Internal Audit Annual Report Fiscal Year 2025
in Accordance with the Texas Internal Auditing Act

Prepared by Internal Audit Department
Terry Corrigan, Director Internal Audit

Table of Contents

SECTION
Internal Audit Plan for Fiscal Year 2025	I
Quality Assurance Review	II
Summary of Observations & Management Action Plans	III
List of Consulting Engagements and Non-audit Services Completed.	IV
Internal Audit Plan for Fiscal Year 2026	V
External Audit Services – Fiscal Year 2025	VI
Reporting Suspected Fraud and Abuse	VII
Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit
Annual Report, and Other Audit Information on the HCC Website	VIII

Internal Audit Plan for Fiscal Year 2025

The Board of Trustees approved the FY 2025 Internal Audit Plan on August 21, 2024. The Houston City College (HCC) audit universe is developed through HCC’s Enterprise Risk Management Assessment Program (ERM) (239 risks assessed). The High Risk Audit Candidates in the plan are based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Chancellor’s Council members and other chief executives (22 interviews), 3) consultants use 4) external audits 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) 2024 KPMG Internal Audit Key Risk, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities. The plan includes some hours for transitioning to the new Global Internal Audit Standards that went into effect January 9, 2025.

A FY 2025 Internal Audit Plan Status Report is detailed in the following table.

I

Internal Audit Annual Report
FY 2025 Internal Audit Plan Status Report

Audit Projects	Project Number	
Stage	Report Issued	
Notes/Issues	
Operational Audit Projects					
Student Mental Health	24-O-2	Complete	12/18/24	Final audit report issued Wednesday, 12/18/2024	
IT Disaster Recovery	25-O-1	Complete	08/28/25	Final audit report issued Thursday, 8/28/2025	
IT Systems Audit	25-O-2	Roll FY 2026	N/A	Roll over to FY 2026 Plan	
Compliance Audit Projects					
Payment Card Industry (PCI) Data Security Standard (DSS)	23-C-2	Complete	04/10/25	Final audit report issued Thursday, 4/10/2025	
Title IX	23-C-3	Cancelled	N/A	Cancelled	
Campus Safety & Environmental Operations Management	25-C-1	N/A	N/A	Planning for all three colleges	
Central College	25-C-1-1	Complete	04/15/25	Final audit report issued Tuesday, 4/15/2025	
Northeast College	25-C-1-2	Complete	04/15/25	Final audit report issued Tuesday, 4/15/2025	
Coleman College	25-C-1-3	Complete	04/15/25	Final audit report issued Tuesday, 4/15/2025	
Procurement Processing	25-C-2	N/A	N/A		
Cooperative Contracts Review	25-C-2-1	Complete	08/27/25	Final audit report issued Wednesday, 8/27/2025	
Blanket Purchase Orders Review	25-C-2-2	Complete	08/26/25	Final audit report issued Tuesday, 8/26/2025	
Payments Processing	25-C-3	N/A	N/A		
Contracted Services Analysis	25-C-3-1	Complete	12/17/24	Final audit report issued Tuesday, 12/17/2024	
Less Than $100K Payments Analysis	25-C-3-2	Complete	12/18/25	Final audit report issued Wednesday, 12/18/2024	
Advisory Services Projects					
Committees & Task Forces	25-S-1	N/A	N/A		
Special Projects & Examinations	25-S-2	N/A	N/A		
ERM Top 10 Risks Baseline Assessment	25-S-3	N/A	N/A		
Administrative Projects					
FY 2026 Audit Planning & ERM Assessment	25-A-1	Complete	08/06/25	FY2026 IA Plan presented Wednesday, 8/6/2025	
TeamMate IA Management System	25-A-2	Ongoing	N/A	Continuously improving the use of TM+	
Internal Quality Assurance Review	25-A-3	Roll FY 2026	N/A	Roll over to FY 2026 Plan	
FY 2025 Annual Audit Report	25-A-4	Complete	10/01/25	FY2025 annual report presented Wednesday, 10/1/2025	
External Audits Monitoring	25-A-5	Ongoing	N/A		
Lunch and Learns	25-A-6	Ongoing	N/A		
Newsletters	25-A-7	Ongoing	N/A		
Global Internal Audit Standards Transition	25-A-8	Ongoing	N/A		
Observation Action Plan Follow-ups					
Observation Action Plan Follow-ups	25-F-1	Ongoing	N/A	Quarterly status report presented to Audit Committee	

I-1

Quality Assurance Review

An external quality assurance review (EQAR) was performed by Basil Woller and Associates (Basil Woller) on the Internal Audit Department in FY 2021, in compliance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards). The review was an independent validation of the assertions and conclusions made in the internal audit report “20-A-3 IA Internal Quality Assurance Review” issued by the HCC’s Internal Audit Department on June 23, 2020. Basil Woller’s report issued May 7, 2021, concurred with the Internal Audit self-assessment, that HCC’s Internal Audit Department generally conforms with the Standards and the IIA Code of Ethics. This level of conformance is the top rating and demonstrates a clear intent and commitment to achieving the Core Principles and the Definition of Internal Auditing.

