HOUSTON COMMUNITY COLLEGE

Internal Audit Annual Report Fiscal Year 2024
in Accordance with the Texas Internal Auditing Act

Prepared by Internal Audit Department
Terry Corrigan, Director Internal Audit

Table of Contents

SECTION
Internal Audit Plan for Fiscal Year 2024	I
Quality Assurance Review	II
Summary of Observations & Management Action Plans	III
List of Consulting Engagements and Non-audit Services Completed.	IV
Internal Audit Plan for Fiscal Year 2025	V
External Audit Services – Fiscal Year 2024	VI
Reporting Suspected Fraud and Abuse	VII
Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit
Annual Report, and Other Audit Information on the HCC Website	VIII

Internal Audit Plan for Fiscal Year 2024

The Board of Trustees approved the FY 2024 Internal Audit Plan on August 16, 2023. The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM) (239 risks assessed). The High Risk Audit Candidates in the plan were based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (23 interviews), 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risk Areas 2023, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan included some hours for planning for the transition to the new Global Internal Audit Standards (Standards) that were published by the Institute of Internal Auditors on January 9, 2024. The new standards will go into effect January 9, 2025.

A FY 2024 Internal Audit Plan Status Report is detailed in the following table.

I

FY 2024 Internal Audit Plan Status Report

Audit Projects	Project Number	
Stage	Report Issued	
Notes/Issues	
Operational Audit Projects					
*Deferred Maintenance	22-O-1	Complete	3/7/2024	Roll over to FY 2024 Plan	
*Asset Management	23-O-1	Complete	4/10/2024	Roll over to FY 2024 Plan; 4 interim reports issued	
IT Disaster Recovery	24-O-1	Complete	8/27/2024	Final audit report issued Tuesday, 8/27/2024	
Student Mental Health	24-O-2	Roll - FY 2025		Roll over to FY 2025 Plan	
Compliance Audit Projects					
*Web Content Accessibility Guidelines Review - Follow-up	19-C-2	Implementing	N/A	On hold - program being established based on ITCA	
*Cares Act - HEERF III	21-C-2	Complete	8/27/2024	Roll over to FY 2024 Plan	
*Payment Card Industry (PCI) Data Security Standard (DSS)	23-C-2	Roll - FY 2025		Roll over to FY 2025 Plan	
*Title IX	23-C-3	Roll - FY 2025		Roll over to FY 2025 Plan	
Campus Safety & Environmental Operations Management	24-C-1	N/A	N/A	Planning for all three colleges	
Central College	24-C-1-1	Complete	4/25/2024	Final audit report issued Thursday, 4/25/2024	
Northeast College	24-C-1-2	Complete	4/25/2024	Final audit report issued Thursday, 4/25/2024	
Coleman College	24-C-1-3	Complete	4/24/2024	Final audit report issued Wednesday, 4/24/2024	
SB 17	24-C-2	Complete	9/11/2024	Final audit report issued Wednesday, 9/11/2024	
Advisory Services Projects					
*Campus Security	19-S-3	Implementing	N/A	On hold - using BRG report to help establish a program	
Committees & Task Forces	24-S-1	N/A	N/A		
Special Projects & Examinations	24-S-2	N/A	N/A		
New State Funding Model Transition	24-S-2-1	Ongoing	N/A		
Security Program Dashboard Updates	24-S-2-2	Ongoing	N/A		
Student Enrollment Information	24-S-2-3	Complete	2/28/2024	Final audit report issued Wednesday, 2/28/2024	
Facilities and Property Information	24-S-2-4	Complete	12/14/2023	Final audit report issued Thursday, 12/14/2023	
Succession Planning Information	24-S-2-5	Complete	12/4/2023	Final audit report issued Monday, 12/4/2023	
Complaints Grievance Process Information	24-S-2-6	Complete	4/24/2024	Final audit report issued Wednesday, 4/24/2024	
Annual THECB Analysis	24-S-2-7	Complete	12/14/2023	Final audit report issued Thursday, 12/14/2023	
Contracted Services Report	24-S-2-8	Complete	11/6/2023	Final audit report issued Monday, 11/6/2023	
Less Than $100,000 Payments Report	24-S-2-9	Complete	11/6/2023	Final audit report issued Monday, 11/6/2023	
ERM Top 10 Risks Baseline Assessment	24-S-3	Ongoing	N/A		

Administrative Projects					
FY 2025 Audit Planning & ERM Assessment	24-A-1	Complete	8/7/2024	FY2025 IA Plan presented Wednesday, 8/7/2024	
TeamMate IA Management System	24-A-2	Ongoing	N/A	Continuously improving the use of TM+	
Internal Quality Assurance Review	24-A-3	Complete	8/29/2024	Combined w/ 24-A-8 Global IA Standards Transition	
FY 2024 Annual Audit Report	24-A-4	Complete	10/2/2024	FY2024 annual report presented Wednesday, 10/2/2024	
External Audits Monitoring	24-A-5	Ongoing	N/A		
Lunch and Learns	24-A-6	Ongoing	N/A		
Newsletters	24-A-7	Ongoing	N/A		
Global Internal Audit Standards Transition	24-A-8	Complete	8/29/2024	Final audit report issued Thursday, 8/29/2024	

Quality Assurance Review

An external quality assurance review (EQAR) was performed by Basil Woller and Associates (Basil Woller) on the Internal Audit Department in FY 2021, in compliance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards). The review was an independent validation of the assertions and conclusions made in the internal audit report “20-A-3 IA Internal Quality Assurance Review” issued by the HCC’s Internal Audit Department on June 23, 2020. Basil Woller’s report issued May 7, 2021, concurred with the Internal Audit self-assessment, that HCC’s Internal Audit Department generally conforms with the Standards and the IIA Code of Ethics. This level of conformance is the top rating and demonstrates a clear intent and commitment to achieving the Core Principles and the Definition of Internal Auditing.

