HOUSTON COMMUNITY  COLLEGE

Internal Audit Annual Report Fiscal Year 2022
in Accordance with the Texas Internal Auditing Act

Prepared by Internal Audit Department
Terry Corrigan, Director Internal Audit

Table of Contents

SECTION
Internal Audit Plan for Fiscal Year 2022	I
Quality Assurance Review	II
Summary of Observations & Management Action Plans	III
List of Consulting Engagements and Non-audit Services Completed.	IV
Internal Audit Plan for Fiscal Year 2023	V
External Audit Services – Fiscal Year 2022	VI
Reporting Suspected Fraud and Abuse	VII
Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit
Annual Report, and Other Audit Information on the HCC Website	VIII

Internal Audit Plan for Fiscal Year 2022

The Board of Trustees approved the FY 2022 Internal Audit Plan on August 18, 2021. The HCC audit universe was developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates are updated based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risks and Focus Areas for 2021, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

A FY 2022 Internal Audit Plan Status Report is detailed in the following table.

I

Houston Community College	Internal Audit Annual Report

FY 2022 Internal Audit Plan Status Report as of August 31, 2022

Audit Projects	Project Number	
Stage	Report Issued	
Notes/Issues	
Operational Audit Projects					
Enrollment	20-O-1	Planning		Roll over to FY 2023 Plan	
IT Governance	21-O-3	Planning		Roll over to FY 2023-Combine w/ Cyber&Data Security	
Construction Cost Management	21-O-5	Fieldwork		Roll over to FY 2023 Plan	
Deferred Maintenance	22-O-1	Planning		Roll over to FY 2023 Plan	
IT Cyber & Data Security	22-O-2	Planning		Roll over to FY 2023 Plan	
IT Disaster Recovery	22-O-3	Complete	07/20/22	Final audit report issued Wednesday, 7/20/2022	
Compliance Audit Projects					
Web Content Accessibility Guidelines Review	19-C-2	Implementing	N/A	On hold - program being established based on ITCA	
Campus Safety & Environmental Operations Management	21-C-1	Complete	N/A	Planning for all three colleges	
Central College	21-C-1-1	Complete	06/28/22	Final audit report issued Tuesday, 6/28/2022	
Northeast College	21-C-1-2	Complete	06/30/22	Final audit report issued Thursday, 6/30/2022	
Coleman College	21-C-1-3	Complete	06/27/22	Final audit report issued Monday, 6/27/2020	
Cares Act - HEERF II	21-C-2	Complete	08/30/2022	Interim report for II; III Roll over to FY 2023 Plan	
Pcard Process	22-C-1	Complete	05/31/22	Final audit report issued Tuesday, 5/31/2022	
Below $100,000 Procurements Review	22-C-2	Complete	07/13/22	Final audit report issued Wednesday, 7/13/2022	
Procurement Contracting Review	22-C-3	Complete	8/26/2022	Final audit report issued Friday, 8/26/2022	
Advisory Services Projects					
Campus Security	19-S-3	Implementing	N/A	On hold - using BRG report to establish a program	
Committees & Task Forces	22-S-1	N/A	N/A		
Special Projects & Examinations	22-S-2	N/A	N/A		
Administrative Projects					
FY 2023 Audit Planning & ERM Assessment	22-A-1	Complete	08/03/22	FY2022 IA Plan presented Wednesday, 8/3/2022	
TeamMate IA Management System	22-A-2	Implementing	N/A	Migrated from TM-AM to TM+	
Internal Quality Assurance Review	22-A-3	Complete	08/31/2022	Final audit report issued Wednesday, 8/31/2022	
FY 2022 Annual Audit Report	22-A-4	Complete	10/06/22	FY2022 annual report presented Thursday, 10/6/2022	
External Audits Monitoring	22-A-5	Ongoing	N/A		
Lunch and Learns	22-A-6	Ongoing	N/A		
Newsletters	22-A-7	Ongoing	N/A		

I-1

Quality Assurance Review

An external quality assurance review (EQAR) was performed by Basil Woller and Associates (Basil Woller) on the Internal Audit Department in FY 2021, in compliance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards). The review was an independent validation of the assertions and conclusions made in the internal audit report “20-A-3 IA Internal Quality Assurance Review” issued by the HCC’s Internal Audit Department on June 23, 2020. Basil Woller’s report issued May 7, 2021, concurred with the Internal Audit self-assessment, that HCC’s Internal Audit Department generally conforms with the Standards and the IIA Code of Ethics. This level of conformance is the top rating and demonstrates a clear intent and commitment to achieving the Core Principles and the Definition of Internal Auditing.

The HCC Internal Audit Department completed the following quality assurance activities during FY 2022:
Collaborated with the Risk Management Office to update and complete the annual Enterprise Risk Management Assessment for HCC.
An internal quality assurance review was performed.
Internal Audit Charter revisions defining IA's functional reporting relationship with the Audit Committee were made and approved by the Board in the April 20, 2022, regular board meeting.
An “Internal Audit Charter Matrix” was developed to monitor and report the status of requirements embedded in the Internal Audit Charter. The matrix was presented to the Audit Committee in the February 2, 2022 meeting.
An internal auditing competency framework was developed to support talent and resource management activities within Internal Audit and to demonstrate professional proficiency. The framework was presented to the Audit Committee in the February 2, 2022, meeting.
TeamMate Analytics software was procured and is being used to perform data analytics in all audit projects based on planning assessments.
Migrated the internal audit management software from TeamMate AM to TeamMate+ to take advantage of the enhanced functionality.
The Quality Assurance Improvement Program documentation was updated in the Internal Audit Manual to reflect changes in the IIA Standards.
The periodic internal assessment process was enhanced by evaluating the level of effectiveness or maturity of Internal Audit related to the Core Principles for the professional practice of internal auditing.
Maintained a professional staff with diversified skill sets and professional certifications.
Completed training to maintain professional certifications and to improve knowledge and understanding required to complete audit projects.

