HOUSTON COMMUNITY COLLEGE

Internal Audit Plan

Fiscal Year 2023

Approved by Board of Trustees August 17, 2022

Internal Audit Plan Fiscal Year 2023

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (the Department) will conduct during fiscal year 2023. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2023.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates are updated in Attachment I based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program,
6) KPMG Internal Audit Key Risks and Focus Areas for 2022, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

Internal Audit Available Time

Total Hours (7 Staff * 52 Weeks *40 hours)	14,560	100%	
Less: Staff Vacancies	0	0%	
Estimated Vacation, Holiday, Sick, and Other	2,944	20%	
Training	840	6%	
Various Meetings & Departmental Administration	2,660	18%	
Total Hours Available for Audits & Other Projects	8,116	56%	

Description of Project Types

Operational: These are projects in which some activity or other management assertion is evaluated so that improvements to operating efficiency and effectiveness can be made. These can also be projects in which the object is to develop new information on an activity so that management can use that information in their decision-making process.

Compliance: Reviews focused on ensuring compliance with regulations and HCC policies.

Advisory Services: Consulting projects that improve management of risks, add value, and improve the organization’s operations.

Administrative: These include fraud investigations, special projects requested by the Board or management, and administrative projects within the department such as performing risk assessments, preparing the next fiscal year’s audit plan, performing quality assurance, preparing the Annual Audit Report, newsletters, and lunch & learns.

Observation action plan follow-ups: These are on-going status reviews on the resolution of deficiencies identified in past audits to ensure management completed action plans.

FY 2023 Internal Audit Plan

No.	Project	Description	Hours	
Operational Audit Projects	
20-O-1	*Enrollment	Review enrollment streamlining to facilitate student growth and retention including coordination with financial aid	800	
21-O-5	*Construction Cost Management	Focusing on the WHE project, review process for competitive contracting compliance with regulations, invoice payment approvals, accounting, and HCC policies & procedures compliance	120	
22-O-1	*Deferred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	640	
22-O-2	*IT Cyber & Data Security and Governance	Evaluate the controls in place to limit the spread and impact of ransomware. And review management of business requirements and optimization to deliver functionality, dependability, and support
by IT	800	
23-O-1	Asset Management	Review HCC's operating process for safeguarding assets and ensuring compliance with Board and departmental policies and procedures	640	
Compliance Audit Projects	
19-C-2	*Web Content Accessibility Guidelines Review - Follow-up	Review the implementation of CR2 (REGULATION) to ensure that qualified individuals with disabilities have access to the College District’s technology resources	120	
21-C-2	*Cares Act - HEERF III	Review management process to ensure compliance with terms	400	
23-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews	320	
23-C-1-1	Northwest College	Safety & environmental legal policy compliance	240	
23-C-1-2	Southeast College	Safety & environmental legal policy compliance	240	
23-C-1-3	Southwest College	Safety & environmental legal policy compliance	240	
23-C-2	Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures	480	
23-C-3	Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures.	480	
23-C-4	Board Expenditures	Board expenditures as defined under Board Bylaws Article H: Board Operations, 2. Expenditures compliance review	120	
Advisory Services Projects	
19-S-3	*Campus Security	Work with all HCC stakeholders in evaluating the implementation of a Campus Security Program	80	
23-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice	240	
23-S-2	Special Projects & Examinations	Responsive to provide services as required	120	
Administrative Projects	
23-A-1	FY 2024 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning	720	
23-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement	320	
23-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	320	
23-A-4	FY 2023 Annual Audit Report	Compile and prepare State required annual audit report	40	
23-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans	80	
23-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	160	
23-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	80	
Observation Action Plan Follow-ups	
23-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	316	
* Carry-over/continued projects from FY 2022 Internal Audit Plan	

Attachment I

FY 2023
High Risk Audit Candidates

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Public safety	

Campus security & safety	Campus safety standards, door locking (classrooms and exterior), new hire security/emergency response training, responsibility for interior routine security, staffing of remote/low utilization areas, operating hours, open campus access, student and employee badging enforcement, campus safety committees, surveillance camera standards, access, usage, intra building communication
systems	