The next EQAR is due to be completed in 2026. The review will assess conformance with The Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF) comprised of Global Internal Audit Standards (Standards), Topical Requirements, and Global Guidance. These new Standards went into effect January 9, 2025.

The HCC Internal Audit Department completed the following quality assurance activities during FY 2025:
Collaborated with the Risk Management Office to update and complete the annual Enterprise Risk Management Assessment for HCC.
An Internal Quality Assurance Review was combined with a Global Internal Audit Standards transition review to meet the requirements of the new Standards.
TeamMate Analytics software is being used to perform data analytics in audit projects based on planning assessments.
Maintained a professional staff with diversified skill sets and professional certifications.
Completed training to maintain professional certifications and to improve knowledge and understanding required to complete audit projects.

Summary of Observations and Management Action Plans

See the detailed FY 2025 Audit Observations and Management Action Plans Attachment to this report.

Internal Audit Annual Report
List of Consulting Engagements and Non-audit Services Performed

Internal Audit provided a lunch and learn on “Fraud Awareness.” Members of the Internal Audit Department participated on the following councils, task forces, and committees in FY 2025:

Accountability and Standards Council

Internet and Communication Technology and Accessibility Committee

Procurement Contract Evaluation Committees

Candidates for Hiring Screening Committees

Internal Audit Plan for Fiscal Year 2026

The Houston City College (HCC) Board of Trustees approved the Fiscal Year 2026 Internal Audit Plan on August 20, 2025.

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the HCC Internal Audit Department (IA) will conduct during fiscal year 2026. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Board Policy CDC (LOCAL), Audit Committee Charter, HCC’s Internal Audit Department Charter, The Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF), and Texas Internal Auditing Act. Time is built into the Plan for IA to be agile and responsive to board and management concerns that come up during the fiscal year.

A significant amount of time will be devoted to collaborating with HCC’s Vice Chancellor, Administration and Operations and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program in FY 2026. The plan includes time for reviewing the integrity and validity of assessments and information provided to the board on the top 10 risks identified in HCC’s ERM Assessment.
Plan Development Methodology

The HCC audit universe is developed through HCC’s ERM Assessment Program (239 risks assessed). The High Risk Audit Candidates in the plan are based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with the Chancellor, Chancellor’s Executive Council members and other chief executives (24 interviews), 3) external consultants use,
4) external audits, 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) top risks identified by the University Risk Management Association, 7) 2025 KPMG Internal Audit Key Thematic Areas, 8) Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF) 9) Texas Internal Auditing Act, and 10) alignment with HCC’s strategic priorities. The plan includes some hours for transitioning to the new Global Internal Audit Standards that went into effect on January 9, 2025.

The FY 2026 Internal Audit Plan is detailed in the following table.

Internal Audit Department Fiscal Year 2026 Audit Plan

No.	Project	Description	
Operational Audit Projects	
26-O-1	Minors on Campus	Governance, risk and controls (GRC) propriety review. Review the propriety of processes for mandatory staff training, compliance with unaccompanied minor policy, event planning, facility use agreements, and MOU's with ISDs.	
26-O-2	Policing	Governance, risk and controls (GRC) propriety review. Review the progress being made in upgrading systems automation and equipment.	
Information Technology Audit Projects	
26-I-1	IT Disaster Recovery/Business Continuity	Review of governance, risk and controls (GRC) propriety. Evaluate processes and procedures for IT Disaster Recovery and Business Continuity including compliance with regulations and HCC policies. Additionally, IA will attend and observe the annual disaster recovery
exercise. The criteria for this engagement will include the standards established by TAC 202.	
26-I-2	IT Systems Audit	Employee off boarding represents the final chapter of an individual’s professional journey within an organization. An effective offboarding process is important for several reasons, including but not limited to: Ensuring that access to university systems, data, and physical assets is promptly revoked, significantly reducing the risk of unauthorized access and
potential security breaches; The criteria for this engagement will include the standards established by TAC 202.	
Compliance Audit Projects	
26-C-1	Campus Safety & Environmental Operations Management	Planning for campus safety & environmental legal policy compliance management reviews.	
26-C-1-1	Central College	Safety & environmental legal policy compliance.	
26-C-1-2	Northeast College	Safety & environmental legal policy compliance.	
26-C-1-3	Coleman College	Safety & environmental legal policy compliance.	
26-C-2	Clery Act Reporting	Review the Clery Act reporting process and compliance with the regulations.	
Advisory Services Projects	
26-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control advice.	
26-S-2	Special Projects & Examinations	Responsive to provide services as required.	
26-S-3	ERM Top 10 Risks Baseline Assessment	Review for integrity and validity of assessments and information.	
26-S-4	Contracted Services Analysis	Analysis report on contracted services.	
26-S-5	Less than $100K Payments Analysis	Vendor analysis report on payments under the chancellor’s signatory authority.	
26-S-6	Procurement Processing	Review the procurement processes to help streamline the system.	
26-S-7	HB 33 Active Shooter & Campus Security	Review HCC's preparedness to implement HB 33 requirements.	
26-S-8	Website Accessibility	Monitor website accessibility compliance with OCR requirements.	
26-S-9	SB 37 Faculty Senate Reconstruction	Review Faculty Senate reconstruction under the new regulations and revised policy framework. Review faculty governance documents revisions in compliance with the bill.	