The HCC Internal Audit Department completed the following quality assurance activities during FY 2024:
Collaborated with the Risk Management Office to update and complete the annual Enterprise Risk Management Assessment for HCC.
An Internal Quality Assurance Review was combined with a Global Internal Audit Standards transition review to meet the requirements of the new Standards effective January 9, 2025.
TeamMate Analytics software is being used to perform data analytics in audit projects based on planning assessments.
Maintained a professional staff with diversified skill sets and professional certifications.
Completed training to maintain professional certifications and to improve knowledge and understanding required to complete audit projects.

Summary of Observation and Management Action Plans

See the detailed FY 2024 Audit Observations and Management Action Plans Attachment to this report.

List of Consulting Engagements and Non-audit Services Performed

Internal Audit provided a lunch and learn on “Fraud Awareness.” Members of the Internal Audit Department participated on the following councils, task forces, and committees in FY 2024:

Accountability and Standards Council
Internet and Communication Technology and Accessibility Committee
Procurement Contract Evaluation Committees
Candidates for Hiring Screening Committees

Internal Audit Plan for Fiscal Year 2025

The HCC Board of Trustees approved the Fiscal Year 2025 Internal Audit Plan on August 21, 2024.

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (IA) will conduct during fiscal year 2025. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act. Time is built into the Plan for IA to be responsive to board and management concerns.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2025. The plan includes time for reviewing the integrity and validity of assessments and information provided on the top 10 risks identified in HCC’s ERM Assessment.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM) (239 risks assessed). The High Risk Audit Candidates in the plan are based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (22 interviews), 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) 2024 KPMG Internal Audit Key Risk, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan includes some hours for transitioning to the new Global Internal Audit Standards that go into effect January 9, 2025.

The FY 2025 Internal Audit Plan is detailed in the following table.

Internal Audit Department Fiscal Year 2025 Audit Plan

No.	Project	Description	
Operational Audit Projects	
24-O-2	*Student Mental Health	Review HCC's program for addressing student mental health issues, BITAT processes, and plans to address Human Trafficking risk mitigation.	
25-O-1	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery including compliance with regulations and HCC policies. Additionally, IA will attend and observe the annual disaster recovery exercise.	
25-O-2	IT Systems Audit	Review HCC IT systems access. Employee offboarding will be a focus. An effective offboarding process is important for several reasons including: ensuring that access to HCC systems, data, and physical assets (like laptops or building access cards) is promptly revoked, significantly reducing the risk of unauthorized access and potential security breaches. Patch levels for systems will also be reviewed.	
Compliance Audit Projects	
23-C-2	*Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures. The new regulations are effective March 2025.	
23-C-3	*Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures. The new rules were to be effective August 1, 2024; however, lawsuits in progress will affect some of the provisions from going into effect.	
25-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews.	
25-C-1-1	Northwest College	Safety & environmental legal policy compliance.	
25-C-1-2	Southeast College	Safety & environmental legal policy compliance.	
25-C-1-3	Southwest College	Safety & environmental legal policy compliance.	
25-C-2	Procurement Processing	Review the process propriety and for compliance with government regulations and HCC policies.	
25-C-3	Payments Processing	Review the process propriety and for compliance with government regulations and HCC policies.	
Advisory Services Projects	
25-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice.	
25-S-2	Special Projects & Examinations	Responsive to provide services as required.	
25-S-3	ERM Top 10 Risks Baseline Assessment	Review for integrity and validity of assessments and information.	
25-S-3-1	Enrollment & Funding Model		
25-S-3-2	Campus Security		
25-S-3-3	IT Systems Access/Cyber Security/Data Recovery		
25-S-3-4	Deferred Maintenance		
25-S-3-5	Post Pandemic "New Normal"/competition/ Changing market		
25-S-3-6	Title IX/VAWA/SB 212/SB 17		
25-S-3-7	Minors on Campus		
25-S-3-8	Behavioral Intervention & Threat Assessment		
25-S-3-9	Website Accessibility (Section 508)		
25-S-3-10	Policing		

V-1

Administrative Projects	
25-A-1	FY 2026 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning.	
25-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement.	
25-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA.	
25-A-4	FY 2025 Annual Audit Report	Compile and prepare State required annual audit report.	
25-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans.	
25-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	
25-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	
25-A-8	Global Internal Audit Standards Transition	IA transitioning to the new Institute of Internal Auditors “Global Internal Audit Standards” that are effective January 9, 2025.	
Observation Action Plan Follow-ups	
25-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	
* Carry-over/continued projects from FY 2024 Internal Audit Plan	

V-2

External Audit Services – Fiscal Year 2024

HCC Procured Services in FY 2024

Texas Mutual Insurance Company – 2023-2024 Workers’ Compensation final audit
Whitley Penn – Annual Financial Statements Audit for FY 2023
Gallagher's Public Sector and Higher Education practice human resources consulting
Forvis Mazars – Annual Financial Statements Audit for FY 2024

Regulatory Imposed in FY 2024

Weaver engaged by Houston-Galveston Area Council to perform 2023-2024 Financial Monitoring & Billing Review on contracts 213-23 & 213-24.
Texas School Safety Center performed a Fall 2023 Emergency Operations Plan (EOP) Review. HCC’s EOP met all 64 audited items requirements.
The Southern Association of Colleges and Schools Commission on Colleges (SACSCOC) conducted a required site visit to complete their review process of our new baccalaureate programs.
Triennial Campus Safety & Security Audit – Texas Education Code 37.108 &
37.109 establishes the standards. The Texas School Safety Center has regulatory oversight responsibility.
The SAO performed an evaluation of compliance with the Public Funds Investment Act (PFIA) and Rider 5 requirements. HCC was determined to be fully compliant with PFIA and Rider 5 requirements.
The THECB performed a Perkins Basic Grant Site Visit.
THECB performed an Appropriation Year 2023 Single Audit Report Evaluation noting no federal or state funding findings.