Berkeley Research Group – security & safety program review 19-S-3 Campus Security	

Community	

Policing	Fire arms, arrest authority, coordination between College and local police, training (diversity, crowd control), oversight and external review, undercover work, campus versus community policing, prisoner control, confiscated property control, community outreach and education, timely and appropriate call response, adequate staff, "blue phones," incident reporting, statistics capture and reporting, communication and communication media	Berkeley Research Group – security & safety program review 19-S-3 Campus Security
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory Acts Compliance	

Financial	
Enrollment - growth, retention, contraction	Decline in enrollment, increased tuition discounting reducing income, competitive market for students increasing cost to attract students, increasing costs to support student success.	Kennedy & Company - consulting 20-O-1 Enrollment
19-O-2 International Students Services Review	

Competition	

Competition from diverse education providers	Response to competition (for-profit universities, foreign universities, on-line learning, accelerated learning, curriculum enhancements, improved facilities, high schools and two-year colleges, etc.), appreciation/adjustment to educational competitors from various sectors and directions, institutional need for clear differentiation, a demonstrable value proposition, organizational flexibility, financial strength, ability to overcome procedural inertia/inward focus/market
insensitivity, growing interest in education in the trades, short-term intensive training (boot camps).	

Kennedy & Company - consulting 20-O-1 Enrollment	

Technology	

Systems Access	

System access privileges (initial, change in person's status, terminations), access security (user id/password/biometric), security, policy, performance audit/review, application across platforms, ease of use	Myers & Stauffer – pen testing 23-C-2 PCI Data Security Standard
22-O-2 IT Cyber & Data Security and Governance
22-O-3 IT Disaster Recovery 21-O-2 IT Active Directory & Windows Server
19-O-3 IT Disaster Recovery-BCP 18-O-3 PS Applications Controls 17-3 IT Cyber and Data Security	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Financial	

Deferred maintenance	
Identification/prioritization of maintenance, adequate budget, efficient maintenance/preventative maintenance program, maintenance tracking/reporting	
AGCM - construction project management
22-O-1 Deferred Maintenance	

Gender-related issues	

Title IX & SB 212	Title IX compliance, sexual assault, equal athletic opportunity for men/women in sports. Efforts to combat sexual assault by creating new cultural norms on campus. Applicability to events "off campus" or involving individuals not part of the campus community. Dept. of Education exemptions to religious institutions. SB 212 mandatory reporting requirements.	THECB HB-1735 review 23-C-3 Title IX
21-C-4 Title IX New Regulations 21-C-5 SB 212
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory
Acts Compliance	

Safety	

Fire/Life and lab life safety (including code compliance)	Lab safety for academic and COE labs. Lab safety manuals, inspections, signage, Compliance, chemical inventory, inventory control, transporting and shipping, reporting, chemical storage and disposal, select agents, hazardous materials/environmental safety program, personal projective equipment, training, inspections and monitoring, liability and insurance, emergency response program. Building design, construction, fire detection/suppression systems and maintenance, building codes, insurance company requirements, best practices, building evacuation plans/signage meet TX School Safety Center requirements, drills for fire/tornado/earthquake and other
emergencies, annunciation/communication within building, contents combustibility, inspections and compliance reviews	

IA FY 2017/2018/2019/2020/2022
Campus Safety & Environmental Reviews covering all six colleges	

Financial	

Grants - compliance with requirements of grant	

Funds used in compliance with terms of grant, accurate/timely reporting, impact on operations/employment when grant expires, proper accounting, failure to use all grant funds	Martinez Partners/McConnell Jones Whitley Penn – single audit Regulatory audits
Husch Blackwell – CARES advisory 21-C-2 Cares Act
21-C-6 Grants Compliance NASFAA – financial aid program review	

Financial	

Construction	Capital/construction plan, project prioritization, building design, competitive contracting, skilled contractors, project oversight, scope creep, project delivery on time/budget, fund raising strategy success, construction deficiencies, fraud, capital to pay for projects, vicarious liability for construction accidents	m Strategic Partners - construction project management
21-O-5 Construction Cost Management