal Audit Department generally conforms with the Standards and the IIA Code of Ethics. This level of conformance is the top rating and demonstrates a clear intent and commitment to achieving the Core Principles and the Definition of Internal Auditing.

The HCC Internal Audit Department completed the following quality assurance activities during FY 2023:
Collaborated with the Risk Management Office to update and complete the annual Enterprise Risk Management Assessment for HCC.
An internal quality assurance review was performed.
TeamMate Analytics software is being used to perform data analytics in audit projects based on planning assessments.
Developing an action plan for HCC’s internal audit function to meet the requirements of the new Global Internal Audit Standards that are expected to be published by the Institute of Internal Auditors early 2024 and effective 12 months after publication.
Maintained a professional staff with diversified skill sets and professional certifications.
Completed training to maintain professional certifications and to improve knowledge and understanding required to complete audit projects.

Summary of Observation and Management Action Plans

See the detailed FY 2023 Audit Observations and Management Action Plans Attachment to this report.

List of Consulting Engagements and Non-audit Services Performed

Internal Audit provided a lunch and learn on “Fraud Awareness”. Members of the Internal Audit Department participated on the following councils, task forces, and committees in FY 2023:

Accountability and Standards Council

Strategic Assembly

Internet and Communication Technology and Accessibility Committee

Procurement Contract Evaluation Committees

Candidates for Hiring Screening Committees

Internal Audit Plan for Fiscal Year 2024

The HCC Board of Trustees approved the Fiscal Year 2024 Internal Audit Plan on August 16, 2023.

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (IA) will conduct during fiscal year 2024. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act. Significant time is built into the Plan for IA to be responsive to board and management concerns.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2024.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM) (239 risks assessed). The High Risk Audit Candidates in the plan are based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (23 interviews), 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risk Areas 2023, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan will include some hours for planning for the transition to the new Global Internal Audit Standards that are expected to be published early 2024.

The FY 2024 Internal Audit Plan is detailed in the following table.

Internal Audit Department Fiscal Year 2024 Audit Plan

No.	Project	Description	
Operational Audit Projects	
22-O-1	*Deferred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	
23-O-1	*Asset Management	Review HCC's operating process for safeguarding assets and ensuring compliance with Board and departmental policies and procedures. Completion of Facilities and IT areas	
24-O-1	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery including compliance with regulations and HCC policies. Additionally, IA will attend and observe the annual disaster recovery exercise.	
24-O-2	Student Mental Health	Review HCC's program for addressing student mental health issues, BITAT processes, and plans to address Human Trafficking risk mitigation	
Compliance Audit Projects	
19-C-2	*Web Content Accessibility Guidelines Review
- Follow-up	Review the implementation of CR2 (REGULATION) to ensure that qualified individuals with disabilities have access to the College District’s technology resources	
21-C-2	*Cares Act - HEERF III	Review management process to ensure compliance with terms	
23-C-2	*Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures	
23-C-3	*Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures.	
24-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews	
24-C-1-1	Central College	Safety & environmental legal policy compliance	
24-C-1-2	Northeast College	Safety & environmental legal policy compliance	
24-C-1-3	Coleman College	Safety & environmental legal policy compliance	
24-C-2	SB 17	Review steps taken to comply with new state regulations related to DEI	
Advisory Services Projects	
19-S-3	*Campus Security	Work with all HCC stakeholders in evaluating the implementation of a Campus Security Program	
24-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice	
24-S-2	Special Projects & Examinations	Responsive to provide services as required	
24-S-2-1	New State Funding Model Transition	Monitoring information on plan for transitioning to new state funding model based on "credentials of value"	
24-S-2-2	Security Program Dashboard Updates	Report update on Security Program Dashboard and HCC policy establishment	
24-S-2-3	Student Enrollment Information	Student enrollment projections by program and "credentials of Value" for state funding	
24-S-2-4	Facilities and Property Information	Report on HCC's facilities & properties, including a report on ROC projects and status	
24-S-2-5	Succession Planning Information	Report on HCC's succession planning	
24-S-2-6	Complaints Grievance Process Information	Report on details related to the complaints grievance process	
24-S-2-7	Annual THECB Analysis	Competition benchmarking report using THECB Annual report	
24-S-2-8	Contracted Services Report	Report on contracted services payments	
24-S-2-9	Less Than $100,000 Payments Report	Vendor payments report on under the chancellor’s signatory authority	

V-1

Administrative Projects	
24-A-1	FY 2025 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning	
24-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement	
24-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	
24-A-4	FY 2024 Annual Audit Report	Compile and prepare State required annual audit report	
24-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans	
24-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	
24-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	
24-A-8	Global Internal Audit Standards Transition	IA transitioning to the new Institute of Internal Auditors “Global Internal Audit Standards” expected to be published early 2024	
Observation Action Plan Follow-ups	
24-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	
* Carry-over/continued projects from FY 2023 Internal Audit Plan	

V-2

External Audit Services – Fiscal Year 2023

HCC Procured Services in FY 2023

Texas Mutual Insurance Company – 2022-2023 Workers’ Compensation final audit
Whitley Penn – Annual Financial Statements Audit
Corporate Lounge LLC – review to remove the waste, streamline, and implement best practices in HCC’s direct payment process.
Huron Consulting Group – administrative and academic human resource assessment and student services enrollment review.
Rapid 7 – IT cyber & data security penetration testing

Regulatory Imposed in FY 2023

Weaver engaged by Houston-Galveston Area Council to perform 2022-2023 Financial Monitoring & Billing Review on contracts 213-22 & 213-23.
DOE Emergency Assistance to Institutions of Higher Education FY 2021 OMB circular A-123 C review.
DOE required SACSCOC to confirm its virtual visit findings with an in-person Verification Visit. Visit team follow-up affirmed the information provided during the original visit.
THECB Perkins Basic Grant Desk Review AY 2020-2021
Houston-Galveston Area Council conducted a desk review of HCC’s comprehensive annual financial and single audit reports for FY 2021 and accepted the report.
Texas School Safety Center performed a Fall 2022 Emergency Operations Plan (EOP) Review. HCC’s EOP met all 76 requirements.
THECB performed an Appropriation Year 2022 Single Audit Report Evaluation noting no federal or state funding findings.