Summary of Observation and Management Action Plans

See the detailed FY 2022 Audit Observations and Management Action Plans Attachment to this report

List of Consulting Engagements and Non-audit Services Completed

Internal Audit provided a lunch and learn on “Fraud Awareness”. Members of the Internal Audit Department participated on the following councils, task forces, and committees in FY 2022:

Compliance Partners Council

Internet and Communication Technology and Accessibility Committee (ICTA)

Procurement Contract Evaluation Committees

Candidates for Hiring Screening Committees

Internal Audit Plan for Fiscal Year 2023

The HCC Board of Trustees approved the Fiscal Year 2023 Internal Audit Plan on August 17, 2022.

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (the Department) will conduct during fiscal year 2023. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2023.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates in the plan are based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risks and Focus Areas for 2022, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

Internal Audit Department Fiscal Year 2023 Audit Plan
No.	Project	Description	
Operational Audit Projects	
20-O-1	*Enrollment	Review enrollment streamlining to facilitate student growth and retention including coordination with financial aid	
21-O-5	*Construction Cost Management	Focusing on the WHE project, review process for competitive contracting compliance with regulations, invoice payment approvals, accounting, and HCC policies & procedures compliance	
22-O-1	*Deferred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	
22-O-2	*IT Cyber & Data Security and Governance	Evaluate the controls in place to limit the spread and impact of ransomware. And review management of business requirements and optimization to deliver functionality, dependability, and support by IT	
23-O-1	Asset Management	Review HCC's operating process for safeguarding assets and ensuring compliance with Board and departmental policies and procedures	
Compliance Audit Projects	
19-C-2	*Web Content Accessibility Guidelines Review - Follow-up	Review the implementation of CR2 (REGULATION) to ensure that qualified individuals with disabilities have access to the College District’s technology resources	
21-C-2	*Cares Act - HEERF III	Review management process to ensure compliance with terms	
23-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews	
23-C-1-1	Northwest College	Safety & environmental legal policy compliance	
23-C-1-2	Southeast College	Safety & environmental legal policy compliance	
23-C-1-3	Southwest College	Safety & environmental legal policy compliance	
23-C-2	Payment Card Industry (PCI) Data Security Standard (DSS)	Evaluate controls and other key processes in place to ensure compliance with Payment Card Industry Data Security Standards and to assess the adequacy and effectiveness of relevant policies and procedures	
23-C-3	Title IX	Review operating process to ensure compliance with changing regulations and with Board and departmental policies and procedures.	
23-C-4	Board Expenditures	Board expenditures as defined under Board Bylaws Article H: Board Operations, 2. Expenditures compliance review	
Advisory Services Projects	
19-S-3	*Campus Security	Work with all HCC stakeholders in evaluating the implementation of a Campus Security Program	
23-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice	
23-S-2	Special Projects & Examinations	Responsive to provide services as required	
Administrative Projects	
23-A-1	FY 2024 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning	
23-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement	
23-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	
23-A-4	FY 2023 Annual Audit Report	Compile and prepare State required annual audit report	
23-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans	
23-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	
23-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance	
Observation Action Plan Follow-ups	
23-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	
* Carry-over/continued projects from FY 2022 Internal Audit Plan	

V-1

External Audit Services – Fiscal Year 2022

HCC Procured Services in FY 2022

Texas Mutual Insurance Company – Workers’ Compensation
Whitley Penn – Annual Financial Statements Audit
Corporate Lounge LLC – review to remove the waste, streamline, and implement best practices in HCC’s direct payment process

Regulatory Imposed in FY 2022

Weaver engaged by Houston-Galveston Area Council to perform 2021-2022 Financial Monitoring & Billing Review on contracts 213-21 & 213-22
State Auditor's Office – 2022 Public Funds Investment Act Compliance Assessment
Grants Management Division of National Oceanic and Atmospheric Administration performed a virtual site visit with MBDA’s Business Center
San Jacinto College – FY 2021 Sub-Recipient Monitoring Review for the U.S. National Science Foundation, Louis Stokes B2B Alliance: Harris County Community College Alliance Grant Program
Texas Workforce Commission performed a desk review on HCC’s FY 2021 ACFR to ensure compliance with the U.S. Code of Federal Regulations Part 200, Uniform Guidance, Uniform Grant Management Standards, and State of Texas Single Audit Circular
Texas Workforce Commission subrecipient monitoring review on Apprenticeship Training Program grant agreements
THECB performed an AY 2021 Single Audit Evaluation noting one finding that HCC resolved
Houston-Galveston Area Council’s (H-GAC) Workforce Solutions Quality Assurance Review of the Adult Education and Literacy programs
DOE Emergency Assistance to Institutions of Higher Education FY 2021 OMB circular A-123 C review

Reporting Suspected Fraud and Abuse

HCC has taken the following actions to implement the fraud detection and reporting requirements of Section 7.09 of the 83rd Legislature’s General Appropriations Act, and Texas Government Code, Section 321.022:

All employee mandatory annual Standards of Conduct training has been established.
HCC has established a confidential independent Hotline for people to report suspected fraud, abuse, and unethical behavior. A link to the reporting Hotline is on the HCC website home page. Reporting Hotline information is included in mandatory annual Standards of Conduct training.
The HCC Compliance and Ethics website has a link to the State Auditor’s Office fraud hotline.
In compliance with the reporting requirements of fraud, waste, and abuse, HCC reports all instances of confirmed fraud, waste, and abuse to the State Auditor’s Office.

Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on the HCC Website

TGC, Section 2102.015 was added by House Bill 16 (83rd Legislature, Regular Session) on June 14, 2013. Colleges are required to post certain information on their website. Specifically, Colleges must post the following information within 30 days of approval by the Board of Trustees:
The approved audit plan for the current fiscal year.
The annual audit report for the previous fiscal year.
A detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report.
A summary of the action taken by the College to address concerns raised by the audit plan or annual report.

HCC Internal Audit will submit the Internal Audit Annual Report to the website coordinators for posting on the Internal Audit section of the HCC website no later than 30 days after the HCC Board of Trustees approves the report. The current fiscal year audit plan has been posted to the website. This report includes the TGC, Section 2102.015 standard elements.