Reporting Suspected Fraud and Abuse

HCC has taken the following actions to implement the fraud detection and reporting requirements of Section 7.09 of the 83rd Legislature’s General Appropriations Act, and Texas Government Code, Section 321.022:

All employee mandatory annual Standards of Conduct training has been established.
HCC has established a confidential independent Hotline for people to report suspected fraud, abuse, and unethical behavior. A link to the reporting Hotline is on the HCC website home page. Reporting Hotline information is included in mandatory annual Standards of Conduct training.
The HCC Compliance and Ethics website has a link to the State Auditor’s Office fraud hotline.
Internal Audit provided a “Fraud Awareness” lunch and learn available to all HCC employees.
In compliance with the reporting requirements of fraud, waste, and abuse, HCC reports all instances of confirmed fraud, waste, and abuse to the State Auditor’s Office.

Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on the HCC Website

TGC, Section 2102.015 was added by House Bill 16 (83rd Legislature, Regular Session) on June 14, 2013. Colleges are required to post certain information on their website. Specifically, Colleges must post the following information within 30 days of approval by the Board of Trustees:
The approved audit plan for the current fiscal year.
The annual audit report for the previous fiscal year.
A detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report.
A summary of the action taken by the College to address concerns raised by the audit plan or annual report.
HCC Internal Audit will submit the Internal Audit Annual Report to the website coordinators for posting on the Internal Audit section of the HCC website no later than 30 days after the HCC Board of Trustees approves the report. The current fiscal year audit plan has been posted to the website. This report includes the TGC, Section 2102.015 standard elements.

FY 2024 Audit Observations and Management Action Plans

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
22-C-3 Procurement Contracting Review	1	HCC Policy CF (LOCAL) requires that the Board of Trustees (BOT) must approve purchase contracts valued at $100,000 or more ($500,000 or more if cooperative, interlocal or job order). Such contracts are presented to the BOT for approval prior to execution. For goods and services procured using the procurement requisition process, the Procurement Department submits proposed contracts valued at
$100,000 or more to the BOT for approval prior to issuance of a purchase order for a specified dollar amount and the automated matching process within the payment system ensures that approved payments do not exceed the authorized amount.
There are no corresponding controls for direct payment contracts, which generally include billing rates but do not specify a dollar limit. During fieldwork Internal Audit (IA) observed no cumulative direct payments to a vendor meeting the $100,000 or more threshold without BOT approval. However, no control was identified that would prevent or detect cumulative direct payments at the $100,000 or more threshold that do not have BOT approval. We observed one direct payment supplier where the board approved fiscal year (FY) spend amount had been exceeded in FYs 2019, 2020, and 2021. Internal controls should be implemented to ensure that board approval is obtained for cumulative direct payments to a vendor meeting the
$100,000 or more threshold in a fiscal year and to ensure board approved spend amounts are not exceeded for direct payments.	Procurement and Finance have teamed together and have engaged Corporate Lounge LLC, a business that has been providing services on process improvements for over 13 years in the Houston area. We intend to remove the waste, streamline the process, and implement best practices. This process will be completed over an 8 week period.	Executive Director, Procurement Operations & AVC, Finance & Accounting	Complete 12/18/2023	
	
23-C-4 Board Expenditures	1	IA observed that the wording in the BBG (LOCAL) policy is vague and lacks the appropriate amount of detail for some travel guidelines. IA noted opportunities to strengthen the wording in the policy in the following three specific areas:
1) Economy Fare
HCC Policy BBG (LOCAL) states that “air travel shall be reimbursed at the rate of economy fare with advance booking. If travel is booked in a more expensive class, the difference in the fare booked and the economy fare shall not be reimbursed by the College District”.
The BBG (LOCAL) policy in its current state fails to provide a definition of an economy fare. BBG (LOCAL) policy should be revised to provide a clear definition of allowable economy air fares and list other acceptable air fare fees.	HCC Policy BBG (Local) guidelines should be revised to address the noted observations. The current policy language is outdated as hotels rarely charge to change the room type; however, upgrades may be necessary based on room circumstances such as construction or accessibility. Also, airfare fare is based on the fare availability at the time of booking, which may vary depending on receipt of a response from the Trustee regarding flight preference. The following actions will be taken to address the IA observation:
Update the HCC Policy BBG (Local) and develop travel guidelines regarding lodging and airfare.
In discussion with Board Counsel, Board Services will include an overview of the travel policy guidelines as part of the Board’s annual Governance training as a refresher for the Trustees.	Director, Board Services	Complete 6/5/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
		Receipts Requirement
HCC Policy BBG (LOCAL) states that “all requested reimbursable expenses, including tips, bus, taxi, shuttle or ground transportation must be supported by receipts.
Board members shall submit a notarized affidavit verifying expenses when receipts are not available”. IA noted receipts were provided with the travel expense reimbursement forms; however, some of the receipts lacked pertinent information. BBG (LOCAL) policy guidelines should be revised to include wording that requires all receipts to be “itemized receipts”.