V-1

Administrative Projects	
26-A-1	FY 2027 Audit Planning & ERM Assessment	Collaborate with HCC Risk Management to update the Enterprise Risk Management (ERM) assessment & audit planning.	
26-A-2	TeamMate IA Management System	TeamMate software system maintenance & improvement.	
26-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA.	
26-A-4	FY 2026 Annual Audit Report	Compile and prepare State required annual audit report.	
26-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans.	
26-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	
26-A-7	Newsletters	Newsletters to HCC's general personnel to raise awareness on fraud deterrence, risk management, internal control & compliance.	
26-A-8	Global Internal Audit Standards Transition	IA transitioning to the new Institute of Internal Auditors “Global Internal Audit Standards” that are effective January 2025.	
Observation Action Plan Follow-ups	
26-F-1	Observation Action Plan Follow-ups	Follow-up on completion of audit observations action plans	

V-2

External Audit Services – Fiscal Year 2025

HCC Procured Services in FY 2025

Rapid 7 – IT cyber & data security penetration testing.
Texas Mutual Insurance Company – 3/1/24 to 3/1/25 Workers’ Compensation final premium audit.
Forvis Mazars – Annual Financial Statements Audit for FY 2025 in progress.

Regulatory Imposed in FY 2025

The State Auditor’s Office completed its evaluation of compliance with the Public Funds Investment Act (PFIA) and Rider 5 requirements. HCC was determined to be fully compliant with PFIA requirements.
Houston-Galveston Area Council (H-GAC) engaged Weaver to perform 2023- 2024 Financial Monitoring & Billing Review on adult education contracts 213- 23 & 213-24. The examination yielded no findings of concern.
City of Houston Housing and Community Development Department performed a subrecipient compliance monitoring review on HCC’s EmPowering Solar Jobs Program. All issues were determined adequately resolved and the review is now closed.
THECB performed an AY 2022 Governor's Emergency Education Relief (GEER) Fund desk compliance review on Online Learning – Reporting Modernization. HCC was determined in compliance.
Houston-Galveston Area Council conducted an interview-style cyber-security review of HCC’s IT systems. No issues were identified for follow up.
THECB performed an Appropriation Year 2024 Single Audit Report Evaluation noting no federal or state funding findings.
THECB performed a FY 2024 Houston Community College Perkins Desk Review. No compliance issues were observed in the review.
The THECB completed a Compliance Monitoring Desk Review of the Texas Educational Opportunity Grant (TEOG). The review focused on TEOG data for the financial aid year 2023-2024. There were no observations resulting from the engagement.

Reporting Suspected Fraud and Abuse

HCC has taken the following actions to implement the fraud detection and reporting requirements of Section 7.09 of the 83rd Legislature’s General Appropriations Act, and Texas Government Code, Section 321.022:

All employee mandatory annual Standards of Conduct training has been established.
HCC has established a confidential independent Hotline for people to report suspected fraud, abuse, and unethical behavior. A link to the reporting Hotline is on the HCC website home page. Reporting Hotline information is included in mandatory annual Standards of Conduct training.
The HCC Compliance and Ethics website has a link to the State Auditor’s Office fraud hotline.
Internal Audit provided a “Fraud Awareness” lunch and learn available to all HCC employees.
In compliance with the reporting requirements of fraud, waste, and abuse, HCC reports all instances of confirmed fraud, waste, and abuse to the State Auditor’s Office.

Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on the HCC Website

TGC, Section 2102.015 was added by House Bill 16 (83rd Legislature, Regular Session) on June 14, 2013. Colleges are required to post certain information on their website. Specifically, Colleges must post the following information within 30 days of approval by the Board of Trustees:
The approved audit plan for the current fiscal year.
The annual audit report for the previous fiscal year.
A detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report.
A summary of the action taken by the College to address concerns raised by the audit plan or annual report.
HCC Internal Audit will submit the Internal Audit Annual Report to the website coordinators for posting on the Internal Audit section of the HCC website no later than 30 days after the HCC Board of Trustees approves the report. The current fiscal year audit plan has been posted to the website. This report includes the TGC, Section 2102.015 standard elements.

FY 2025 Audit Observations and Management Action Plans

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
21-O-5 Construction Cost Management	2	While HCC Facilities has controls in place to ensure construction cost management processes are performed in a way that helps HCC meet its business objectives without introducing unnecessary risks, those processes are not formally written and documented. The HCC Facilities Department needs to deploy control activities through written departmental policies that establish expectations in the construction cost management process and procedures to put
those policies into action.	Policies and procedures governing construction cost management will be implemented per the audit recommendation.	Executive Director of Facilities/Capital Improvement Projects	Complete 8/1/2024	
	
20-O-1 Enrollment Review	1	Student Services reported Enrollment Projections to the Board on April 19, 2023, including a list of 5 immediate next steps needed to maintain momentum toward achieving enrollment goals. IA concurs with this analysis of primary steps urgently needed to enable HCC to reach enrollment goals and transition to the new State Appropriation “Performance Based Funding Model”. These 5 steps are as follows:		
		1. Develop a strategic enrollment management plan (SEM).	RFP being secured through the procurement department for an official SEM plan
at HCC.	Interim VC Student Service/ Interim AVC	Complete 10/31/2024	
			District-wide townhalls will be held to introduce the SEM to internal and external
stakeholders.		Complete 10/31/2024	
		4. Invest in a CRM and resources to develop a 360-degree perspective of students in the enrollment funnel.	My One Flow, the interim CRM Solution, went live 10/11/2024.	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 10/11/2024	
			The feasibility of a another permanent comprehensive CRM software solution is being explored. The specs have been given to HCC IT for review.		In Progress TBD	
		5. Provide students with a primary contact / mentor to support them throughout their student experience.	A process has been established to assign primary contacts to all HCC credit students from initial connection through graduation.	Interim VC Student Service/ Interim AVC Enrollment Management	Complete 10/11/2024	
	
20-O-2 IT Cyber & Data Security and Governance Audit	1	Internal Audit reviewed HCC IT Cyber Security staff job responsibilities for appropriateness. This appeared appropriate. Additionally, IA compared staffing size against similar sized peers and with third party studies and noted an area for improvement. The staffing level is minimal for a college of this size. HCC should evaluate the possibility of increasing staffing for full-time HCC IT Cyber Security to eight employees. This would help strengthen the institution’s resiliency against
cyber-attacks.	The IT Governance & Compliance department has submitted a FY2026 unrestricted budget request to fund the needed staffing.	CIO, VC Finance, VC TE, VC Admin & Ops	Complete 1/23/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
22-O-1 Deferred Maintenance	1	During interviews with the Facilities department personnel, it was determined that HCC Facilities has processes in place for identifying, risk assessing, prioritizing, cost tracking, and reporting deferred maintenance projects. However, these processes are not formally written and documented. The HCC Facilities Department should create written departmental procedures for deferred maintenance to help control activities and establish expectations. The procedures should document the steps used to assess and prioritize deferred maintenance projects. In addition, all agendas and minutes from meetings held with subject matter experts (SMEs) to assess and determine the priority of deferred maintenance projects should be documented and maintained.	The Facilities Department will establish formal written procedures that document the steps used to assess and prioritize deferred maintenance projects referred to in the action plan for observation 2 below.	Chief Facilities Officer/Executive Director, Maintenance and Auxiliary Services	Complete 11/30/2024	
	2	During the review of processes and procedures in place to identify, assess and prioritize deferred maintenance projects, it was determined that a Facilities Condition Assessment was performed in 2019. Industry best practices indicate regular inspections and condition assessments should be performed, at least every five years. The HCC Facilities Department should recommend to the Board of Trustees that an updated Facilities Condition Assessment be performed. An updated FCA will:
?Help Facilities assess the current condition of College buildings and properties.
?Provide more accurate and actionable data to assist Facilities in assessing DM
needs.
?Help Facilities prioritize budgetary needs and establish maintenance and repair
timelines.
?Enable better capital planning and forecasting.
?Ensure compliance with industry standards and safety requirements.
?Help better estimate deferred maintenance expenses.	The current condition assessment concludes in calendar year 2029. The Facilities Department will request approval for a firm to conduct a new facilities condition assessment in FY29. The Facilities Department is not using the 2019 Facilities Condition Assessment for managing the deferred maintenance program. The Department has created a weighted scoring system for the deferred maintenance program and will utilize this to prioritize the FY2025 Deferred Maintenance projects. Additionally, the Department will form an advisory committee to present the ranked projects quarterly to maintain a high level of functionality and prioritizing items in imminent failure planning with the campuses as necessary.	Chief Facilities Officer/Executive Director, Maintenance and Auxiliary Services	Complete 10/14/2024	
	