FY 2022 Audit Observations and Management Action Plans

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
20-O-2 Business Continuity Plan	1A	The template being used for the risk assessment has not been updated in the overall institutional BCP. A risk assessment has been incorporated in the EOP but the BCP does not reflect this change. The BCP should be updated to reflect the EOP risk assessment. Defining credible events during a risk assessment can ensure that risks are understood and appropriately managed.	The Business Continuity Plan will be revised and updated. The revisions will include the following:
Incorporate the annual hazard and vulnerability risk assessment that is included in the Emergency Operations Plan.
Incorporate lessons learned from the pandemic response including the transition to remote work.
Expand the communications strategies to specifically address public information office functions including media relations.
Incorporate opportunities for improvement identified in after action reviews.
Integrate the testing, training and exercise program into the program used for the Emergency Operations Plan.	Executive Director - Risk Management	1A Completed 11/1/2021	
	1B	A business impact analysis (BIA) should be documented for all HCC critical business areas. We were unable to verify that a BIA exists for all critical areas. The BIA is the foundation of a BCP. BIA is used to identify the critical processes that need to be recovered following a disaster event. An organization is placed at greater risk without a current BIA to provide adequate direction	The completion of the departmental/college specific business continuity plans will require a series of facilitated workshops with the respective departmental/college leadership. The workshops will guide the departments through the completion of department / college specific business continuity plan templates. The department specific continuity plans will include the identification of essential functions / critical processes and the completion of a business impact analysis.	Executive Director - Risk Management	1B In Progress 8/31/2022	
	1C	The HCC overall institutional BCP lacks some documentation. Procedures for how to handle some events are not specifically addressed in the Plan. Some of these events include remote work, media inquiries and pandemic illnesses. In addition, the documentation for the Campus BCPs and the Functional Unit BCPs has not
been completed.		Executive Director - Risk Management	1C In Progress 8/31/2022	
	1D	HCC BCP(s) are not reviewed per the established Review Table included in the overall institutional BCP. BCPs should be reviewed at least annually. The overall institutional plan has not been updated since 2016. While many elements of the BCP have been incorporated into the EOP and updated annually, the BCP does not reflect these changes. The BCP does not include the most recent regulatory guidance. In addition, After Action Reports (AAR), which reflect lessons learned from prior events, have not been incorporated into the BCP. BCPs should be updated formally and timely to reflect updates in regulations and lessons learned from events, tests, trainings, and exercises. BCPs decline over time and become less effective as people, processes and technology change. Changes in the operating environment need to be reflected in the plans		Executive Director - Risk Management	1D Completed 11/1/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2A	HCC should develop a written disaster communication strategy. Risk Management should collaborate with key HCC contacts and personnel to develop documented notification procedures and clearly assign job responsibilities in the event of a disaster. Clear communication during a disaster increases timely and
orderly recovery.	Risk Management will collaborate with Communications, IT, and the HCC Police Department to formalize emergency notification and communications protocols.	Executive Director - Risk Management & Manager - Emergency
Management	In Progress 8/31/2022	
	2B	HCC is not performing regular TT&E as established in the overall institutional BCP. Testing, training and performing exercises of continuity capabilities is essential to demonstrating, assessing and improving HCC’s ability to execute the continuity program, plans, and procedures. Regular TT&E can help ensure the continuity program is becoming progressively more mature.	Testing, training and exercises will be conducted in conjunction with emergency operations plan testing, training, and exercises beginning Fall 2020.	Executive Director - Risk Management & Manager - Emergency Management	Completed 11/29/2021	
	
19-O-3 IT Disaster Recovery/Business Continuity Plan	1	Internal Audit obtained the 2020 IT Disaster Recovery and DR Assurance and Testing Plan for review during fieldwork. The document was last updated and signed off in February 2020. During review of the embedded files within the documents, IA noted that the last modified dates on some documents were not current. Documents such as the network diagram and employee contact information were not current. Additionally primary contact phone numbers, and secondary contacts were not included in the IT Vendor/Service Provider contact list. The most up to date documentation may enhance HCC’s ability to successfully restore critical systems without delay.	As the audit spanned numerous months, Information Technology provided Internal Audit with a large number of supplemental documents, including up-to- date network diagrams, contact information, plan summaries, and ancillary support information. In the next IT DR Plan update, the embedded documents will be linked externally to ensure the referenced documentation is the most up to date and current. Recovery operations and related vendor contact information are tracked and managed by the respective IT team. IT Administrative Services and IT CSN will partner with the recovery operations leads to ensure this data is tracked in the aggregate vendor contact sheet.	Executive Director, Cyber Security & Network	Completed 10/4/2021	
	
18-O-3 PeopleSoft Application Controls	1	Business Application Services Management provided IA with a listing of active PeopleSoft Finance accounts. This listing was compared against the HCC terminated user listing. IA noted two active PeopleSoft Finance accounts that belonged to two HCC employees that retired August 15, 2020. Through discussion with Business Application Services management, it was determined that employee ID numbers are not associated with PeopleSoft Finance user accounts; therefore, when terminations occur, disabling PeopleSoft Finance accounts is a manual process. The two PeopleSoft Finance accounts were disabled on October 5, 2020. The two employees’ active directory accounts were set to status retired and remain active due to a prior existing management decision to allow retired employees to retain an HCC e-mail address to preserve employee benefits.
Controls need improvement to ensure terminated and retired employees’ PS accounts are disabled timely.	Both employees’ Active Directory (AD) accounts reflected terminated (Retired). They remained active in AD in order to allow the retirees to retain their HCC e- mail addresses. IT is working through the development of a process that will be implemented with the following controls to eliminate the noted observation.