Reporting Suspected Fraud and Abuse

HCC has taken the following actions to implement the fraud detection and reporting requirements of Section 7.09 of the 83rd Legislature’s General Appropriations Act, and Texas Government Code, Section 321.022:

All employee mandatory annual Standards of Conduct training has been established.
HCC has established a confidential independent Hotline for people to report suspected fraud, abuse, and unethical behavior. A link to the reporting Hotline is on the HCC website home page. Reporting Hotline information is included in mandatory annual Standards of Conduct training.
The HCC Compliance and Ethics website has a link to the State Auditor’s Office fraud hotline.
Internal Audit provided a “Fraud Awareness” lunch and learn available to all HCC employees.
In compliance with the reporting requirements of fraud, waste, and abuse, HCC reports all instances of confirmed fraud, waste, and abuse to the State Auditor’s Office.

Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on the HCC Website

TGC, Section 2102.015 was added by House Bill 16 (83rd Legislature, Regular Session) on June 14, 2013. Colleges are required to post certain information on their website. Specifically, Colleges must post the following information within 30 days of approval by the Board of Trustees:
The approved audit plan for the current fiscal year.
The annual audit report for the previous fiscal year.
A detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report.
A summary of the action taken by the College to address concerns raised by the audit plan or annual report.

HCC Internal Audit will submit the Internal Audit Annual Report to the website coordinators for posting on the Internal Audit section of the HCC website no later than 30 days after the HCC Board of Trustees approves the report. The current fiscal year audit plan has been posted to the website. This report includes the TGC, Section 2102.015 standard elements.

FY 2023 Audit Observations and Management Action Plans

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
20-O-2 Business Continuity Plan	1B	A business impact analysis (BIA) should be documented for all HCC critical business areas. We were unable to verify that a BIA exists for all critical areas. The BIA is the foundation of a BCP. BIA is used to identify the critical processes that need to be recovered following a disaster event. An organization is placed at greater risk without a current BIA to provide adequate direction	The completion of the departmental/college specific business continuity plans will require a series of facilitated workshops with the respective departmental/college leadership. The workshops will guide the departments through the completion of department / college specific business continuity plan templates. The department specific continuity plans will include the identification of essential functions / critical processes and the completion of a business impact analysis.	Executive Director - Risk Management	Complete 9/29/2022	
	1C	The HCC overall institutional BCP lacks some documentation. Procedures for how to handle some events are not specifically addressed in the Plan. Some of these events include remote work, media inquiries and pandemic illnesses. In addition, the documentation for the Campus BCPs and the Functional Unit BCPs has not
been completed.		Executive Director - Risk Management	Complete 9/29/2022	
	2A	HCC should develop a written disaster communication strategy. Risk Management should collaborate with key HCC contacts and personnel to develop documented notification procedures and clearly assign job responsibilities in the event of a disaster. Clear communication during a disaster increases timely and
orderly recovery.	Risk Management will collaborate with Communications, IT, and the HCC Police Department to formalize emergency notification and communications protocols.	Executive Director - Risk Management & Manager - Emergency
Management	Complete 9/29/2022	
	