Lodging
Policy BBG (LOCAL) states that “lodging shall be reimbursed at the rate of a single occupancy room (plus tax) or the published conference room rate”. IA noted that the policy does not provide details for when lodging exceptions may be required. Also, hotel accommodations have changed from the current language in the policy. The policy guidelines for lodging should be reviewed and updated to more accurately reflect the current hotel travel accommodations. Details should be added to the policy to address situations when hotel upgrades may be necessary to accommodate a Board member.				
	
21-O-5 Construction Cost Management	1	Right to Audit clause was omitted from original contract. The Right to Audit clause should be included in all contracts. The Right to Audit provides the owner or the owner’s representative the right to examine Contractor records to ensure evaluation and verification of any or all of the following:

Compliance with contract requirements for deliverables
Compliance with approved plans and specifications
Compliance with Owner's business ethics expectations
Compliance with contract provisions regarding the pricing of change orders

Accuracy of contractor representations regarding the pricing of invoices
Accuracy of contractor representations related to claims submitted by the contractor or any of their payees
Even if an audit is not required, the transparency an audit provides may be in the best interest of HCC. All projects can benefit from the oversight and reporting that comes with an audit. A Right to Audit clause needs to be included in construction
contracts in the future.	The Office of General Counsel is currently working with construction counsel to draft wording to add to the construction contracts regarding the Right to Audit and Weather Delays. Once the wording is drafted, we will work with our partners in procurement to implement the change in the College’s solicitations.	Deputy General Counsel	Complete 9/1/2023	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
		Weather conditions constitute a risk that is assumed by the owner in the absence of a contractual agreement. Construction contracts commonly contain a weather clause, which either expressly grants an extension for delays caused by weather conditions or expressly denies the right to any extension of time or additional compensation because of weather condition difficulties. HCC Facilities and WHE Project Management became aware of the omission and the need to include a weather delay clause in construction contracts in the future.				
	2	While HCC Facilities has controls in place to ensure construction cost management processes are performed in a way that helps HCC meet its business objectives without introducing unnecessary risks, those processes are not formally written and documented. The HCC Facilities Department needs to deploy control activities through written departmental policies that establish expectations in the construction cost management process and procedures to put those policies into
action.	Policies and procedures governing construction cost management will be implemented per the audit recommendation and have been drafted (roughly 50% complete). Once a new Executive Director of Facilities/Capital Improvement Projects is hired, they will have primary responsibility for implementing and enforcing the policies and procedures when adopted.	Executive Director of Facilities/Capital Improvement Projects	In Progress 8/1/2024	
	
23-C-1-1 Northwest College Campus Safety & Environmental Operations Management	2	Obstruction of safety equipment, such as eyewash stations and portable fire extinguishers, was noted in six classrooms. Two of these obstructions were cleared on site by campus operations. Three exceptions were corrected prior to the issuance
of this report.	Fire extinguisher in Room 234 is blocked by a permanent fixture (desk). Resolution and best corrective action to be discussed and implemented.	COO; Campus Manager; Fine Arts Faculty Division Chair;
EHS Manager	Complete 1/31/2024	
	8	Two classrooms and/or labs did not have eyewash stations present or operational where required by chemicals known to be present.	Eyewash installation pending.	COO; Campus
managers; EHS Manager	Complete 1/31/2024	
	9	Two classrooms/labs had fume hoods that were not working properly.	Vendor has been contacted for repairs and certification of fume hoods.	EHS Manager	Complete
1/31/2024	
	
23-C-1-2 Southeast College Campus Safety & Environmental Operations Management	2	Six classrooms/labs had fume hoods that were out of service. The fume hoods had not been inspected and certified.	Two exceptions were corrected prior to the issuance of this report. Vendor has been contacted for all inoperable fume hoods in Felix Fraga building. Repairs and certification pending.	EHS Manager	Complete 1/31/2024	
	
23-C-1-3 Southwest College Campus Safety & Environmental Operations Management	3	Five classrooms/labs had an eyewash station that was not operational due to lack of flushing and testing. Four of the noted exceptions were corrected prior to the
issuance of this report.	Eyewash station installation pending. EHS department has put in request.	EHS Manager	Complete 1/31/2024	
	6	Two classrooms and one storeroom had fume hoods that were not working properly.	Vendor has been contacted for repairs and certification of fume hoods.	COO; Campus Manager; EHS
Manager	Complete 9/10/2024	
	
23-O-1 Asset Management – Police Academy	1	The HCC’s Equipment and Supplies Management policy requires the asset custodian to establish a fixed asset management program to maintain appropriate stewardship for the location and value of fixed assets. The Perkins Grant requires
the custodian to prepare the following:	The Police Academy will adopt and implement an asset management policy, which details the manner in which weapons are to be issued and returned each time they are issued to a student. Additionally, a control system will be developed to ensure
proper safeguards are in place and being utilized to ensure adequate safeguards are	Coordinator, Law Enforcement Academy	Complete 9/29/2023	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
		A physical inventory of the property must be taken, and the results reconciled with the property records at least once every two years.
A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated.
Adequate maintenance procedures must be developed to keep the property in good condition.
Informal controls are in place to account for the firearms and ammunition. No discrepancies were observed in inventory testing. However, controls can be improved by establishing formally written procedures that document the asset management processes currently being used to prevent firearms from being lost or stolen.
Written procedures for performing preventive maintenance on vehicles should also
be established.	in place. The Police Academy will establish and document the cleaning and maintenance procedures on the weapons and the procedures on HCC vehicle use and maintenance regarding college-owned vehicles being used in academy blocks of instruction.			
	