Create new retiree email accounts process for retired employees – reducing the need for manual intervention for retiree email account creation and eliminating the possibility of unnecessary user level access to AD authenticated applications via employee AD accounts

Enhance the PeopleSoft Finance system to allow for seamless two-way integration between PeopleSoft and Active Directory to:
Maintain active employee ids within PS Finance
Create an integration process between PS HR and/or Active Directory to allow for real-time automation of account deactivation	IT/CORE Information Technology teams	Complete 4/1/2022
Complete 4/1/2022	
	
21-A-3 External Quality Assurance Review (Basil Woller and Associates)	1	Standard 1000 Purpose, Authority, and Responsibility – Strengthen organizational independence of Internal Audit by specifically defining the nature of the functional reporting relationship with the Audit Committee in the Internal Audit
Charter.	Appropriate Internal Audit Charter revisions defining IA's functional reporting relationship with the Audit Committee will be made in the February 2022 scheduled Charter review.	Director - Internal Audit	Completed 2/2/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2	Standard 1000 Purpose, Authority, and Responsibility – Consider developing and
using an “Internal Audit Charter Matrix” to monitor and report the status of requirements embedded in the Internal Audit Charter.	An “Internal Audit Charter Matrix” will be developed and presented with the February 2022 scheduled Charter review.	Director - Internal Audit	Completed 2/2/2022	
	3	Standard 1210 Proficiency – Consider developing and using an internal auditing
competency framework to support talent and resource management activities within Internal Audit and to demonstrate professional proficiency.	An internal auditing competency framework to demonstrate professional proficiency will be developed with September 1, 2021, targeted implementation.	Director - Internal Audit	Completed 2/2/2022	
	6	Standard 1311 Internal Assessments – Consider enhancing the periodic internal
assessment process by evaluating the level of effectiveness or maturity of Internal Audit related to the Core Principles.	The periodic internal assessment process will be enhanced with a maturity level to Core Principles evaluation included in next internal assessment targeted for June
30, 2022.	Director - Internal Audit	Complete 8/31/2022	
	8	Standard 2050 Coordination and Reliance – Consider enhancing the Internal Audit risk assessment and audit planning process by providing an assurance map in the annual audit plan presentation that describes coverage of risk between
Internal Audit and other providers of assurance for HCC.	An assurance map will be included in the annual audit plan presentation scheduled for August 4, 2021, that describes coverage of risk between Internal Audit and other providers of assurance for HCC.	Director - Internal Audit	Complete 8/3/2022	
	
21-C-4 Title IX New Regulations	1	A discussed two cases with the Title IX Coordinator. The investigations of the two cases were completed and the final investigation reports were issued in spring 2021. For both cases, OIE can modify procedures to ensure that proper documentation exists to support that:
Prompt notification is provided to the complainant and respondent soon after receiving the initial complaint.
The respondent is provided a written notice for initial interviews in a timely fashion.
There are timely and appropriate case notes are made in the Title IX case file.	OIE will update the departmental procedures to ensure that proper documentation exists.	Director, EEO/Compliance & Title IX Coordinator	Completed 9/30/2021	
	
21-O-2 IT Active Directory and Windows Server	1	IA noted Microsoft Windows 7 and Windows Server 2003 still in service. Microsoft officially ended software updates and security patches for Windows 7 in January 2020 and Windows Server 2003 in July 2015. Through discussion with IT network security HCC is aware that Windows 7 and Windows Server 2003 systems are no longer receiving updates. The affected servers are segregated in a separate Virtual Local Area Network (VLAN) with a hardened system configuration. HCC is in the process of upgrading or decommissioning those systems. Computers running operating systems that are no longer receiving security patches may increase the risk that known computer vulnerabilities can
be exploited.	One of the identified Windows Server 2003 will be powered down by 9/30/2021. The second Windows Server 2003 system would have its services migrated to a compliant/supported operating system by December 2021. Upon confirmation of service migration to a new complaint server, the non-compliant server will be decommissioned.
The remaining Microsoft Windows 7 PCs will be upgraded by the end of the first quarter, 2022.	Director, Enterprise Sys Admin Serv; Exec Dir, Campus Tech Serv; Dir, Cyber Security & Compliance	Complete 3/31/2022
In Progress 8/31/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
21-O-4 IT Change Management	1	IA obtained the CM process document for review during fieldwork. This document was last updated in April 2021. This process document serves as the framework that documents the workflow, roles, procedures and policies needed to implement changes. During review of the document, IA noted the following:
Criteria for priority and impact are not defined and fully implemented;
Minimum documentation requirements for different change types are not clearly defined;
ServiceNow is not being utilized as the system of record for storing supporting documentation (test, back-out and verification plans).
The documentation should be updated to reflect the current process, including additional definitions. IT Management, in consultation with Records Management, should consider the extent to which ServiceNow’s document storage capabilities should be used.	Priority and Impact fields will be removed from the Change form, as these fields were only intended for use with ServiceNow (SNOW) Incident SLAs and serve no additional value-added purpose for the Change form. Additionally, by removing these fields from the Change form there is then only one system of record for collection of this information that is contained in the originally intended source system.
IT will work with Records Management to develop an internal process for securely housing critically sensitive information.
In keeping with industry standard best practices security protocols, and to mitigate cyber security threats and attacks, ServiceNow (as an externally vendor hosted system) will not be used to house detailed information related to HCC infrastructure. An internal secured means for housing this critically sensitive information has been operationalized.	Manager Application Development, IT Change Management	Completed
1. 1/12/2022
2. 2/23/2022
3. 2/23/2022	
	2	Formal training for ServiceNow and the CM process was last conducted in 2019. When the CM process document is updated and approved by executive management, IT should consider conducting formalized training, maintaining evidence of attendance and potentially producing an electronic archive that can be used for onboarding new IT employees and for reference. This would reinforce IT personnel’s understanding of the process and individuals’ roles and responsibilities. Additionally, IT had not distributed reports related to change requests since April 2020. Periodic management reports that include metrics and trends related to change requests would bring awareness to items of interest and enhance HCC’s ability for remediation of any failed or rejected changes, meeting
of SLA’s or other issues.	IT Change Management is collaboratively working with the IT Executive Leadership team to set Change Management training goals for IT staff, interns, and contractors for the 2021/2022 calendar year. Going forward, the IT Change Management training calendar will identify and reflect those topics and training initiative timelines as aligned with the vision and business expectations of IT leadership.