21-O-2 IT Active Directory and Windows Server	1	IA noted Microsoft Windows 7 and Windows Server 2003 still in service. Microsoft officially ended software updates and security patches for Windows 7 in January 2020 and Windows Server 2003 in July 2015. Through discussion with IT network security HCC is aware that Windows 7 and Windows Server 2003 systems are no longer receiving updates. The affected servers are segregated in a separate Virtual Local Area Network (VLAN) with a hardened system configuration. HCC is in the process of upgrading or decommissioning those systems. Computers running operating systems that are no longer receiving security patches may increase the risk that known computer vulnerabilities can
be exploited.	One of the identified Windows Server 2003 will be powered down by 9/30/2021. The second Windows Server 2003 system would have its services migrated to a compliant/supported operating system by December 2021. Upon confirmation of service migration to a new complaint server, the non-compliant server will be decommissioned.
The remaining Microsoft Windows 7 PCs will be upgraded by the end of the first quarter, 2022.	Director, Enterprise Sys Admin Serv; Exec Dir, Campus Tech Serv; Dir, Cyber Security & Compliance	Complete 3/31/2022
Complete 1/12/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
22-C-1 P-Card Process	2	Continuous P-Card Program training should be provided to all cardholders. New cardholders are required to complete P-Card training in the Percipio employee online learning system before receiving a new P-Card. However, cardholders have not received P-Card training after the initial training consistently. Training should include proper expense coding for cardholders, budget managers and processors to ensure that expenditures are expensed against departmental budgets correctly. Training requirements and completion should be well documented. The Percipio training modules should be reviewed and updated frequently to reflect the changes in the P-Card Program.	P-Card training is mandatory for all new cardholders.
CLP (College Leadership Program) training is currently offered for new managers via WebEx on a monthly basis.
P-Card training will be mandatory for current cardholders on an annual basis via Percipio.
New Live P-Card training will be offered via WebEx and Teams (registration required) as a refresher training.
5 .Training will be developed and offered via WebEx, and Teams for cardholders, budget managers, and processors to address proper coding, supporting documentation requirements, funding sources for accuracy, and procedures compliance offered on a monthly basis.
WebEx and Teams training rosters and quiz results will be stored in the Concur shared drive; Training results conducted in the Percipio Employee Online Learning system (rosters and quizzes) will be stored in Percipio.
P-Card training modules have been updated and will be available to the users
via Percipio.	P-Card Program Administrator	Complete 9/3/2018
Complete 2/25/2022
Complete 12/15/2022
Complete 12/15/2022
Complete 12/15/2022
Complete 12/15/2022
Complete 12/15/2022	
	3C	P-Card Administration should continue to retrieve and audit the files of every P- Card cardholder for completeness and accuracy. Cardholders are required to sign three agreements to participate in the P-Card program. These agreements are the P-Card Application, Citibank Government Purchase Card Setup Form, and the P- Card User Agreement. Cardholders electronically sign a new P-Card User Agreement annually in SNOW. All cardholder P-Card Agreements and training documents are maintained either in SNOW or on the departmental shared drive. IA performed testing to determine the completeness and accuracy of the P-Card Agreements and training documentation. We selected a random sample of 43 active P-Card cardholders and reviewed their P-Card files in SNOW and on the departmental shared drive. Fifteen of the 43 cardholders did not have a Citibank Government Purchase Card Setup Form available. Three of the 43 cardholders did not have a new annual Procurement Card User Agreement available in SNOW. Three cardholders did not have a P-Card cardholder file available on the departmental shared drive. One cardholder did not have files either in SNOW or on the departmental shared drive. Training certificates of completion were not available for 30 of the 43 cardholders.	P-Card team has requested a copy of IA’s audit samples to review the existing cardholders’ files in the Concur share drive and identify any missing documentation (training certificates, Citibank applications, HCC applications and agreements)
Pending the review of the test sample from IA the P-Card team will address the missing documentation including all cardholders. Missing documentation for cardholders stored in Concur share drive prior to July, 2020, will be collected via the HCC-Travel & P-Card Expense SNOW portal from the cardholders with current dates, if the originals are no longer available.
P-Card team will update file folders in the Concur share drive for cardholders missing documentation.
The P-Card team created a record file for each cardholder containing all required documentation in the HCC-Travel & P-Card Expense SNOW portal.
The P-Card team will ensure users are completing the credit limit increase forms in the HCC-Travel & P-Card Expense SNOW portal before the credit limit is granted.	P-Card Program Administrator	Complete 5/2/2022
Complete 5/2/2022
Complete 11/30/2022
Complete 9/29/2022
Complete 5/2/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3E	Merchant Category Codes (MCCs) are used to identify the type of business in which a merchant is engaged. Periodic reviews of the lists of HCC approved MCCs should be performed. Occasionally, overrides are authorized and approved by the director and/or executive director of procurement operations so that one-time single purchases can be made from MCCs that are not on the approved MCC lists. Purchases made from temporarily lifted MCCs should be monitored and the appropriate approval documentation should be maintained for each transaction.	P-Card team will be reviewing the current MCC list template with Citibank once per semester to identify authorized business/merchants per the P-Card Procedures Manual.
If an unauthorized MCC code is requested per a one-time exception, an approved One Time Exception Transaction Form is required. The approved form is attached to each approved transaction. A log will be kept on the Concur share drive of all exceptions.
Expense reports containing temporary exceptions will be reviewed for appropriate approvals and documentation on a monthly basis as part of our departmental review process. A checklist will be attached to indicate that a
thorough review has been performed for each transaction.	P-Card Program Administrator	Complete 12/15/2022
Complete 6/30/2022
Complete 6/30/2022	
	3F	P-Card administration should perform random audits. Audits should be performed frequently and include measures to detect potential split purchases made by cardholders. A split purchase is the “intentional split” of a purchase to meet the P-Card single purchase limit in order to avoid sending the purchase to the contracting office and/or to avoid P-Card guidelines. Information gathered from random audits should be used to detect possible P-Card misuse and to organize topics for training exercises.
System generated reports should be reviewed routinely to monitor cardholder activity. The reasons that purchases are declined should be monitored and tracked. Reports should be used to track repeat cardholder violations and monitor the requests for temporarily lifted MCCs.	Utilizing the Citibank split transaction report, the P-Card team will conduct a random review on a monthly basis to identify “intentional split” transactions, itemized receipts and proper coding. The cardholder will be contacted to address the issue, administering the “Three Strike Rule”.
Training material will be developed based on information gathered from the randomly reviewed reports and identify users who require additional training.
P-Card team will review monthly reports for cardholder activity and misuse including decline transactions. If misuse is identified, the “Three Strike Rule” will be applied.
P-Card team will create logs to keep track of cardholder violations such as MCC temporary lifts, Decline and Split Transactions. If misuse is identified, the “Three Strike Rule” will be applied.	P-Card Program Administrator	Complete 6/10/2022
Complete 10/3/2022
Complete 6/10/2022
Complete 11/9/2021	
	
21-C-1-1 Central College Campus Safety & Environmental Operations Management	6	Four classrooms and/or labs did not have appropriate eyewash stations or did not have an operational eyewash station.	Environmental and Safety Department and Central College Operations are working together to obtain required station equipment and installation.	Enviro & Safety Dept; COO	Complete 1/12/2023	
	12	One prep room did not have the required safety shower.	HCC Environmental and Safety Department and Central College Operations are working together to obtain the safety shower equipment and installation.	Enviro & Safety Dept; COO	Complete 1/12/2023	
	