23-O-1 Asset Management - Information Technology	1	IA observed various discrepancies with departmental IT asset inventory. The discrepancies are detailed in the report Attachment. IA noted that HCC does not have a written policy that details HCC’s expectations for managing IT assets. IA recommends an HCC policy regulation be written and submitted to the Chancellor’s Executive Committee (CEC) for approval to manage IT assets. IA suggests that the regulation cover the following elements:
?Onboarding: Workflow from HCC IT to the customer. This would include departmental technology assets from general purchase, grant funded, and donated items. The HCC IT department should be the initial recipient of controlled and capitalized IT assets inclusive of computers, servers and network equipment. This would help ensure that these types of assets are properly recorded, set up, secured, managed, configured and safe to use on the HCC network.
?Monitoring: Annual inventory count and reconciliation by a designated party, movement forms completed when assets are moved and transferred to another location.
?Offboarding: Workflow from IT asset custodians to HCC IT when employees leave
HCC or transfer to other departments.
?Training: Required training details.
?Review and monitoring oversight: Required by directly responsible individuals.
?Enforcement: Accountability, disciplinary action for policy offenders.	A Regulation Policy has not been approved because Texas regulations have increased accounted for assets to $10K, so the Regulation Policy was not taken to the BOT in August. HCC accounted for assets is still at $5K; however, IT and Facilities are working to educate college leadership about the existing process for Asset Management inventories. The new proposed date for BOT approval is November. Facilities is currently closing the FY2025 inventory and working with IT to adopt a new software system to link the IT inventory with the inventory in PeopleSoft.	Chief Facilities Officer/Chief Information Officer	In Progress 11/30/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
	
24-C-1 Campus Safety & Environmental Operations Management	1	Historically, HCC has maintained safety data sheets (SDS) in a hard copy format, leading to inefficiencies in storage, retrieval, and updating as indicated by ongoing observations related to missing SDS and incomplete chemical inventories. With advancements in technology, digital solutions offer a more streamlined and effective approach to managing SDS information. Internal Audit recommends that EH&S submit a proposal to HCC Administration to implement
an online SDS service.	EH&S is working with Velocity EHS, Procurement, IT and Legal to purchase the software necessary to use an online SDS system for our SDS inventories. EH&S is meeting with program deans and administrators to identify SDS administrators to the system. EH&S expects to begin loading information by the end of September 2025.	EHS Manager	In Progress 9/30/2025	
	
24-C-1-1 Central College Campus Safety & Environmental Operations	7	Two classrooms did not have eyewash stations available when chemicals and materials on hand required an eyewash be present for immediate emergency use. One eyewash station was not working properly in JBW 118. The equipment
was repaired on site by EHS.	Eye wash stations were installed.	EHS Manager	Complete 4/17/2025	
	17	One prep room did not have a safety shower present when a shower would be
required by chemicals on hand.	Safety shower was installed.	EHS Manager	Complete 4/17/2025	
	
24-C-2 Senate Bill 17	1	In Internal Audits opinion, HCC executive management has been provided with sufficient training concerning SB 17 compliance through Chancellor Executive Council Task Force Meetings, Accountability and Standards Council meeting presentations, and required executive management attestation certifications. An SB 17 Compliance Resources email was provided to all HCC employees on July 25, 2024, to assist employees in complying with the new mandatory requirements.
Employees may not have been diligent in adequately acquainting themselves with the information provided. All employees are responsible for familiarizing themselves and complying with SB 17’s basic requirements. Internal Audit recommends HCC management provide required training for all HCC employees to strengthen the control environment around complying with the new requirements.	OGC hired a Compliance Training Specialist in January 2025. The course will be rolled out by the 2nd week of August 2025. It will be available to all employees; however, it will be required for E10 and above, including the Deans, Chairs, and Program Directors.	General Counsel and VC, Talent Engagement & CHRO	In Progress 8/15/2025	
	