A standard reporting feature is already a part of ServiceNow and this will be recommunicated during training.	Manager Application Development, IT Change Management	Complete 6/7/2022	
	
22-C-1 P-Card Process	1A	P-Card program policies and procedures should be communicated in a uniform manner. All P-Card cardholders should be made aware of program revisions and updates timely. Lack of communication causes inconsistent application by cardholders. We reviewed the expense report P-Card transactions submitted in Concur. IA determined that the P-Card was not the correct method of payment for many transactions. The transactions included non-allowable expenditures such as reoccurring charges, food charges, subscriptions, individual registrations and memberships, gift cards, services, and purchases where payment was made via an intermediary processor such as PayPal or Venmo. These are not allowed P- Card transactions according to HCC and P-Card guidelines.
IA also noted that 10 transactions did not have adequate itemized receipts and supporting documentation. Two transactions were posted to incorrect sub account codes. Sales tax was included on one transaction. HCC, as a governmental subdivision under section 501C (3) of the Internal Revenue Code, is exempted from paying Texas sales tax.	The program has started sending communications via HCC News and E-Blast to inform the users when a new update to the P-Card Procedures Manual has been posted to the Travel and Expense Center. Links to this document are also posted under the HCC-Travel and P-Card Expense portal, Procurement Program web page, and Concur Company notes.
Monthly communications will be sent out to P-Card users to remind them of the proper procedures for P-Card use, proper coding of expenses, and required attachments.
Monthly reviews will be conducted via reports extracted from Concur by processor.10% of a processor’s transactions will be reviewed addressing transaction issues such as lack of supporting documentation, food charges, memberships, State of Texas Sales Tax, etc.
Semi-annual reviews will be conducted via reports extracted from Concur auditing 10 % of the overall transactions addressing transaction issues such as lack of supporting documentation, food charges, memberships, etc.	P-Card Program Administrator	Complete 4/28/2022
Complete 5/31/2022
Complete 6/10/2022
Complete 6/10/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	1B	P-Card policies and procedures should be current, consistent and easily accessible on the HCC Intranet. IA observed conflicting or out-of-date P-Card Program information posted in different locations on the Intranet. Information on the Intranet should be reviewed and updated frequently. IA noted that the P-Card Program resources on the Finance & Accounting Travel and Expense Center webpage were updated during our review. All P-Card information on the Intranet should be reviewed and updated accordingly.	The P-Card Procedures Manual has been updated and posted to the Travel and Expense Center. Links to this document were also posted under the HCC-Travel and P-Card Expense portal and Concur Company notes.
The Procurement webpage was updated with a link accessing the Travel and Expense Center.	P-Card Program Administrator	Complete 4/26/2022
Complete 5/6/2022	
	1C	The HCC P-Card Program Guidelines and Procedures Manual should be reviewed and updated routinely. The manual states that gift cards are not allowed.
However, cardholders are allowed to purchase gift cards for students in certain situations. In this case, the manual should be updated to reference the Student Gift Card Purchase Request Form which provides the procedures on how to make student gift card purchases. Routine reviews and updates of the P-Card Program Guidelines and Procedures Manual will help to ensure cardholders are kept abreast of P-Card policies and procedures. IA noted that the P-Card Program Guidelines and Procedures Manual was updated and posted to the Finance & Accounting Travel and Expense Center webpage during our review in February 2022.	The P-Card Procedures Manual has been updated to include the new gift card procedures and required forms.
Program Administrator will review the procedures each semester to make procedural updates.
Program Administrator will send communications via HCC News and E-Blast to inform the users when a new update to the P-Card Procedures Manual has been posted to the Travel and Expense Center. Links to this communication will also be available under the HCC-Travel and P-Card Expense portal, Travel and Expense Center and Concur Company notes.	P-Card Program Administrator	Complete 4/26/2022
Complete 6/15/2022
Complete 4/28/2022	
	2	Continuous P-Card Program training should be provided to all cardholders. New cardholders are required to complete P-Card training in the Percipio employee online learning system before receiving a new P-Card. However, cardholders have not received P-Card training after the initial training consistently. Training should include proper expense coding for cardholders, budget managers and processors to ensure that expenditures are expensed against departmental budgets correctly. Training requirements and completion should be well documented. The Percipio training modules should be reviewed and updated frequently to reflect the changes in the P-Card Program.	P-Card training is mandatory for all new cardholders.
CLP (College Leadership Program) training is currently offered for new managers via WebEx on a monthly basis.
P-Card training will be mandatory for current cardholders on an annual basis via Percipio.
New Live P-Card training will be offered via WebEx and Teams (registration required) as a refresher training.
5 .Training will be developed and offered via WebEx, and Teams for cardholders, budget managers, and processors to address proper coding, supporting documentation requirements, funding sources for accuracy, and procedures compliance offered on a monthly basis.
WebEx and Teams training rosters and quiz results will be stored in the Concur shared drive; Training results conducted in the Percipio Employee Online Learning system (rosters and quizzes) will be stored in Percipio.
P-Card training modules have been updated and will be available to the users
via Percipio.	P-Card Program Administrator	Complete 9/3/2018
Complete 2/25/2022
In Progress 10/3/2022
In Progress 11/1/2022
In Progress 11/1/2022
In Progress 11/1/2022
In Progress 10/3/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3A	P-Card administration should increase the monitoring of cardholder employment status to verify that P-Cards are assigned to, and continue to be held by, individuals who need them to perform their assigned duties. Only active, full-time employees should have active P-Cards. We noted 31 cardholders with active, open P-Card accounts who did not have an active, full-time employment status according to Talent Engagement. These cardholders included four part-time, seven terminated and 20 employees on leave. P-Card administration should monitor all changes in a cardholders’ employment that may cause the cardholder to no longer need a P-Card. P-Cards should be temporarily deactivated when cardholders are on a leave of absence.
P-Card administration should perform a full review of department transfers to determine whether all cardholder transfers have been received and accurately documented. Only eight transfer forms were available on the departmental shared drive and nine completed transfer forms were available in SNOW. IA noted that 3 out of 9 transfer forms in SNOW were submitted more than 30 days after the cardholder transferred departments. IA noted that the P-Card administrator requested that Talent Engagement provide a monthly report of employee departmental transfers and terminations.	P-Card team receives the monthly termination report from Talent Engagement, which is then used to deactivate cards for terminated employees.
P-Card team receives the monthly employee transfer report; contacts the transferring employee and request that the employee completes the transfer form located under the HCC-Travel and P-Card Expense portal within a week of the transfer. Card is temporarily deactivated until transfer form is approved.
P-Card team has requested to add employee position status to the transfer report identifying when employees move from a FT position to a PT position and will deactivate all PT cardholders’ cards.
P-Card team has requested a monthly report for employees on leave to temporarily deactivate the P-Card while the employee is on leave status (upon receipt from Talent Engagement).
P-Card team will begin sending E News and E Blast communications to inform Employees to complete the transfer form on the HCC-Travel & P-Card Expense SNOW portal when transferring departments.
P-Card team will run a Concur report to verify and/or correct employee ID’s and use this information to update their Citibank card profiles.
P-Card team will request an employee transfer report from Talent Engagement for the current fiscal year to ensure all transferred employees’ P-Card records are up to date in the HCC-Travel & P-Card Expense SNOW portal.	P-Card Program Administrator	Complete 8/1/2021
Complete 2/2/2022
Complete 6/15/2022
Complete 6/15/2022
Complete 5/20/2022
Complete 6/15/2022
Complete 6/15/2022	
	3B	IA observed that employee id numbers and names were incorrect or unavailable for some cardholders. P-Card cardholder account information should be accurate and complete. Employee id numbers and names should match official Talent Engagement employment records. Cardholder information, including the dates P- Card accounts were opened and closed, should be easily accessible in the cardholder’s file on the departmental shared drive. Cardholder information should be reviewed and updated frequently to maintain accuracy.	P-Card team will run a Concur report to verify and/or correct employee ID’s and use this information to update their Citibank card profiles.
P-Card team will run a fiscal year quarterly report (P-Card Account Details) from Concur to revise employee ID’s and upload to Citibank for correction of cardholder accounts.	P-Card Program Administrator	Complete 6/15/2022
Complete 6/15/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3C	P-Card Administration should continue to retrieve and audit the files of every P- Card cardholder for completeness and accuracy. Cardholders are required to sign three agreements to participate in the P-Card program. These agreements are the P-Card Application, Citibank Government Purchase Card Setup Form, and the P- Card User Agreement. Cardholders electronically sign a new P-Card User Agreement annually in SNOW. All cardholder P-Card Agreements and training documents are maintained either in SNOW or on the departmental shared drive. IA performed testing to determine the completeness and accuracy of the P-Card Agreements and training documentation. We selected a random sample of 43 active P-Card cardholders and reviewed their P-Card files in SNOW and on the departmental shared drive. Fifteen of the 43 cardholders did not have a Citibank Government Purchase Card Setup Form available. Three of the 43 cardholders did not have a new annual Procurement Card User Agreement available in SNOW. Three cardholders did not have a P-Card cardholder file available on the departmental shared drive. One cardholder did not have files either in SNOW or on the departmental shared drive. Training certificates of completion were not available for 30 of the 43 cardholders.	P-Card team has requested a copy of IA’s audit samples to review the existing cardholders’ files in the Concur share drive and identify any missing documentation (training certificates, Citibank applications, HCC applications and agreements)