23-O-1 Asset Management – Library	1	The Facilities Department’s Asset Management Procedures require that Department Heads establish accountability for HCC property under their control to secure the equipment from loss, theft, and potential damage. Internal Audit conducted a review of laptops and Chromebook assets under the control of HCC Library and noted the following:
8 laptops and 12 Chromebooks were reported missing by the HCC library department.	· Students self-reported that 14 loaned laptops and 87 loaned Chromebooks were lost or stolen.

2 loaned laptops and 11 loaned Chromebooks were claimed to have been returned by the students but are not in the HCC libraries inventory.

Currently there are 2 loaned laptops overdue by more than 1 year and 2 Chromebooks overdue by more than 2 years.

To enhance the controls related to the HCC Library laptop and Chromebook assets the existing policies and procedures should be updated to include the following:
Require at least annual reconciliations of the Sierra asset information such as asset tag, serial ID, and the device location to the device information stored in the AMS.

Require asset counts be performed at least annually and the counts documentation be maintained.
Require that check-in and check-out of the Library assets be performed by HCC full-time library employees when possible. The name of the employee processing these ins and outs be recorded.
Require devices be stored in a secure area.
A set timeline be established for processing the Library assets as lost when assets are not returned.	Each May, the Library will reconcile Sierra asset information to the information stored in the AMS system.

Each May, the Library will perform and document asset counts, categorize the device as lost when it has been overdue for over 1 year, request IT to lock down the lost device, and file an HCC police report for the loss.

The Library will refine the policy and procedures to require the Library to file the HCC Police report when students notify us their devices were lost or stolen.

The Library will enforce devices be locked in storage shelves and the shelves be placed in secure areas, where they are only accessible to HCC employees.

Full-time employees do not work in the evenings or weekends and may not be able to process the device check-out or check-in to students in the evenings or weekends. The Library will request to add a feature in the Sierra system that may track the employee who processes the checks-out or checks-in of a device.	Director, Library Support Services	1) & 2)
Complete 5/15/2024

Complete 10/19/2023

Complete 10/19/2023

Complete 10/19/2023	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
		Require lost or stolen devices be reported to the HCC Police Department within 24 hours of lost or stolen determination.
When the Library assets are determined to be lost or stolen, require a request be sent to IT to track the location of the device and lock down the device.				
	2	The HCC Equipment and Supplies Management policy requires the asset custodian to maintain the appropriate location and value of assets stewardship. IA did not observe procedures in place for communicating and documenting laptop and Chromebook assets being moved out of Library custody. The Library can make the following improvements:
Complete an E-form for the Facilities Department when moving devices from one location to another to facilitate Asset Management System (AMS) updates by the Facilities Department.
Notify Campus Technology Solution (CTS) when devices are transferred to
another location and maintain notification records.	Upon withdrawal of a device from the library system, the Library will complete an e- form to update the device’s location in HCC’s AMS and then notify CTS to schedule the device retrieval. The Library will complete the transfer e-Form from a specific library location to Library Support Services and ultimately to CTS.	Director, Library Support Services	Complete 8/31/2023	
	
20-O-1 Enrollment Review	1	Student Services reported Enrollment Projections to the Board on April 19, 2023, including a list of 5 immediate next steps needed to maintain momentum toward achieving enrollment goals. IA concurs with this analysis of primary steps urgently needed to enable HCC to reach enrollment goals and transition to the new State Appropriation “Performance Based Funding Model”. These 5 steps are as follows:		
		1. Develop a strategic enrollment management plan (SEM).	Trellis Foundation has been contracted to provide guidance through the strategic plan development. A SEM taskforce will be established and work teams created.	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 3/31/2024	
			SEM management plan will be developed and recommendations submitted for
Board of Trustees approval.		In Progress
8/31/2024	
			District-wide townhalls will be held to introduce the SEM to internal and external
stakeholders.		In Progress
10/31/2024	
		3. Outline resources required to strengthen enrollment and retention efforts.	This is addressed with both the Quality Enhancement Plan and Student Success Framework. The Student Support Team provides resource information through ongoing workshops, the student portal, and the refined website.	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 2/5/2024	
		4. Invest in a CRM and resources to develop a 360-degree perspective of students in the enrollment funnel.	Student Services leadership along with project manager assigned are building out an interim solution while a permanent solution is being determined. An interim solution has been requisitioned and is being developed that is expected to launch at the end of May. Then the solicitation process for a more permanent solution will
begin.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 12/31/2024	
		5. Provide students with a primary contact / mentor to support them throughout their student experience.	This is addressed with the Pathway Advisor Model. At the beginning of the first semester that a student is enrolled, a pathways advisor is assigned to the student. The effectiveness of the program will be assessed.	Interim VC Student Service/ Interim AVC Enrollment Management	In Progress 8/31/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
	2	Anecdotal reports clearly indicate that prospective students frequently have trouble navigating the website admissions and enrollment processes. Stopping the resulting enrollment losses will also be key to recovering and growing enrollment numbers. A project to identify and remediate the causes of website navigation failures is
urgently needed.	HCC has acquired a firm to conduct a study of the processes provided on our website as it relates to admissions and enrollment processes. The study will provide recommendations for making improvements to our processes for admissions and enrollment.	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 2/29/2024	
	