24-A-8 Global Internal Audit Standards Transition	1	An effective partnership between the board, senior management and the CAE is essential to enable effective internal auditing and enhance organizational success. All three parties must support each other to enable success. Domain III: Governing the Internal Audit Function, in the Standards, outlines the requirements for the CAE to work closely with the board to establish the internal audit function, position it independently, and oversee its performance. Domain III also outlines senior management’s responsibilities that support the board’s responsibilities and promote strong governance of the internal audit function.
While most of the requirements in Domain III are not new, the “essential conditions” presented in Domain III require direct communication and collaboration between the CAE, board, and senior management to enable organizational success. The CAE should establish a plan to meet with the board and senior management to discuss the new Purpose of Internal Auditing under the new Standards and the essential conditions presented in the nine standards in Domain III.	In a start to establishing more direct communication and collaboration between the CAE, board, and senior management, the Director of Internal Audit will make a presentation in the Audit Committee meeting scheduled for October 2, 2024, to introduce the new Standards and the essential conditions.	Director Internal Audit	Complete 10/2/2024	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
24-O-2 Student Mental Health	1	Opportunities for improvement were identified in conjunction with Counseling and Ability Services related to staffing needs. The improvements would offer expanded services to further promote student success and wellbeing. The significant changes in student needs, regulatory requirements, and the overall campus environment since 2012 underscore the necessity of hiring additional counselors. By expanding the counseling staff, HCC can better support students' mental health and wellness, comply with legal obligations, and effectively handle the increasing number of crises on campus. This investment is essential for fostering a healthy and supportive educational environment.	Counseling and Ability Services leadership have submitted hiring justification for additional positions that could improve regular hours caseload coverage and provide support for after hours and weekend services for emergent events and to accommodate students whose work/life schedule does not allow free time for counseling during regular business hours. Upon approval for hiring, Counseling and Ability Services will work with Talent Engagement to post and recruit for additional counseling positions.	AVC, Special Programs & Success	In Progress 9/1/2025	
	2	Counseling and Ability Services training offerings are quite robust, however, comprehensive tracking of attendance by faculty and staff is needed. Counseling and Ability Services should maintain a record of attendee names, positions and departments. For student-facing positions, goals evaluated in the PEP process could include annual training in mental health, human trafficking and other related topics. In this case, evidence of attendance in the form of certificates backed by attendance records would be needed to provide appropriate documentation supporting the achievement of goals.	Counseling and Ability Services will take advantage of the Anthology Engage Student Engagement Platform being acquired by Student Life to track the attendees’ names, positions, and departments for each training offering, as well as tracking evaluation feedback forms for topics of interest and needs for professional development as reported by faculty, staff and student attendees.	AVC, Special Programs & Success	In Progress 9/1/2025	
	
24-C-1-1 Northwest College Campus Safety	1	Safety data sheets were not readily available in one storage room and four
classrooms.	Three exceptions were corrected on site by the campus manager. All exceptions
were corrected prior to report issuance.	COO; Campus
Manager, ATTC	Complete 4/15/2025	
	2	Four classrooms/labs did not have appropriate signs present indicating hazard
information.	All corrective action plans were completed prior to report issuance.	COO; Campus
Manager, ATTC	Complete 4/15/2025	
	3	One chemical storage room and one classroom did not contain the required spill
cleanup kit.	All corrective action plans were completed prior to report issuance.	COO	Complete 4/15/2025	
	4	Two classrooms did not have appropriate eyewash stations when chemicals and materials on hand required an eyewash be present for immediate emergency
use.	Installation of eyewash stations completed.	EHS Manager	Complete 8/9/2025	
	5	The fume hood sashes in two labs were open when not in use.	All exceptions were corrected on site by campus operations personnel or the EHS
Manager.	Campus Manager;
EHS Manager	Complete 4/15/2025	
	6	Obstruction of safety equipment, such as eyewash stations and portable fire
extinguishers, was noted in one classroom.	The exception was corrected on site by the EHS Manager.	EHS Manager	Complete 4/15/2025	
	7	One lab contained a fire extinguisher with no indication of annual inspection.	The exception was corrected on site by the contracted vendor TDI.	EHS Manager	Complete 4/15/2025	
	8	One classroom did not have a Hazard Communication Program available.	The exception was corrected on site by the campus manager.	Campus Manager	Complete 4/15/2025	
	9	Containers in one lab were not appropriately labeled with the full chemical or
trade name.	The exception was corrected on site by campus operations personnel.	Campus Manager	Complete 4/15/2025	
	10	One classroom did not contain an accurate inventory list of hazardous chemicals
known to be present.	The exception was corrected on site by the instructor.	COO; Campus
Managers	Complete 4/15/2025	
	11	One classroom did not have all hazardous or flammable chemicals stored in an
NFPA approved flammable storage cabinet.	The exception was corrected on site by EHS.	EHS Manager	Complete 4/15/2025	
	12	One classroom had a chemical not stored by hazard class.	All action plans have been completed. The exception was corrected on site by the
campus manager.	Campus Manager	Complete 4/15/2025	
	