Pending the review of the test sample from IA the P-Card team will address the missing documentation including all cardholders. Missing documentation for cardholders stored in Concur share drive prior to July, 2020, will be collected via the HCC-Travel & P-Card Expense SNOW portal from the cardholders with current dates, if the originals are no longer available.
P-Card team will update file folders in the Concur share drive for cardholders missing documentation.	P-Card Program Administrator	Complete 5/2/2022
Complete 5/2/2022
In Progress 11/30/2022	
	3C	IA noted that the number of required Agreements may have changed due to the implementation of the SNOW portal. New P-Card applicants may no longer need to complete a separate Citibank Government Purchase Card Setup Form. IA noted that Agreement procedures are not being consistently applied for all new P-Card applicants.
Every P-Card cardholder should have the required P-Card Agreements and training documentation available either in SNOW or on the departmental shared drive. In addition, cardholders should be required to complete a new P-Card agreement whenever a P-Card is issued with a new account number. Older P-Card Agreements that cannot be uploaded to SNOW should be available in the cardholders’ files on the departmental shared drive.
Changes in cardholders’ single and monthly credit limits should be well documented and maintained. This information should be maintained either in the SNOW portal or in the cardholders’ files on the departmental shared drive.	P-Card team will create a record file for each cardholder containing all required documentation in the HCC-Travel & P-Card Expense SNOW portal.
P-Card team will ensure users are completing the credit limit increase forms in the HCC-Travel & P-Card Expense SNOW portal before the credit limit is granted.	P-Card Program Administrator	In Progress 9/29/2022
Complete 5/20/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3D	P-Card administration should continue to work with IT to maximize the benefits of the HCC Travel & Expense Service Now (SNOW) portal. We observed that some cardholder electronic documents in SNOW were marked as closed/complete but did not have a completed approval workflow. Some cardholder records were missing the required electronic documents. Some fields in the SNOW portal are not being utilized to store cardholder information. This information could be valuable in monitoring cardholder activity. P-Card User Agreements should be available electronically for every cardholder in SNOW for annual completion. In addition, new cardholders should have all required P-Card Agreements available in SNOW.	P-Card team will meet with the IT team to review SNOW Portal capabilities and ensure that we are utilizing the system to its full potential.
Upon gaining access from IT, the P-Card team will ensure that all missing user certificates, agreements, applications etc., are available electronically via the HCC- Travel & P-Card Expense SNOW portal.
Upon gaining access from IT, the P-Card team will begin moving all files to the HCC-Travel & P-Card Expense SNOW portal to eventually have everything in one platform.
As of May 2021, all P-Card agreements are stored in the HCC-Travel & P-Card Expense SNOW portal.	P-Card Program Administrator	Complete 6/15/2022
Complete 7/29/2022
Complete 7/29/2022
Complete 5/3/2021	
	3E	Merchant Category Codes (MCCs) are used to identify the type of business in which a merchant is engaged. Periodic reviews of the lists of HCC approved MCCs should be performed. Occasionally, overrides are authorized and approved by the director and/or executive director of procurement operations so that one-time single purchases can be made from MCCs that are not on the approved MCC lists. Purchases made from temporarily lifted MCCs should be monitored and the appropriate approval documentation should be maintained for each transaction.	P-Card team will be reviewing the current MCC list template with Citibank once per semester to identify authorized business/merchants per the P-Card Procedures Manual.
If an unauthorized MCC code is requested per a one-time exception, an approved One Time Exception Transaction Form is required. The approved form is attached to each approved transaction. A log will be kept on the Concur share drive of all exceptions.
Expense reports containing temporary exceptions will be reviewed for appropriate approvals and documentation on a monthly basis as part of our departmental review process. A checklist will be attached to indicate that a
thorough review has been performed for each transaction.	P-Card Program Administrator	In Progress 11/1/2022
Complete 6/30/2022
Complete 6/30/2022	
	3F	P-Card administration should perform random audits. Audits should be performed frequently and include measures to detect potential split purchases made by cardholders. A split purchase is the “intentional split” of a purchase to meet the P-Card single purchase limit in order to avoid sending the purchase to the contracting office and/or to avoid P-Card guidelines. Information gathered from random audits should be used to detect possible P-Card misuse and to organize topics for training exercises.
System generated reports should be reviewed routinely to monitor cardholder activity. The reasons that purchases are declined should be monitored and tracked. Reports should be used to track repeat cardholder violations and monitor the requests for temporarily lifted MCCs.	Utilizing the Citibank split transaction report, the P-Card team will conduct a random review on a monthly basis to identify “intentional split” transactions, itemized receipts and proper coding. The cardholder will be contacted to address the issue, administering the “Three Strike Rule”.
Training material will be developed based on information gathered from the randomly reviewed reports and identify users who require additional training.
P-Card team will review monthly reports for cardholder activity and misuse including decline transactions. If misuse is identified, the “Three Strike Rule” will be applied.
P-Card team will create logs to keep track of cardholder violations such as MCC temporary lifts, Decline and Split Transactions. If misuse is identified, the “Three Strike Rule” will be applied.	P-Card Program Administrator	Complete 6/10/2022
In Progress 10/3/2022
Complete 6/10/2022
Complete 11/9/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	4	Violations of P-Card program policies and procedures should be strictly enforced and well documented. IA was unable to determine whether disciplinary actions were taken against cardholders who violated program policies. P-Card violation enforcement rules should include disciplinary actions for cardholders who fail to code expenditures properly. Cardholders who continue to violate the program policies should not be able to continue to participate in the program. IA noted that a new P-Card Violation Procedure was posted to the Finance & Accounting Travel and Expense Center webpage during the review.	P-Card team will create logs to keep track of cardholder violations such as MCC temporary lifts, Decline and Split Transactions. If misuse is identified, the “Three Strike Rule” will be applied.
P-Card team will use the Violation log to enforce the P-Card Violation Procedures to terminate cardholders’ program participation. Upon identifying 3 strikes (violations), the P-Card review committee consisting of the ED of Accounting, ED Procurement, Department Manager and P-Card Administrator will meet to determine if the cardholder is allowed to continue utilizing the P-Card.	P-Card Program Administrator	Complete 11/9/2021
Complete 11/9/2021	
21-C-1-1 Central College Campus Safety & Environmental Operations Management	1	Obstructions of safety equipment, such as eyewash stations and portable fire
extinguishers, were noted in seven classrooms.	All obstructions were cleared prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	2	Seven classrooms had containers that were not properly labeled with the full
chemical or trade name.	All noted exceptions were cleared prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	3	Safety data sheets were not on hand or readily available for all hazardous
chemicals in four classrooms and/or labs.	All noted missing safety data sheets were resolved prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	4	An accurate list (inventory) of the hazardous chemicals known to be present and referenced by the appropriate safety data sheet was not available in three
classrooms and one prep room.	All missing hazardous chemicals inventory lists were resolved prior to issuance of the report.	COO; Campus Managers	Complete 6/21/2022	
	5	Appropriate spill containment was not present in four classrooms.	All spill containment exceptions were resolved prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	6	Four classrooms and/or labs did not have appropriate eyewash stations or did not have an operational eyewash station.	Environmental and Safety Department and Central College Operations are working together to obtain required station equipment and installation.	Enviro & Safety Dept; COO	In Progress 8/31/2022	
	7	Two classrooms did not have a sufficient number of fire extinguishers.	Required fire extinguishers were put in place by the HCC Safety Team prior to the
issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	8	One classroom contained a fire extinguisher with no indication of annual
inspection.	Resolved by the HCC Safety Team prior to the issuance of the report.	Enviro & Safety Dept;
COO	Complete
6/21/2022	
	9	An exit in one classroom in was obstructed.	The obstruction was cleared prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	10	Acids were not properly stored in an approved storage cabinet in one prep room.	The exception was resolved prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	11	One prep room did not contain the required spill cleanup kit.	The exception was resolved prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	12	One prep room did not have the required safety shower.	HCC Environmental and Safety Department and Central College Operations are working together to obtain the safety shower equipment and installation.	Enviro & Safety Dept; COO	In Progress 8/31/2022	
	13	One prep room had chemicals stored under a fume hood.	The chemicals were removed from under the fume hood and the exception was
resolved prior to issuance of the report.	COO; Campus
Managers	Complete
6/21/2022	
	