20-O-2 IT Cyber & Data Security and Governance Audit	1	Internal Audit reviewed HCC IT Cyber Security staff job responsibilities for appropriateness. This appeared appropriate. Additionally, IA compared staffing size against similar sized peers and with third party studies and noted an area for improvement. The staffing level is minimal for a college of this size. HCC should evaluate the possibility of increasing staffing for full-time HCC IT Cyber Security to eight employees. This would help strengthen the institution’s resiliency against
cyber-attacks.	IT management will proceed with providing justification and a formal request for additional cyber security team staffing. Approval of IA’s recommended increased headcount and associated funding for the additional positions will be requested over the course of the current and ensuing fiscal years.	Director, Cyber Security & Compliance	In Progress 8/30/2024	
	
22-O-1 Deferred Maintenance	1	During interviews with the Facilities department personnel, it was determined that HCC Facilities has processes in place for identifying, risk assessing, prioritizing, cost tracking, and reporting deferred maintenance projects. However, these processes are not formally written and documented. The HCC Facilities Department should create written departmental procedures for deferred maintenance to help control activities and establish expectations. The procedures should document the steps used to assess and prioritize deferred maintenance projects. In addition, all agendas and minutes from meetings held with subject matter experts (SMEs) to assess and determine the priority of deferred maintenance projects should be documented and maintained.	The firm that is awarded the project of updating the 2019 Facilities Condition Assessment will create current industry best practices for the departmental procedures for identifying, assessing, prioritizing, and tracking deferred maintenance projects.	Chief Facilities Officer/Executive Director, Maintenance and Auxiliary Services	In Progress 8/31/2025	
	2	During the review of processes and procedures in place to identify, assess and prioritize deferred maintenance projects, it was determined that a Facilities Condition Assessment was performed in 2019. Industry best practices indicate regular inspections and condition assessments should be performed, at least every five years. The HCC Facilities Department should recommend to the Board of Trustees that an updated Facilities Condition Assessment be performed. An updated FCA will:
lllHelp Facilities assess the current condition of College buildings and properties.
lllProvide more accurate and actionable data to assist Facilities in assessing DM
needs.
lllHelp Facilities prioritize budgetary needs and establish maintenance and repair
timelines.
lllEnable better capital planning and forecasting.
lllEnsure compliance with industry standards and safety requirements.
lllHelp better estimate deferred maintenance expenses.	HCC Facilities department in conjunction with HCC Procurement department will request approval from the Board of Trustees to engage with an appropriate firm to update the 2019 Facilities Condition Assessment.	Chief Facilities Officer/Executive Director, Maintenance and Auxiliary Services	In Progress 8/31/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
23-O-1 Asset Management - Information Technology	1	IA observed various discrepancies with departmental IT asset inventory. The discrepancies are detailed in the report Attachment. IA noted that HCC does not have a written policy that details HCC’s expectations for managing IT assets. IA recommends an HCC policy regulation be written and submitted to the Chancellor’s Executive Committee (CEC) for approval to manage IT assets. IA suggests that the regulation cover the following elements:
lllOnboarding: Workflow from HCC IT to the customer. This would include departmental technology assets from general purchase, grant funded, and donated items. The HCC IT department should be the initial recipient of controlled and capitalized IT assets inclusive of computers, servers and network equipment. This would help ensure that these types of assets are properly recorded, set up, secured, managed, configured and safe to use on the HCC network.
lllMonitoring: Annual inventory count and reconciliation by a designated party, movement forms completed when assets are moved and transferred to another location.
lllOffboarding: Workflow from IT asset custodians to HCC IT when employees leave
HCC or transfer to other departments.
lllTraining: Required training details.
lllReview and monitoring oversight: Required by directly responsible individuals.
lllEnforcement: Accountability, disciplinary action for policy offenders.	The Information Technology (IT) department will work collaboratively with the Facilities department and OGC in the development of an asset management regulation to include all controlled and capitalized HCC technology equipment lifecycle management (onboarding, monitoring and offboarding).	Chief Facilities Officer/Chief Information Officer	In Progress 8/31/2024	
	2	IA selected network equipment to review. IA noted the age and vendor support of the devices. Many of the devices are approaching their end of life for support. The existing funding model is not sufficient for HCC’s IT operations. Not having sufficient funding to meet HCC’s IT needs jeopardizes HCC in meeting their goal to the college of choice and achieving student success.Presently, the IT budget allocation received from student technology fees has been consistently underfunded. These tech fees provide the revenue for all IT equipment needs including computers for faculty and staff, classroom projectors, computer labs, network equipment, servers, and data storage. However, these fees are based on student enrollment. The fee amount was established years ago and is not based on IT equipment operations actual budget needs. For HCC IT to operate in an efficient and effective manner, HCC IT should receive sufficient IT operating equipment funding in the annual budgeting process. Having sufficient funding would help alleviate unnecessary downtime, security vulnerabilities, and ensure a smooth transition to new hardware when aging equipment needs to be retired.	The Information Technology department will prepare the Technology replacement budget in accordance to the recommended technology equipment lifecycle replacement plans.	Chief Information Officer	Complete 2/29/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
23-O-1 Asset Management - Facilities	1	The Asset Management Procedures manual requires a physical asset count of all assets to be completed at least once a year. The two previous annual counts were performed in January 2022 and May 2023. In coordinating the annual asset counts, the Asset Management team (AM) counted non-IT assets and reconciled non-IT asset information from selected departments and campuses. The annual counts were not 100% asset reconciliations. In IA's review of assets, many discrepancies were noted as detailed in the report. IA recommends the following: 1) The Annual Inventory Procedures be updated to require the Asset Management team obtain asset reconciliation sheets from all departments and campuses to ensure 100% of fixed assets are reconciled. 2) All assets be included in the annual asset reconciliations. 3)lllEnsure the asset’s location, tag number, and serial ID in PeopleSoft are correctly recorded, and the status is current.	Asset Management has updated the procedures to ensure that all locations provide results of a physical inventory and that 100% of assets are reconciled. Additionally, AM will ensure that the location, tag number, and serial ID are current and correct.	Chief Facilities Officer/Asset Management Staff	Complete 4/10/2024	
	