21-C-1-2 Northeast College Campus Safety & Environmental Operations Management	1	Eight classrooms/labs did not contain an accurate inventory list of hazardous
chemicals known to be present.	Inventory List will be added to MSDS binders.	COO; Campus
Managers	Complete
10/17/2022	
	3	Five classrooms/labs did not have the safety data sheets on hand or readily
available for all hazardous chemicals.	Required safety data sheets for all hazardous chemicals will be put in place.	COO; Campus
Managers	Complete
8/15/2022	
	6	Three classrooms/labs did not have all hazardous or flammable chemicals stored in NFPA approved flammable storage cabinets.	Required flammables safety cabinets will be put in place and chemicals properly stored.	Enviro & Safety Dept; Campus Manager	Complete 1/12/2023	
	8	Two classrooms/labs did not have a Hazard Communication Program and/or
Chemical Hygiene Work Plan.	The required program and plan will be put in place.	COO; Campus
Managers	Complete
10/17/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	14	An eyewash station in one lab was not operational.	College Operations and Environmental and Safety Department have contacted the vendor to perform inspection and make needed eye wash station repairs.	Enviro & Safety Dept; Campus Manager	Complete 8/15/2022	
	15	A fume hood in one lab was not working properly.	College Operations and Environmental and Safety Department have contacted the vendor to perform inspection and to certify fume hood.	Enviro & Safety Dept; Campus Manager	Complete 8/15/2022	
	
21-C-1-3 Coleman College Campus Safety & Environmental Operations
Management	1	Six classrooms/labs did not contain an accurate inventory list of hazardous chemicals.	Pharmacy Technician Department will verify inventory is up to date and then will prepare inventory.	Pharmacy Technician Department	Complete 9/1/2022	
	8	The fume hood in one lab had not been inspected and certified.	HCC Environmental and Safety Department has scheduled vendor inspection for
the fume hood.	Enviro & Safety Dept	Complete
3/3/2023	
	
22-C-3 Procurement Contracting Review	1	HCC Policy CF (LOCAL) requires that the Board of Trustees (BOT) must approve purchase contracts valued at $100,000 or more ($500,000 or more if cooperative, interlocal or job order). Such contracts are presented to the BOT for approval prior to execution. For goods and services procured using the procurement requisition process, the Procurement Department submits proposed contracts valued at $100,000 or more to the BOT for approval prior to issuance of a purchase order for a specified dollar amount and the automated matching process within the payment system ensures that approved payments do not exceed the authorized amount. There are no corresponding controls for direct payment contracts, which generally include billing rates but do not specify a dollar limit. During fieldwork Internal Audit (IA) observed no cumulative direct payments to a vendor meeting the $100,000 or more threshold without BOT approval. However, no control was identified that would prevent or detect cumulative direct payments at the $100,000 or more threshold that do not have BOT approval. We observed one direct payment supplier where the board approved fiscal year (FY) spend amount had been exceeded in FYs 2019, 2020, and 2021. Internal controls should be implemented to ensure that board approval is obtained for cumulative direct payments to a vendor meeting the $100,000 or more threshold in a fiscal year and to ensure board approved spend amounts are not exceeded for direct payments.	Procurement and Finance have teamed together and have engaged Corporate Lounge LLC, a business that has been providing services on process improvements for over 13 years in the Houston area. We intend to remove the waste, streamline the process, and implement best practices. This process will be completed over an 8 week period.	Executive Director, Procurement Operations & AVC, Finance & Accounting	In Progress 12/18/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
22-A-3 Internal Quality Assurance Review	1	In response to an observation presented in our external assessment performed in FY 2021, IA developed and implemented a
Competency Framework to support talent and resource management activities within the department and to demonstrate professional proficiency. As an enhancement to this framework, IA should consider including an appendix to the framework identifying SME currently on staff, plans for developing additional expertise and maintaining the level of competency required based on current and likely future audit plans. Documentation of the available expertise in various relevant subjects can be used to optimize project assignments, reveal needs for additional training or cross-training and ensure that the level of proficiency is maintained and enhanced.	IA will develop documentation of staff expertise and experience, and include the information as an appendix to the IA Competency Framework.	Director Internal Audit	Complete 4/25/2023	
	
23-C-4 Board Expenditures	1	IA observed that the wording in the BBG (LOCAL) policy is vague and lacks the appropriate amount of detail for some travel guidelines. IA noted opportunities to strengthen the wording in the policy in the following three specific areas:
Economy Fare
HCC Policy BBG (LOCAL) states that “air travel shall be reimbursed at the rate of economy fare with advance booking. If travel is booked in a more expensive class, the difference in the fare booked and the economy fare shall not be reimbursed by the College District”.
The BBG (LOCAL) policy in its current state fails to provide a definition of an economy fare. BBG (LOCAL) policy should be revised to provide a clear definition of allowable economy air fares and list other acceptable air fare fees.