21-C-1-2 Northeast College Campus Safety & Environmental Operations Management	1	Eight classrooms/labs did not contain an accurate inventory list of hazardous
chemicals known to be present.	Inventory List will be added to MSDS binders.	COO; Campus
Managers	In Progress
7/19/2022	
	2	Seven classrooms/labs had containers that were not labeled with the full
chemical or trade name.	All the exceptions were corrected prior to issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	3	Five classrooms/labs did not have the safety data sheets on hand or readily
available for all hazardous chemicals.	Required safety data sheets for all hazardous chemicals will be put in place.	COO; Campus
Managers	In Progress
7/19/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	4	Five classrooms/labs did not have appropriate signs indicating required hazard
information present.	All the exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	5	Appropriate spill containment for hazardous materials was not present in four
classrooms/labs.	All the exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	6	Three classrooms/labs did not have all hazardous or flammable chemicals stored in NFPA approved flammable storage cabinets.	Required flammables safety cabinets will be put in place and chemicals properly stored.	Enviro & Safety Dept; Campus Manager	In Progress 7/19/2022	
	7	Two classrooms/labs had areas around electrical panels that were obstructed.	All the exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	8	Two classrooms/labs did not have a Hazard Communication Program and/or
Chemical Hygiene Work Plan.	The required program and plan will be put in place.	COO; Campus
Managers	In Progress
7/19/2022	
	9	The sashes on fume hoods in two labs were left open when not in use.	All the exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	10	The walkway in one lab was obstructed by a hose.	The obstruction was resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	11	The aisle in one classroom was obstructed by hair dryers and salon chairs.	The obstruction was cleared prior to issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	12	One bay door exit was obstructed by a hose.	The obstruction was cleared prior to issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	13	One lab did not have the required spill cleanup present.	The exception was resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	14	An eyewash station in one lab was not operational.	College Operations and Environmental and Safety Department have contacted the vendor to perform inspection and make needed eye wash station repairs.	Enviro & Safety Dept; Campus Manager	In Progress 10/1/2022	
	15	A fume hood in one lab was not working properly.	College Operations and Environmental and Safety Department have contacted the vendor to perform inspection and to certify fume hood.	Enviro & Safety Dept; Campus Manager	In Progress 10/1/2022	
	16	A propane tank was stored under the fume hood in one lab.	The exception was resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	17	Gas cylinders stored in an outside storage area were not secured so they could
not fall.	The exception was resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/30/2022	
	