24-C-1 Campus Safety & Environmental Operations Management	1	Historically, HCC has maintained safety data sheets (SDS) in a hard copy format, leading to inefficiencies in storage, retrieval, and updating as indicated by ongoing observations related to missing SDS and incomplete chemical inventories. With advancements in technology, digital solutions offer a more streamlined and effective approach to managing SDS information. Internal Audit recommends that EH&S submit a proposal to HCC Administration to implement an online SDS service.	EHS is working with Procurement on securing this service from a vendor.	EHS Manager	In Progress 9/30/2024	
	
24-C-1-1 Central College Campus Safety & Environmental Operations Management	1	Obstruction of safety equipment, such as eyewash stations and portable fire extinguishers, was noted in eight classrooms. All obstructions of safety equipment were corrected on site. No further action is necessary.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	2	Safety data sheets were not readily available in seven classrooms and/or labs. One exception, WWH 417, was corrected on site as instructor removed chemical from the lab. The remaining six exceptions were corrected prior to the issuance of report.	All action plans have been completed.	COO; Campus Manager	Complete 4/24/2024	
	3	Five classrooms/labs did not have a Hazard Communication Program available as required by chemicals being maintained. Exceptions were corrected prior to the
issuance of report.	All action plans have been completed.	COO; Campus Manager	Complete 4/24/2024	
	4	Five classrooms and one prep room did not contain an accurate inventory list of
hazardous chemicals known to be present. Exceptions were corrected prior to the issuance of report.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	5	Five classrooms/labs did not have appropriate signs present indicating hazard information. All exceptions were corrected on site by the Environmental Health and
Safety team.	All action plans have been completed.	EHS Manager	Complete 4/24/2024	
	6	Three classrooms had a fire extinguisher that did not contain a current (within one month) inspection tag. All noted exceptions were corrected prior to the issuance of
report.	All action plans have been completed.	EHS Manager	Complete 4/24/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
	7	Two classrooms did not have eyewash stations available when chemicals and materials on hand required an eyewash be present for immediate emergency use. One eyewash station was not working properly in JBW 118. The equipment was
repaired on site by EHS.	A requisition is being drafted for work in JBW 105 and 223.	EHS Manager	In Progress 12/15/2024	
	8	The walkway in two classrooms were obstructed. Both obstructions were cleared
prior the issuance of report.	All action plans have been completed.	COO; Campus
managers	Complete
4/24/2024	
	9	Two classrooms contained a fire extinguisher with no indication of annual inspection. Annual inspections were completed for JBW and FAC prior to the
issuance of report.	All action plans have been completed.	EHS Manager	Complete 4/24/2024	
	10	Two classrooms/labs did not have all hazardous or flammable chemicals stored in a NFPA approved flammable storage cabinets. One exception, WWH 417, was cleared on site. The instructor removed the flammable chemical from the lab as it was no longer needed for the course. WKF 116 was cleared prior to the issuance of report.	All action plans have been completed.	COO; Campus Manager	Complete 4/24/2024	
	11	Two classrooms had table saws that were not properly guarded to prevent injury to operator of equipment. Guards were added to saws prior to the issuance of report.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	12	Two classrooms had gas cylinders that were not properly and adequately secured to prevent accidents or damage to the cylinders. All exceptions were corrected prior to
the issuance of report.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	13	An exit in one classroom was obstructed. The exit obstruction was cleared prior to
the issuance of report.	All action plans have been completed.	COO; Campus
Managers	Complete
4/24/2024	
	14	A damaged or missing ceiling tile was noted in one classroom. The damaged ceiling
tile was replaced prior to the issuance of report.	All action plans have been completed.	COO; Campus
Managers	Complete
4/24/2024	
	15	One classroom did not have appropriate spill containment of hazardous material. Spill containment was placed in the classroom prior to issuance of report.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	16	One prep room did not contain the required spill cleanup kit. Spill kit added to the
prep room prior to the issuance of report.	All action plans have been completed.	COO; Campus
Managers	Complete
4/24/2024	
	17	One prep room did not have a safety shower present when a shower would be
required by chemicals on hand.	A requisition is being drafted for this work.	EHS Manager	In Progress
12/15/2024	
	18	One prep room had chemicals stored under a fume hood. The exception was
corrected prior to the issuance of report.	All action plans have been completed.	COO; Campus
Managers	Complete
4/24/2024	
	19	One classroom had equipment set up that appeared to be an electrical hazard as electrical parts were exposed and not properly grounded. The electrical hazard, exposed wires and cables, were cleared prior to issuance of report.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	
24-C-1-2 Northeast College Campus Safety & Environmental Operations Management	1	Nine classrooms had a fire extinguisher that did not contain a current (within one month) inspection tag. Monthly inspections were performed in eight classroom/labs prior to issuance of report.	Correction plan is in progress.	COO; Campus Manager, ATTC	Complete 5/1/2024	
	2	Safety data sheets were not readily available in six classrooms and/or labs. Three
exceptions were corrected prior to the issuance of report.	Correction plan is in progress.	COO; Campus
Manager, ATTC	Complete
5/1/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
	3	One lab in Codwell Hall and two classrooms in the Automotive Tech Training Center did not contain an accurate inventory list of hazardous chemicals known to be present. A chemical inventory list was added to Codwell Hall, Room 229, prior to the
issuance of report.	Correction plan is in progress.	COO; Campus Manager, ATTC	Complete 7/5/2024	
	4	Three classrooms did not have appropriate hazard signs present. All exceptions were
corrected prior to the issuance of report.	All action plans have been completed.	COO	Complete
4/24/2024	
	5	Two classrooms did not have all hazardous or flammable chemicals stored in a NFPA approved flammable storage cabinets. The exception in the Automotive Tech Training Center was corrected on site by the automotive department dean. The exception for Codwell Hall was resolved prior to issuance of report.	All action plans have been completed.	COO	Complete 4/24/2024	
	6	Obstruction of areas around a fire extinguisher was noted in one classroom. The
obstruction was cleared prior to issuance of report.	All action plans have been completed.	COO	Complete
4/24/2024	
	7	One classroom contained a fire extinguisher with no indication of annual inspection. The noted exception was corrected prior to issuance of report.	All actions plans have been completed.	EHS Manager	Complete 4/24/2024	
	8	One classroom did not have a Hazard Communication Program and/or Chemical Hygiene Work Plan readily available for a flammable chemical found in the room. Department personnel removed the flammable item from classroom, removing need for Hazard Communication program as no other chemicals were found to be
present.	All actions plans have been completed.	COO	Complete 4/24/2024	
	9	One classroom did not have appropriate spill containment of hazardous material.
Spill containment was put in place prior to issuance of report.	All actions plans have been completed.	COO	Complete
4/24/2024	
	10	A fume hood in one classroom was not working properly. The fume hood had been
inspected and certified, but an error code was being displayed.	The fume hood has been repaired.	EHS Manager	Complete
4/24/2024	
	11	One prep room had chemicals stored under a fume hood. The exception was corrected on site as the lab tech removed the chemicals stored under the fume
hood.	All action plans have been completed.	COO; Campus Managers	Complete 4/24/2024	
	12	One classroom with electrical equipment was not properly wired for isolating, securing, or blocking machines or equipment from energy sources.	All action plans have been completed.	Program Director CE
Construction; EHS Manager	Complete 4/24/2024	
	13	One classroom had gas cylinders that were not properly and adequately secured to prevent accidents or damage to the cylinders. Corrected prior to the issuance of
report.	All action plans have been completed.	COO; Campus Managers	Complete 4/10/2024	
	