Receipts Requirement
HCC Policy BBG (LOCAL) states that “all requested reimbursable expenses, including tips, bus, taxi, shuttle or ground transportation must be supported by receipts. Board members shall submit a notarized affidavit verifying expenses when receipts are not available”. IA noted receipts were provided with the travel expense reimbursement forms; however, some of the receipts lacked pertinent information. BBG (LOCAL) policy guidelines should be revised to include wording that requires all receipts to be “itemized receipts”.	HCC Policy BBG (Local) guidelines should be revised to address the noted observations. The current policy language is outdated as hotels rarely charge to change the room type; however, upgrades may be necessary based on room circumstances such as construction or accessibility. Also, airfare fare is based on the fare availability at the time of booking, which may vary depending on receipt of a response from the Trustee regarding flight preference. The following actions will be taken to address the IA observation:
Update the HCC Policy BBG (Local) and develop travel guidelines regarding lodging and airfare.
In discussion with Board Counsel, Board Services will include an overview of the travel policy guidelines as part of the Board’s annual Governance training as a refresher for the Trustees.	Director, Board Services	In Progress 10/31/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
		3) Lodging
Policy BBG (LOCAL) states that “lodging shall be reimbursed at the rate of a single occupancy room (plus tax) or the published conference room rate”. IA noted that the policy does not provide details for when lodging exceptions may be required. Also, hotel accommodations have changed from the current language in the policy.
The policy guidelines for lodging should be reviewed and updated to more accurately reflect the current hotel travel accommodations. Details should be added to the policy to address situations when hotel upgrades may be necessary
to accommodate a Board member.				
	2	HCC Policy BBG (LOCAL) states that “all requests for reimbursement must be accompanied by receipts and submitted to the manager of Board Services within 30 days of the completion of the travel. Receipts and requests for reimbursement submitted later than 30 days after the completion of the travel shall not be eligible for reimbursement”. IA noted that 10 out of the 37 expense reimbursement forms exceeded the 30-day processing requirement. Receipts and/or supporting documentation and signatures were not submitted according to policy guidelines. IA recommends that the policy be enforced as written. All receipts and supporting documentation should be submitted within 30 days of completion of the travel. Any request for reimbursement submitted without required documentation should be processed excluding payment for missing receipts.	Processing of the travel reimbursement sometimes takes additional time due to the need to obtain itemized receipts; however, the desire is to have receipts submitted within the 30-day period for processing in alignment with policy BBG (Local). The following actions will be taken to address the IA observation:
Board Services will implement an automation process using SmartSheet that will send a weekly email to the respective Trustee as a reminder that itemized receipts have not been submitted after completion of travel.
Board Services will include an overview regarding the submission of receipts and reviewing travel reimbursements as part of the Annual Training on Governance.	Director, Board Services	Complete 6/30/2023	
	
21-O-5 Construction Cost Management	1	Right to Audit clause was omitted from original contract. The Right to Audit clause should be included in all contracts. The Right to Audit provides the owner or the owner’s representative the right to examine Contractor records to ensure evaluation and verification of any or all of the following:

Compliance with contract requirements for deliverables
Compliance with approved plans and specifications
Compliance with Owner's business ethics expectations
Compliance with contract provisions regarding the pricing of change orders

Accuracy of contractor representations regarding the pricing of invoices
Accuracy of contractor representations related to claims submitted by the contractor or any of their payees
Even if an audit is not required, the transparency an audit provides may be in the best interest of HCC. All projects can benefit from the oversight and reporting that comes with an audit. A Right to Audit clause needs to be included in
construction contracts in the future.	The Office of General Counsel is currently working with construction counsel to draft wording to add to the construction contracts regarding the Right to Audit and Weather Delays. Once the wording is drafted, we will work with our partners in procurement to implement the change in the College’s solicitations.	Deputy General Counsel	In Progress 9/1/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
		Weather conditions constitute a risk that is assumed by the owner in the absence of a contractual agreement. Construction contracts commonly contain a weather clause, which either expressly grants an extension for delays caused by weather conditions or expressly denies the right to any extension of time or additional compensation because of weather condition difficulties. HCC Facilities and WHE Project Management became aware of the omission and the need to include a weather delay clause in construction contracts in the future.				
	2	While HCC Facilities has controls in place to ensure construction cost management processes are performed in a way that helps HCC meet its business objectives without introducing unnecessary risks, those processes are not formally written and documented. The HCC Facilities Department needs to deploy control activities through written departmental policies that establish expectations in the construction cost management process and procedures to put
those policies into action.	Policies and procedures governing construction cost management will be implemented per the audit recommendation and have been drafted (roughly 50% complete). Once a new Executive Director of Facilities/Capital Improvement Projects is hired, they will have primary responsibility for implementing and enforcing the policies and procedures when adopted.	Executive Director of Facilities/Capital Improvement Projects	In Progress 12/31/2023	
	