21-C-1-3 Coleman College Campus Safety & Environmental Operations Management	1	Six classrooms/labs did not contain an accurate inventory list of hazardous chemicals.	Pharmacy Technician Department will verify inventory is up to date and then will prepare inventory.	Pharmacy Technician Department	In Progress 7/1/2022	
	2	Three classrooms/labs did not have chemicals segregated and stored properly.	Exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	3	The electrical panel was obstructed in two classrooms/labs.	Exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	4	The containers in one classroom/lab were not legibly labeled with the full
chemical or trade name.	Exceptions were resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	5	One classroom/lab did not have required safety data sheets on hand or readily
available.	Exception was resolved prior to the issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	6	One lab did not have flammable chemicals stored properly in a NFPA approved
flammable storage cabinet.	Exception was corrected prior to issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	7	Appropriate spill containment was not present in one lab.	Exception was corrected prior to issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	8	The fume hood in one lab had not been inspected and certified.	HCC Environmental and Safety Department has scheduled vendor inspection for
the fume hood.	Enviro & Safety Dept	In Progress
8/31/2022	
	9	One lab did not have appropriate signs that accurately indicated hazard
information.	Exception was corrected prior to issuance of the report.	COO; Campus
Managers	Complete
6/27/2022	
	
22-C-3 Procurement Contracting Review	1	HCC Policy CF (LOCAL) requires that the Board of Trustees (BOT) must approve purchase contracts valued at $100,000 or more ($500,000 or more if cooperative, interlocal or job order). Such contracts are presented to the BOT for approval prior to execution. For goods and services procured using the procurement requisition process, the Procurement Department submits proposed contracts valued at $100,000 or more to the BOT for approval prior to issuance of a purchase order for a specified dollar amount and the automated matching process within the payment system ensures that approved payments do not exceed the authorized amount. There are no corresponding controls for direct payment contracts, which generally include billing rates but do not specify a dollar limit. During fieldwork Internal Audit (IA) observed no cumulative direct payments to a vendor meeting the $100,000 or more threshold without BOT approval. However, no control was identified that would prevent or detect cumulative direct payments at the $100,000 or more threshold that do not have BOT approval. We observed one direct payment supplier where the board approved fiscal year (FY) spend amount had been exceeded in FYs 2019, 2020, and 2021. Internal controls should be implemented to ensure that board approval is obtained for cumulative direct payments to a vendor meeting the $100,000 or more threshold in a fiscal year and to ensure board approved spend amounts are not exceeded for direct payments.	Procurement and Finance have teamed together and have engaged Corporate Lounge LLC, a business that has been providing services on process improvements for over 13 years in the Houston area. We intend to remove the waste, streamline the process, and implement best practices. This process will be completed over an 8 week period.	Executive Director, Procurement Operations & AVC, Finance & Accounting	In Progress 9/30/2022	
	
22-A-3 Internal Quality Assurance Review	1	In response to an observation presented in our external assessment performed in FY 2021, IA developed and implemented a
Competency Framework to support talent and resource management activities within the department and to demonstrate professional proficiency. As an enhancement to this framework, IA should consider including an appendix to the framework identifying SME currently on staff, plans for developing additional expertise and maintaining the level of competency required based on current and likely future audit plans. Documentation of the available expertise in various relevant subjects can be used to optimize project assignments, reveal needs for additional training or cross-training and ensure that the level of proficiency is maintained and enhanced.	IA will develop documentation of staff expertise and experience, and include the information as an appendix to the IA Competency Framework.	Director Internal Audit	In Progress 1/31/2023