HOUSTON COMMUNITY COLLEGE

Internal Audit Plan

Fiscal Year 2024

Approved by Board of Trustees August 16, 2023

Internal Audit Plan Fiscal Year 2024

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (IA) will conduct during fiscal year 2024. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act. Significant time is built into the Plan for IA to be responsive to board and management concerns.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2024.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM) (239 risks assessed). The High Risk Audit Candidates are updated in Attachment I based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (23 interviews), 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risk Areas 2023, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan will include some hours for planning for the transition to the new Global Internal Audit Standards that are expected to be published early 2024.

Internal Audit Available Time

Total Hours (7 staff * 262 days *8 hours)	14,672	100%	
Less: Staff Vacancies	0	0%	
Estimated Vacation, Holiday, Sick, and Other	2,928	20%	
Training	840	6%	
Various Meetings & Departmental Administration	2,660	18%	
Total Hours Available for Audits & Other Projects	8,244	56%	

Description of Project Types

Operational: These are projects in which some activity or other management assertion is evaluated so that improvements to operating efficiency and effectiveness can be made. These can also be projects in which the object is to develop new information on an activity so that management can use that information in their decision-making process.
Compliance: Reviews focused on ensuring compliance with regulations and HCC policies.
Advisory Services: Consulting projects that improve management of risks, add value, and improve the organization’s operations, including special projects requested by the Board or management, participating in HCC committees and task forces, and providing investigation services.
Administrative: Administrative projects within the department such as performing enterprise risk assessments, preparing the next fiscal year’s audit plan, performing quality assurance, preparing the Annual Audit Report, newsletters, and lunch & learns.
Observation action plan follow-ups: These are on-going status reviews on the resolution of deficiencies identified in past audits to ensure management completed action plans.

FY 2024 Internal Audit Plan
No.	Project	Description	Hours	
Operational Audit Projects	
22-O-1	*Deferred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	480	
23-O-1	*Asset Management	Review HCC's operating process for safeguarding assets and ensuring compliance with Board and departmental policies and procedures. Completion of Facilities and IT areas	160	
24-O-1	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery including compliance with regulations and HCC policies.
Additionally, IA will attend and observe the annual disaster recovery
exercise	640	
24-O-2	Student Mental Health	Review HCC's program for addressing student mental health issues, BITAT processes, and plans to address Human Trafficking risk mitigation	480	
Compliance Audit Projects	
19-C-2	*Web Content Accessibility Guidelines Review - Follow-up	Review the implementation of CR2 (REGULATION) to ensure that qualified individuals with disabilities have access to the College District’s technology resources	120	
21-C-2	*Cares Act - HEERF III	Review management process to ensure compliance with terms	160	
23-C-2	*Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures	480	
23-C-3	*Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures	480	
24-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews	320	
24-C-1-1	Central College	Safety & environmental legal policy compliance	240	
24-C-1-2	Northeast College	Safety & environmental legal policy compliance	240	
24-C-1-3	Coleman College	Safety & environmental legal policy compliance	240	
24-C-2	SB 17	Review steps taken to comply with new state regulations related to DEI	240	
Advisory Services Projects	
19-S-3	*Campus Security	Work with all HCC stakeholders in evaluating the implementation of a Campus Security Program	80	
24-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice	240	
24-S-2	Special Projects & Examinations	Responsive to provide services as required	1,600	
24-S-2-1	New State Funding Model Transition	Monitoring information on plan for transitioning to new state funding model based on "credentials of value"		
24-S-2-2	Security Program Dashboard Updates	Report update on Security Program Dashboard and HCC policy establishment		
24-S-2-3	Student Enrollment Information	Student enrollment projections by program and related "credentials of Value" for state funding		
24-S-2-4	Facilities and Property Information	Report on HCC's facilities & properties, including a report on ROC projects and status		
24-S-2-5	Succession Planning Information	Report on HCC's succession planning		
24-S-2-6	Complaints Grievance Process Information	Report on details related to the complaint’s grievance process		
24-S-2-7	Annual THECB Analysis	Competition benchmarking report using THECB Annual report		
24-S-2-8	Contracted Services Report	Report on contracted services payments		
24-S-2-9	Less Than $100,000 Payments Report	Vendor payments report on under the chancellor’s signatory authority activity		

FY 2024 Internal Audit Plan (Cont’d)

No.	Project	Description	Hours	
Administrative Projects	
24-A-1	FY 2025 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning	720	
24-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement	320	
24-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	320	
24-A-4	FY 2024 Annual Audit Report	Compile and prepare State required annual audit report	40	
24-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans	80	
24-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	160	
24-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	80	
24-A-8	Global Internal Audit Standards Transition	IA transitioning to the new Institute of Internal Auditors “Global Internal Audit Standards” expected to be published early 2024	80	
Observation Action Plan Follow-ups	
24-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	244	
* Carry-over/continued projects from FY 2023 Internal Audit Plan	