23-C-1-1 Northwest College Campus Safety & Environmental Operations Management	1	Appropriate signs to accurately indicate hazards were not present in seven classrooms. Two exceptions were corrected prior to issuance of this report	Campus Managers at the Katy and the West Houston Institute are working with the Environmental, Health and Safety team to place appropriate hazard signs.	COO; Campus Managers; Safety
team	Complete 7/24/2023	
	2	Obstruction of safety equipment, such as eyewash stations and portable fire extinguishers, was noted in six classrooms. Two of these obstructions were cleared on site by campus operations. Three exceptions were corrected prior to
the issuance of this report.	Fire extinguisher in Room 234 is blocked by a permanent fixture (desk). Resolution and best corrective action to be discussed and implemented.	COO; Campus Manager; Fine Arts Faculty Division
Chair; EHS Manager	In Progress 8/15/2023	
	3	Five classrooms did not have appropriate spill containment of hazardous material. One exception was cleared on site by campus operations. Three
exceptions were cleared prior to the issuance of this report.	Spill containment will be placed in Prep Room 526.	COO; Campus Manager; Biology
Faculty Chair	Complete 7/24/2023	
	4	Four classrooms/labs had containers that were not legibly labeled with the full
chemical or trade name. All the noted exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus Managers	Complete 5/24/2023	
	5	Four classrooms/labs did not have an accurate list of the hazardous chemicals
known to be present. One noted exception was corrected prior to issuance of this report.	Campus managers and Biology lab technicians working to update lists of hazardous chemicals present. One room at Alief Hayes still needs to complete.	COO; Campus
Managers; Biology lab technicians	Complete 7/24/2023	
	6	Safety data sheets were not readily available in three labs. One exception was corrected prior to the issuance of this report.	Campus managers and Biology lab technicians working to update safety data
sheets for hazardous chemicals present. One room at Alief Hayes still needs to complete.	COO; Campus
Managers; Biology lab technicians	Complete 7/24/2023	
	7	Three classrooms had gas cylinders that were not adequately secured so they would not fall. One exception was corrected on site by the class instructor. The remaining two exceptions were corrected prior to the issuance of this report.	All actions plans have been completed.	COO; Campus Managers	Complete 5/24/2023	
	8	Two classrooms and/or labs did not have eyewash stations present or operational where required by chemicals known to be present.	Eyewash installation pending.	COO; Campus managers; EHS
Manager	In Progress 10/31/2023	
	9	Two classrooms/labs had fume hoods that were not working properly.	Vendor has been contacted for repairs and certification of fume hoods.	EHS Manager	In Progress
10/31/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	10	Flexible electrical cords were not being used properly in one classroom. An electrical cord from a computer cabinet was attached to an eyewash station.
Exception was corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus Manager	Complete 5/24/2023	
	11	One classroom had a fire extinguisher that had not been subjected to an annual maintenance check in the past year. Noted exception was corrected prior to the
issuance of this report.	All action plans have been completed.	COO; Campus Managers; EHS
Manager	Complete 5/24/2023	
	12	One classroom had a fire extinguisher that did not contain a current (within one
month) inspection tag. Noted exception was corrected prior to the issuance of this report.	All action plans have been completed.	COO; Enviro & Safety Dept	Complete 5/24/2023	
	13	One storage room did not have appropriate spill cleanup present.	Spill cleanup is now present now.	COO; Campus
Managers	Complete
5/24/2023	
	
23-C-1-2 Southeast College Campus Safety & Environmental Operations Management	1	Obstruction of safety equipment, such as eyewash stations and portable fire
extinguishers, was noted in eight classrooms/labs. All noted obstructions were cleared on site by College Operations.	All action plans have been completed.	COO; Campus Managers	Complete 5/30/2023	
	2	Six classrooms/labs had fume hoods that were out of service. The fume hoods had not been inspected and certified.	Two exceptions were corrected prior to the issuance of this report. Vendor has
been contacted for all inoperable fume hoods in Felix Fraga building. Repairs and certification pending.	EHS Manager	In Progress 10/31/2023	
	3	The exit routes were obstructed in five classrooms. Four of these obstructions
were cleared on site by College Operations. The remaining exception was cleared prior to the issuance of this report.	All action plans have been completed.	COO; Campus Manager	Complete 5/30/2023	
	4	Three classrooms contained fire extinguishers without a current (within one
month) inspection tag. All exceptions were cleared prior to the issuance of this report.	All action plans have been completed.	EHS Manager	Complete 5/30/2023	
	5	Two classrooms did not have safety data sheets on hand for all hazardous chemicals. All noted exceptions were corrected prior to the issuance of this
report.	All action plans have been completed.	COO; Campus Managers	Complete 5/30/2023	
	6	One classroom had missing ceiling tiles. The ceiling tiles were fixed prior to the
issuance of this report.	All action plans have been completed.	COO; Campus
Manager	Complete
5/30/2023	
	7	One classroom did not have an accurate list of the hazardous chemicals known to be present available and referenced on the appropriate safety data sheet. The exception was corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus Managers	Complete 5/30/2023	
	8	One classroom did not have appropriate spill containment present. The noted
exception was corrected on site by College Operations.	All action plans have been completed.	COO; Campus
manager	Complete
5/30/2023	
	9	One classroom had an eyewash station that was not operational due to lack of flushing and testing. Campus Safety flushed the eyewash station, and the noted
exception was corrected on site.	All action plans have been completed.	COO; Campus safety	Complete 5/30/2023	
	10	One classroom did not have appropriate signs present to accurately indicate hazards. The noted exception was corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus Manager	Complete 5/30/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
23-C-1-3 Southwest College Campus Safety & Environmental Operations Management	1	Six classrooms/labs did not have appropriate signs present to accurately indicate hazards. Two exceptions were corrected on site by the Environmental Health and Safety team. The remaining four exceptions were corrected prior to the issuance
of this report.	All action plans have been completed.	COO; Campus Managers	Complete 5/25/2023	
	2	Five classrooms/labs had areas around fire extinguishers or other safety equipment that were not clear. Three noted exceptions were corrected on site. The remaining two exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	EHS Manager	Complete 5/25/2023	
	3	Five classrooms/labs had an eyewash station that was not operational due to lack
of flushing and testing. Four of the noted exceptions were corrected prior to the issuance of this report.	Eyewash station installation pending. EHS department has put in request.	EHS Manager	In Progress 10/31/2023	
	4	Four classrooms contained fire extinguishers without a current (within one
month) inspection tag. All the noted exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	EHS Manager	Complete 5/25/2023	
	5	Four classrooms/labs did not have an accurate list of the hazardous chemicals known to be present available and referenced on the appropriate safety data sheet. All the noted exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus Managers; Biology lab technicians	Complete 5/25/2023	
	6	Two classrooms and one storeroom had fume hoods that were not working properly.	Vendor has been contacted for repairs and certification of fume hoods.	COO; Campus Manager; EHS
Manager	In Progress 10/31/2023	
	7	Two labs did not have a Hazard Communication Program and/or Chemical Hygiene Work Plan, as applicable. The two noted exceptions were corrected prior
to the issuance of this report.	All action plans have been completed.	COO; Campus Managers	Complete 5/25/2023	
	8	Two labs did not have Safety data sheets are on hand for all hazardous chemicals. The two noted exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus manager	Complete 5/25/2023	
	9	Two labs had chemicals being stored under the fume hood. The two noted
exceptions were corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus safety	Complete
5/25/2023	
	10	One classroom had permanent aisles and passageways that were not appropriately marked and kept clear. The noted exception was corrected prior to
the issuance of this report.	All action plans have been completed.	COO; Campus safety	Complete 5/25/2023	
	11	One classroom had flexible electrical cords and cables that were not being used properly. Then noted exception was corrected prior to issuance of this report.	All action plans have been completed.	COO; Campus safety	Complete 5/25/2023	
	12	One classroom had exit routes that were obstructed. The noted exception was
corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus safety	Complete
5/25/2023	
	13	One lab did not have appropriate spill cleanup present. The noted exception was
corrected prior to the issuance of this report.	All action plans have been completed.	COO; Campus safety	Complete
5/25/2023	
	14	One classroom had gas cylinders that were not properly and adequately secured so they would not fall. The noted exception was corrected prior to the issuance of
this report.	All action plans have been completed.	COO; Campus Manager	Complete 5/25/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
23-O-1 Asset Management – Police Academy	1	The HCC’s Equipment and Supplies Management policy requires the asset custodian to establish a fixed asset management program to maintain appropriate stewardship for the location and value of fixed assets. The Perkins Grant requires the custodian to prepare the following:
A physical inventory of the property must be taken, and the results reconciled
with the property records at least once every two years.
A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated.
Adequate maintenance procedures must be developed to keep the property in good condition.
Informal controls are in place to account for the firearms and ammunition. No discrepancies were observed in inventory testing. However, controls can be improved by establishing formally written procedures that document the asset management processes currently being used to prevent firearms from being lost or stolen.
Written procedures for performing preventive maintenance on vehicles should
also be established.	The Police Academy will adopt and implement an asset management policy, which details the manner in which weapons are to be issued and returned each time they are issued to a student. Additionally, a control system will be developed to ensure proper safeguards are in place and being utilized to ensure adequate safeguards are in place. The Police Academy will establish and document the cleaning and maintenance procedures on the weapons and the procedures on HCC vehicle use and maintenance regarding college-owned vehicles being used in academy blocks of instruction.	Coordinator, Law Enforcement Academy	In Progress 9/29/2023	
	
