HOUSTON COMMUNITY COLLEGE

Internal Audit Plan

Fiscal Year 2022

Approved by Board of Trustees August 18, 2021

Internal Audit Plan Fiscal Year 2022

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (the Department) will conduct during fiscal year 2022. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Programin FY 2022.

Plan Development Methodology

1. The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates are updated in Attachment I based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risks and Focus Areas for 2021, 7) standards for the professional practice of internal auditing, Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

Internal Audit Available Time

Total Hours (7 Staff * 52 Weeks *40 hours)	14,560	100%	
Less: Staff Vacancies	0	0%	
Estimated Vacation, Holiday, Sick, and Other	2,624	18%	
Training	840	6%	
Various Meetings & Departmental Administration	2,660	18%	
Total Hours Available for Audits & Other Projects	8,436	58%	

Description of Project Types

Operational: These are projects in which some activity or other management assertion is evaluated so that improvements to operating efficiency and effectiveness can be made. These can also be projects in which the object is to develop new information on an activity so that management can use that information in their decision making process.

Compliance: Reviews focused on ensuring compliance with regulations and HCC policies.

Advisory Services: Consulting projects that improve management of risks, add value, and improve the organization’s operations.

Administrative: These include fraud investigations, special projects requested by the Board or management, and administrative projects within the department such as performing risk assessments, preparing the next fiscal year’s audit plan, performing quality assurance, preparing the Annual Audit Report, newsletters, and lunch & learns.

Observation action plan follow-ups: These are on-going status reviews on the resolution of deficiencies identified in past audits to ensure management completed action plans.

FY 2022 Internal Audit Plan
No.	Project	Description	Hours	
Operational Audit Proj ects	
20-O-1	*Enrollment	Review enrollment streamlining to facilitate student growth and
retention including coordination with financial aid	480	
21-O-3	*IT Governance	IT management of business requirements and optimization to deliver
functionality, dependability, & support	480	
21-O-5	*Construction Cost Management	Focusing on the WHE project, review process for competitive
contracting compliance with regulations, invoice payment approvals, accounting, and HCC policies & procedures compliance	320	
22-O-1	Deferred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	480	
22-O-2	IT Cyber & Data Security	High level general controls review of the information technology
data security management system	640	
22-O-3	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery
including compliance with regulations and HCC policies. Additionally IA will attend and observe the annual disaster recovery exercise.	480	
Compliance Audit Proj ects	
19-C-2	*Web Content Accessibility Guidelines
Review - Follow-up	Review the implementation of CRB (REGULATION) to ensure that
qualified individuals with disabilities have access to the College District’s technology resources	120	
21-C-1	*Campus Safety & Environmental
Operations Management	Planning for campus safety & environmental legal policy compliance
management reviews	320	
21-C-1-1	*Central College	Safety & environmental legal policy compliance	240	
21-C-1-2	*Northeast College	Safety & environmental legal policy compliance	240	
21-C-1-3	*Coleman College	Safety & environmental legal policy compliance	240	
21-C-2	*Cares Act - HEERF II & III	Review management process to ensure compliance with terms	480	
22-C-1	Pcard Process	Review propriety of the Pcard process & activity compliance with
program procedures. External audit management letter resolution.	400	
22-C-2	Below $100,000 Procurements Review	Review procurement activity below $100,000 for compliance with
regulations and HCC policies & procedures	400	
22-C-3	Procurement Contracting Review	Review the general contracting process for compliance with
regulations and HCC policies & procedures	400	
Adv isory Serv ices Projects	
19-S-3	*Campus Security	Work with all HCC stakeholders in evaluating the implementation of
a Campus Security Program	480	
21-S-4-3	*Strategic Plan Metrics Reporting Review	Review the propriety of progress reporting to the BOT using the
Strategic Plan’s performance metrics	60	
22-S-1	Committees & Task Forces	Participate on committees and task forces providing risk
management and control advice	240	
22-S-2	Special Projects & Examinations	Responsive to provide services as required	296	
Administrativ e Projects	
22-A-1	FY 2023 Audit Planning & ERM
Assessment	Collaborate with HCC Risk Management to update the Enterprise
Risk Management (ERM) assessment & audit planning	560	
22-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement	80	
22-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	320	
22-A-4	FY 2022 Annual Audit Report	Compile and prepare State required annual audit report	120	
22-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation
action plans	80	
22-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on
fraud deterrence, risk management, internal control & compliance	160	
22-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud
deterrence, risk management, internal control & compliance	160	
Observ ation Action Plan Follow -ups	
22-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	160	
* Carry-over/continued projects from FY 2021 Internal Audit Plan	

Attachment I

FY 2022
High Risk Audit Candidates

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Public safety	

Campus security & safety	Campus safety standards, door locking (classrooms and exterior), new hire security/emergency response training, responsibility for
interior routine security, staffing of remote/low utilization areas, operating hours, open campus access, student and employee badging enforcement, campus safety committees, surveillance camera standards, access, usage, intra building communication systems	