24-C-1-2 Southeast College Campus Safety	1	Seven classrooms/labs contained a fire extinguisher with no indication of monthly
inspection.	All corrective action plans were completed prior to report issuance.	EHS Manager	Complete 4/15/2025	
	2	Obstruction of safety equipment, such as eyewash stations and portable fire
extinguishers, was noted in five classrooms/labs.	All exceptions were corrected on site by campus operations personnel.	Campus Manager	Complete 4/15/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
	3	One lab and four classrooms contained a fire extinguisher with no indication of
annual inspection.	All corrective action plans were completed prior to report issuance.	EHS Manager	Complete 4/15/2025	
	4	Safety data sheets were not readily available in two classrooms.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	5	Two classrooms did not contain an accurate inventory list of hazardous chemicals
known to be present.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	6	The walkway in one classroom was obstructed.	The exception was corrected on site by campus operations personnel.	Campus Manager	Complete 4/15/2025	
	7	One classroom did not have a flammable chemical stored in a NFPA approved
flammable storage cabinet.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	8	One classroom did not have appropriate eyewash stations when chemicals and materials on hand required an eyewash be present for immediate emergency
use.	Installation of eyewash station completed.	EHS Manager	Complete 8/12/2025	
	9	The fume hood sash in one classroom was open when not in use.	The exception was corrected on site by the campus manager.	Campus Manager	Complete 4/15/2025	
	10	One classroom did not have appropriate signs present indicating hazard
information.	The exception was corrected on site by the EHS Manager.	EHS Manager	Complete 4/15/2025	
	
24-C-1-3 Southwest College Campus Safety	1	Containers in five labs and/or classrooms were not appropriately labeled with the
full chemical or trade name.	All corrective action plans were completed prior to report issuance.	COO; Campus
Manager	Complete 4/15/2025	
	2	Obstruction of safety equipment, such as eyewash stations and portable fire
extinguishers, was noted in four classrooms.	All exceptions were corrected on site by campus operations personnel or the EHS
Manager.	Campus Manager;
EHS Manager	Complete 4/15/2025	
	3	Safety data sheets were not readily available in three labs and one classroom.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	4	One classroom did not have an appropriate eyewash station when chemicals and materials on hand required an eyewash be present for immediate emergency use. Three classrooms had an eyewash station that was not operational.	Installation of eyewash station completed.	EHS Manager	Complete 8/16/2025	
	5	Three classrooms/labs did not have appropriate signs present indicating hazard
information.	All corrective action plans were completed prior to report issuance.	Campus Manager;
EHS Manager	Complete 4/15/2025	
	6	One lab and one chemical storage room did not contain an accurate inventory list
of hazardous chemicals known to be present.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	7	Hazardous or flammable chemicals were not stored properly in two classrooms.	One exception was corrected on site by the campus manager. All exceptions were
corrected prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	8	Two labs did not have appropriate spill containment of hazardous materials.	One exception was corrected on site by the campus manager. The remaining
exception was corrected prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	9	Two labs did not contain the required spill cleanup kit.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	10	Two classrooms had gas cylinders that were not properly and adequately secured
to prevent accidents or damage to the cylinders.	One exception was corrected on site by the EHS manager. The remaining
exception was corrected prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	
	11	One classroom contained a fire extinguisher with no indication of annual
inspection.	All corrective action plans were completed prior to report issuance.	EHS Manager	Complete 4/15/2025	
	12	One classroom contained a machine (saw) with no guard to properly prevent
injury to an individual.	All corrective action plans were completed prior to report issuance.	COO; Campus
Managers	Complete 4/15/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
25-O-1 IT Disaster Recovery	1	As part of the audit, Internal Audit conducted a physical and environmental assessment of HCC’s primacy data center. The facility is currently equipped with a diesel-powered generator, which has sufficient fuel capacity to sustain operations for several days under emergency conditions. However, during natural disasters, fuel availability can become severely constrained, and distribution is typically prioritized for emergency response and essential services. To enhance the resiliency of the data center, it is recommended that HCCs Information Technology department consult with Facilities Management to evaluate the feasibility of transitioning to a natural gas-powered generator. Natural gas systems are generally more reliable during extended emergencies due to the continuous pipeline supply, reducing dependency on fuel deliveries and improving overall disaster recovery preparedness.	Facilities estimates it will cost $3 million to retrofit the existing generator to natural gas. Facilities is investigating getting a 15,000 or 20,000 diesel fuel tank permanently installed in the back parking lot. This process will take 6 to 9 months to evaluate.	Chief Information Officer	In Progress 3/31/2026	
	2	Currently, HCC’s Disaster Recovery priorities are primarily focused on the restoration of critical systems necessary to support payroll processing and vendor payments. While these functions are essential, it is recommended that HCC’s Information Technology and the Administration & Operations department periodically facilitate strategic discussions with executive leadership to formally define and align institutional priorities for system restoration in the event of a disaster. Engaging executive management in these discussions will help ensure that recovery efforts reflect the broader operational, academic, and community service objectives of the College, and that the resources are allocated in a manner consistent with HCC’s mission.	As new application implementations are approved, disaster recovery requirements will be assessed to ensure alignment with organizational resilience standards. HCC’s Information Technology, and Administration and Operations departments will schedule periodic Chancellor Executive Council meetings to identify institutional priorities in the event of a disaster beyond mere restoration of critical systems to ensure continuity of academic and administrative operations. IT will request a first meeting by December 15, 2025.	Chief Information Officer; Vice Chancellor, Administration and Operations	In Progress 12/15/2025	
	