23-O-1 Asset Management – Library	1	The Facilities Department’s Asset Management Procedures require that Department Heads establish accountability for HCC property under their control to secure the equipment from loss, theft, and potential damage. Internal Audit conducted a review of laptops and Chromebook assets under the control of HCC Library and noted the following:
8 laptops and 12 Chromebooks were reported missing by the HCC library
department.	· Students self-reported that 14 loaned laptops and 87 loaned Chromebooks were lost or stolen.

2 loaned laptops and 11 loaned Chromebooks were claimed to have been returned by the students but are not in the HCC libraries inventory.

Currently there are 2 loaned laptops overdue by more than 1 year and 2 Chromebooks overdue by more than 2 years.

To enhance the controls related to the HCC Library laptop and Chromebook assets the existing policies and procedures should be updated to include the following:
a) Require at least annual reconciliations of the Sierra asset information such as asset tag, serial ID, and the device location to the device information stored in the AMS.	Each May, the Library will reconcile Sierra asset information to the information stored in the AMS system.

Each May, the Library will perform and document asset counts, categorize the device as lost when it has been overdue for over 1 year, request IT to lock down the lost device, and file an HCC police report for the loss.

The Library will refine the policy and procedures to require the Library to file the HCC Police report when students notify us their devices were lost or stolen.

The Library will enforce devices be locked in storage shelves and the shelves be placed in secure areas, where they are only accessible to HCC employees.

Full-time employees do not work in the evenings or weekends and may not be able to process the device check-out or check-in to students in the evenings or weekends. The Library will request to add a feature in the Sierra system that may track the employee who processes the checks-out or checks-in of a device.	Director, Library Support Services	In Progress policy for items 1
through 5 8/31/2023
In Progress
procedures dev & training items 1
through 5 12/1/2023

In Progress Asset counts 5/15/2024	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
		Require asset counts be performed at least annually and the counts documentation be maintained.
Require that check-in and check-out of the Library assets be performed by HCC full-time library employees when possible. The name of the employee processing these ins and outs be recorded.
Require devices be stored in a secure area.
A set timeline be established for processing the Library assets as lost when assets are not returned.
Require lost or stolen devices be reported to the HCC Police Department within 24 hours of lost or stolen determination.
When the Library assets are determined to be lost or stolen, require a request be sent to IT to track the location of the device and lock down the device.				
	2	The HCC Equipment and Supplies Management policy requires the asset custodian to maintain the appropriate location and value of assets stewardship. IA did not observe procedures in place for communicating and documenting laptop and Chromebook assets being moved out of Library custody. The Library can make the following improvements:
Complete an E-form for the Facilities Department when moving devices from
one location to another to facilitate Asset Management System (AMS) updates by the Facilities Department.
Notify Campus Technology Solution (CTS) when devices are transferred to
another location and maintain notification records.	Upon withdrawal of a device from the library system, the Library will complete an e-form to update the device’s location in HCC’s AMS and then notify CTS to schedule the device retrieval. The Library will complete the transfer e-Form from a specific library location to Library Support Services and ultimately to CTS.	Director, Library Support Services	In Progress 8/31/2023	
	