24-C-1-3 Coleman College Campus Safety & Environmental Operations Management	1	Two classrooms/labs did not contain an accurate inventory list of hazardous chemicals. Both noted exceptions were corrected prior to the issuance of this
report.	The exceptions have been corrected.	COO; Campus Managers	Complete 4/16/2024	
	2	Safety data sheets were not readily available in one lab. The noted exception was
corrected prior to the issuance of this report.	The exception has been corrected.	COO; Campus
Manager	Complete
4/16/2024	
	3	Appropriate spill containment was not present in one lab. The exception was
corrected on site by the lab tech.	The exception has been corrected.	Lab Tech	Complete
4/16/2024	
	4	Class SRGT Room 1040 did not have an appropriate eyewash station, as required, by
the chemicals maintained in the room.	Eyewash will be installed.	EHS Manager	Complete
7/31/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	Status/Est
Completion Date	
24-C-2 Senate Bill 17	1	In Internal Audits opinion, HCC executive management has been provided with sufficient training concerning SB 17 compliance through Chancellor Executive Council Task Force Meetings, Accountability and Standards Council meeting presentations, and required executive management attestation certifications. An SB 17 Compliance Resources email was provided to all HCC employees on July 25, 2024, to assist employees in complying with the new mandatory requirements. Employees may not have been diligent in adequately acquainting themselves with the information provided. All employees are responsible for familiarizing themselves and complying with SB 17’s basic requirements. Internal Audit recommends HCC management provide required training for all HCC employees to strengthen the control environment around complying with the new requirements.	OGC is in the process of hiring a Compliance Training Specialist. The plan is for this to be one of their first assignments. It will take several months from the time the person is hired and onboarded around early in the new calendar year.	General Counsel and VC, Talent Engagement & CHRO	In Progress 2/15/2025	
	
24-A-8 Global Internal Audit Standards Transition	1	An effective partnership between the board, senior management and the CAE is essential to enable effective internal auditing and enhance organizational success. All three parties must support each other to enable success. Domain III: Governing the Internal Audit Function, in the Standards, outlines the requirements for the CAE to work closely with the board to establish the internal audit function, position it independently, and oversee its performance. Domain III also outlines senior management’s responsibilities that support the board’s responsibilities and promote strong governance of the internal audit function. While most of the requirements in Domain III are not new, the “essential conditions” presented in Domain III require direct communication and collaboration between the CAE, board, and senior management to enable organizational success. The CAE should establish a plan to meet with the board and senior management to discuss the new Purpose of Internal Auditing under the new Standards and the essential conditions presented in the nine standards in Domain III.	In a start to establishing more direct communication and collaboration between the CAE, board, and senior management, the Director of Internal Audit will make a presentation in the Audit Committee meeting scheduled for October 2, 2024, to introduce the new Standards and the essential conditions.	Director Internal Audit	In Progress 10/2/2024