Attachment I

FY 2024
High Risk Audit Candidates

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Financial	

Enrollment - growth, retention, contraction	
New state funding model based on “Credentials of Value”. Decline in enrollment, increased tuition discounting reducing income, competitive market for students increasing cost to attract students, increasing costs to support student success.	
24-S-2-1 New State Funding Model Transition
24-S-2-3 Student Enrollment Information	

Public safety	

Campus security & safety	Campus safety standards, door locking (classrooms and exterior), new hire security/emergency response training, responsibility for interior routine security, staffing of remote/low utilization areas, operating hours, open campus access, student and employee badging enforcement, campus safety committees, surveillance camera standards, access, usage, intra building communication systems	
24-S-2-2 Security Program Dashboard Updates Berkeley Research Group –
security & safety program review 19-S-3 Campus Security	

Community	

Policing	Fire arms, arrest authority, coordination between College and local police, training (diversity, crowd control), oversight and external review, undercover work, campus versus community policing, prisoner control, confiscated property control, community outreach and education, timely and appropriate call response, adequate staff, "blue phones," incident reporting, statistics capture and reporting, communication and communication media	24-S-2-2 Security Program Dashboard Updates Berkeley Research Group –
security & safety program review 19-S-3 Campus Security
17-4 Campus Safety and Security -
Title IX/Clery/VAWA Regulatory Acts Compliance	

Technology	

Systems Access	

System access privileges (initial, change in person's status, terminations), access security (user id/password/biometric), security, policy, performance audit/review, application across platforms, ease of use	24-O-1 IT Disaster Recovery Rapid 7 – pen testing
23-C-2 PCI Data Security Standard 22-O-2 IT Cyber & Data Security and Governance
22-O-3 IT Disaster Recovery 21-O-2 IT Active Directory & Windows Server
19-O-3 IT Disaster Recovery-BCP 18-O-3 PS Applications Controls
17-3 IT Cyber and Data Security	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Financial	

Deferred maintenance	
Identification/prioritization of maintenance, adequate budget, efficient maintenance/preventative maintenance program, maintenance tracking/reporting	24-S-2-4 Facilities and Property Information
22-O-1 Deferred Maintenance AGCM - construction project management	

Governance/Institutional Management	

Leadership Continuity	
Hiring/retention of capable leaders; board/executive training; conflict of interest/commitment; strategic plan; lack of an effective policy setting, communication and monitoring process	

24-S-2-5 Succession Planning Information	

Human Resources	

Employment - recruitment, retention, succession planning	Faculty (oversight of faculty recruitment, retention, development and turnover), ability to attract qualified candidates (uncompetitive pay/working conditions/institution changes), selection/hiring/on- boarding process; accurate job descriptions/pay classifications; performance evaluation process; termination process; succession planning for aging faculty, leadership and staff (recruitment in advance of need, development of internal potential candidates, overlap of incumbent and new candidate, detailed description of
recurring duties/current and future challenges, access to former employee)	

24-S-2-5 Succession Planning Information	

Gender-related issues	

Title IX, SB 212, and SB 17	

Title IX compliance, sexual assault, equal athletic opportunity for men/women in sports. Efforts to combat sexual assault by creating new cultural norms on campus. Applicability to events "off campus" or involving individuals not part of the campus community. Dept. of Education exemptions to religious institutions. SB 212 mandatory reporting requirements. SB 17 new state DEI regulations compliance	
24-S-2-6 Complaints Grievance Process Information
24-C-2 SB 17
23-C-3 Title IX New Regulations THECB HB-1735 review
21-C-4 Title IX New Regulations 21-C-5 SB 212
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory Acts Compliance	

Competition	

Competition from diverse education providers	Pandemic impact on education. Response to competition (for-profit universities, foreign universities, on-line learning, accelerated learning, curriculum enhancements, improved facilities, high schools and two-year colleges, etc.), appreciation/adjustment to educational competitors from various sectors and directions, institutional need for clear differentiation, a demonstrable value proposition, organizational flexibility, financial strength, ability to overcome procedural
inertia/inward focus/market insensitivity, growing interest in education in the trades, short-term intensive training (boot camps).	

24-S-2-7 Annual THECB Analysis Huron Consulting
Kennedy & Company - consulting 20-O-1 Enrollment	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Students	
At-risk students	Behavioral Intervention Teams, Management of Student Misconduct, Threat identification and follow up. Plans to address Human Trafficking risk mitigation.	
24-O-2 Student Mental Health	

Safety	

Fire/Life and lab life safety (including code compliance)	Lab safety for academic and COE labs. Lab safety manuals, inspections, signage, Compliance, chemical inventory, inventory control, transporting and shipping, reporting, chemical storage and disposal, select agents, hazardous materials/environmental safety program, personal projective equipment, training, inspections and monitoring, liability and insurance, emergency response program. Building design, construction, fire detection/suppression systems and maintenance, building codes, insurance company requirements, best practices, building evacuation plans/signage meet TX School Safety Center requirements, drills for fire/tornado/earthquake and other emergencies, annunciation/communication within building, contents
combustibility, inspections and compliance reviews	

IA FY 2017 through 2024 Campus Safety & Environmental Reviews covering all six colleges