23-O-1 Asset Management – Fleet	1	Fleet Management procedures require all vehicles to be serviced every 3,000 miles or as specified by the manufacturer. Internal Audit examined preventive maintenance (PM) records for the vehicles under the control of Fleet Management and noted the following: 1. Two PMs on 1 vehicle were performed more than 1,000 miles past the manufacturer’s recommended schedule. 2. Five vehicle PMs were not documented.
To enhance the controls related to the HCC vehicle PMs, Fleet management should establish a reminder system to ensure routine maintenance is performed timely and retain the PM records.	Fleet Management is committed to implementing impactful measures to ensure the continued optimal performance of our fleet. Our response encompasses the following strategic actions: 1) Implementation of a Reminder System: Fleet Management will introduce a robust reminder system aimed at fostering timely and consistent routine maintenance. This dynamic system will proactively generate notifications, serving as essential reminders for responsible personnel. These reminders will effectively prompt the timely execution of impending maintenance tasks. 2) Establishing Comprehensive PM Records Management: Fleet Management will institute a meticulous and systematic process for the comprehensive retention of PM records. This process will meticulously document all maintenance activities, ensuring precise and accurate record-keeping. This initiative will significantly augment our ability to monitor maintenance history and performance.	Fleet Management/ Fleet Custodians/ Drivers	Complete 9/1/2023	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2	Fleet Management procedures require that drivers conduct pre-and post- operation vehicle inspections. Any identified deficiencies must be documented in the vehicle report at the end of the day. A pre-trip inspection ensures the vehicles are safe to be driven and reduces the opportunity to break down on the road.
Internal Audit conducted a review of the vehicle assets under the control of Fleet management and was informed that pre-trip inspection and vehicle reports are not being completed and retained.
To enhance the controls related to the HCC vehicles, Fleet management should require each driver to perform the pre-trip inspections.	Fleet Management is dedicated to implementing impactful measures aimed at enhancing controls related to HCC vehicles. These measures will ensure the safety and reliability of our vehicles and promote a culture of thorough vehicle checks. Our response includes the following steps: 1. Comprehensive Pre-trip Inspection Checklist: Fleet Management will establish a mandatory pre-trip inspection checklist that each driver must adhere to before operating any vehicle. 2.
Documenting and Retaining Inspection Reports: Fleet Management will establish a systematic process for documenting and retaining pre-trip inspection reports. This process will guarantee the proper recording of inspection outcomes, aiding in maintenance planning and ensuring compliance.	Fleet Management/ Fleet Custodians/ Drivers	Complete 9/1/2023	
	
20-O-1 Enrollment Review	1	Student Services reported Enrollment Projections to the Board on April 19, 2023, including a list of 5 immediate next steps needed to maintain momentum toward achieving enrollment goals. IA concurs with this analysis of primary steps urgently needed to enable HCC to reach enrollment goals and transition to the new State Appropriation “Performance Based Funding Model”. These 5 steps are as follows:		
		1. Develop a strategic enrollment management plan (SEM).	A consulting firm will be contracted to provide guidance through the strategic plan development. A SEM taskforce will be established and work teams created.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 12/18/2023	
			SEM management plan will be developed and recommendations submitted for
Board of Trustees approval.		In Progress
5/31/2024	
			District-wide townhalls will be held to introduce the SEM to internal and external
stakeholders.		In Progress
5/31/2024	
		2. Develop a strategic roadmap for retention.	Student Success Framework is in place. Milestones are provided for checkpoints along the student’s pathways to assist pathways advisors, deans, and other instructional support	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 9/11/2023	
		3. Outline resources required to strengthen enrollment and retention efforts.	This is addressed with both the Quality Enhancement Plan and Student Success Framework. The Student Support Team provides resource information through ongoing workshops, the student portal, and the refined website.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 12/18/2023	
		4. Invest in a CRM and resources to develop a 360-degree perspective of students in the enrollment funnel.	Student Services leadership along with project manager assigned are building out an interim solution while a permanent solution is being determined.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 5/31/2024	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
		5. Provide students with a primary contact / mentor to support them throughout their student experience.	This is addressed with the Pathway Advisor Model. At the beginning of the first semester that a student is enrolled, a pathways advisor is assigned to the student. The effectiveness of the program will be assessed.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 12/18/2023	
	2	Anecdotal reports clearly indicate that prospective students frequently have trouble navigating the website admissions and enrollment processes. Stopping the resulting enrollment losses will also be key to recovering and growing enrollment numbers. A project to identify and remediate the causes of website
navigation failures is urgently needed.	HCC has acquired a firm to conduct a study of the processes provided on our website as it relates to admissions and enrollment processes. The study will provide recommendations for making improvements to our processes for admissions and enrollment.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 12/18/2023	
	
20-O-2 IT Cyber & Data Security and Governance Audit	1	Internal Audit reviewed HCC IT Cyber Security staff job responsibilities for appropriateness. This appeared appropriate. Additionally, IA compared staffing size against similar sized peers and with third party studies and noted an area for improvement. The staffing level is minimal for a college of this size. HCC should evaluate the possibility of increasing staffing for full-time HCC IT Cyber Security to eight employees. This would help strengthen the institution’s resiliency against
cyber-attacks.	IT management will proceed with providing justification and a formal request for additional cyber security team staffing. Approval of IA’s recommended increased headcount and associated funding for the additional positions will be requested over the course of the current and ensuing fiscal years.	Director, Cyber Security & Compliance	In Progress 8/30/2024