Berkeley Research Group – security & safety program review 19-S-3 Campus Security	

Financial	
Enrollment - growth, retention, contraction	Decline in enrollment, increased tuition discounting reducing income, competitive market for students increasing cost to attract students, increasing costs to support student success.	Kennedy & Company - consulting
20-O-1 Enrollment
19-O-2 International Students Services Review	

Gender-related issues	

Title IX & SB 212	Title IX compliance, sexual assault, equal athletic opportunity for men/women in sports. Efforts to combat sexual assault by creating new cultural norms on campus.  Applicability to events "off campus" or involving individuals not part of the campus community. Dept. of Education exemptions to religious institutions. SB 212 mandatory reporting requirements.	THECB HB-1735 review
21-C-4 Title IX New Regulations 21-C-5 SB 212
17-4 Campus Safety and Security -
Title IX/Clery/VAWA Regulatory Acts Compliance	

Financial	

Grants - compliance with requirements of grant	

Funds used in compliance with terms of grant, accurate/timely reporting, impact on operations/employment when grant expires, proper accounting, failure to use all grant funds	Martinez Partners/McConnell & Jones Whitley Penn – single audit Regulatory audits
Husch Blackw ell – CARES advisory
21-C-2 Cares Act
21-C-6 Grants Compliance NASFAA – financial aid program review	

Financial	Deferred maintenance	Identification/prioritization of maintenance, adequate budget, efficient maintenance/preventative maintenance program, maintenance tracking/reporting	m Strategic Partners - construction project management
22-O-1 Deferred Maintenance	

Financial	

Construction	Capital/construction plan, project prioritization, building design, competitive contracting, skilled contractors, project oversight, scope creep, project delivery on time/budget, fund raising strategy success, construction deficiencies, fraud, capital to pay for projects, vicarious liability for construction accidents	m Strategic Partners - construction project management
21-O-5 Construction Cost Management	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	

Community	

Policing	Fire arms, arrest authority, coordination between College and local police, training (diversity, crowd control), oversight and external review, undercover work, campus versus community policing, prisoner control, confiscated property control, community outreach and education, timely and appropriate call response, adequate staff, "blue phones," incident reporting, statistics capture and reporting, communication and communication media	Berkeley Research Group – security & safety program review 19-S-3 Campus Security
17-4 Campus Safety and Security - Title IX/Clery/VAWA Regulatory Acts Compliance	

Technology	

Access	
System access privileges (initial, change in person's status, terminations), access security (user id/password/biometric), security, policy, performance audit/review, application across platforms, ease of use	Myers & Stauffer – pen testing 21-O-2 IT Active Directory &
Windows Server
19-O-3 IT Disaster Recovery-BCP 18-O-3 PeopleSoft Applications Controls
17-3 IT Cyber and Data Security	

Competition	

Competition from diverse education providers	Response to competition (for-profit universities, foreign universities, on-line learning, accelerated learning, curriculum enhancements, improved facilities, high schools and two-year colleges, etc.), appreciation/adjustment to educational competitors from various sectors and directions, institutional need for clear differentiation, a demonstrable value proposition, organizational flexibility, financial strength, ability to overcome procedural inertia/inward focus/market insensitivity, growing interest in education in the trades, short-term intensive training (boot camps).	

Kennedy & Company - consulting 20-O-1 Enrollment	
Students	At-risk students	Behavioral Intervention Teams, Management of Student Misconduct, Threat identification and follow up.	19-O-1 Student Behavioral Intervention Review	

Safety	

Fire/Life and lab life safety (including code compliance)	Lab safety for academic and COE labs. Lab safety manuals, inspections, signage, Compliance, chemical inventory, inventory control, transporting and shipping, reporting, chemical storage and disposal, select agents, hazardous materials/environmental safety program, personal projective equipment, training, inspections and monitoring, liability and insurance, emergency response program. Building design, construction, fire detection/suppression systems and maintenance, building codes, insurance company requirements, best practices, building evacuation plans/signage meet TX School Safety Center requirements, drills for fire/tornado/earthquake and other emergencies, annunciation/communication within building, contents combustibility, inspections and compliance reviews	

IA FY 2017/2018/2019/2020/2022
Campus Safety & Environmental Reviews covering all six colleges	
Human resources	Distance learning	Obtaining sufficient faculty who are proficient at online course
delivery. Successfully adapting curricula	COVID response	

Risk Category	Risk Area	Risk Factors	Internal & External Audit and Consultant Coverage	
Students	Veterans	Compliance with Department of Veterans Affairs program requirements for programs serving veterans of the armed forces	Regulatory reviews	

Financial	
Insurance	Adequacy/cost effectiveness of insurance coverage, governance, adequacy of enterprise risk management program, insurance/claims/policy management	
Charlesworth Consulting – insurance program evaluation