25-C-2-1 Cooperative Contracts Review	1	The Procurement department does not currently have formal written procedures outlining the processes, responsibilities, and controls related to cooperative procurement activities. There is no documented formal guidance to ensure consistent application, proper documentation, or compliance with state and College requirements. The Department has been relying on institutional or personal knowledge and informal practices rather than formally documented policies. The lack of documented processes can lead to increased risk of inconsistent procurement practices, non-compliance with applicable laws and guidelines, and reduced transparency in vendor selection and contracting which could be exacerbated by personnel turnover and employee absenteeism. It is recommended that the Procurement department implement formal written procedures outlining the processes, responsibilities and controls related to Cooperative Contract procurement. During the internal audit review, IA flowcharted and documented the cooperatives contracting process. This documentation has been provided to the Procurement Department and can be used as a guideline in establishing the formal written procedures.	The Procurement department will develop written procedures that document and diagram basic procurement processes, responsible parties, and controls for cooperative contracts.	Executive Director Purchasing/ Procurement Operations	In Progress 11/1/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
	2	The College currently utilizes cooperative purchasing contracts for the procurement of various goods and services. However, there is no centralized process in place to track cumulative annual spending through cooperative contracts. Furthermore, the Board of Trustees is not regularly informed about the volume or nature of such expenditures. Bi-monthly reports were requested by the Board of Trustees to track cooperative contract spending against amounts approved by the Board in the “FY2025 Cooperative Contracts Award List” in the September 2024 Special Meeting. This reporting was not provided. It is recommended that the College establish a formal process to: 1)Track and consolidate annual expenditures made through cooperative contracts across all departments and 2) Prepare and present a summary report to the Board of Trustees quarterly, detailing vendors used, amounts spent, and relevant contract information. The report should include a comparison of the annually board approved “Cooperative Contracts Award List” to actual amounts spent.	The Procurement department is developing a process to track COOP spend weekly to ensure that we report spend compared to approved amount, and available balances on a semi-monthly or quarterly basis. The frequency would be determined by the Board of Trustees.	Executive Director Purchasing/ Procurement Operations	In Progress 10/15/2025	
	3	The College engages multiple job order contract (JOC) cooperative vendors annually to procure goods and services including construction, renovations, environmental services, maintenance, repairs, and supplies. Many of these JOC vendors had total cooperative spending that exceeded $500,000 in the fiscal year; however, board approval was not required because there were multiple contracts for multiple projects with none individually exceeding the $500,000 threshold that requires Board approval. Because these high-dollar JOC cooperative vendor expenditures are not reported to the Board, there is a lack of full transparency and oversight in institutional spending. This may result in the Board not having a comprehensive view of the College’s financial commitments, potentially increasing the risk of overspending or inefficient allocation of resources. It is recommended that the College Administration include information on the JOC vendors expenditures exceeding $500,000 in the quarterly cooperative reporting to the Board. Doing so will strengthen governance practices and ensure greater transparency in cooperative procurement activities.	The Procurement department will add Job Order Contracts [JOC] to the Board report on COOP spend, ideally on a quarterly basis, commencing with 1QFY26. The report will be generated two weeks after the quarter ends.	Executive Director Purchasing/ Procurement Operations	In Progress 12/15/2025	

Project Name	Obs #	
Observation Description	
Remediation Action	Responsible Person	
Status/Est Completion Date	
25-C-2-2 Blanket Purchase Orders Review	1	IA reviewed the HCC Procurement Guidelines (Guidelines) and the Procurement Operations Procedures Manual (Manual) and noted the following areas for improvement:
a.?The Guidelines have not been updated since 2018. IA recommends a comprehensive review and revision to ensure alignment with current procurement practices, regulatory requirements, and institutional needs. b.?The Manual needs to be updated to reflect current practices.
?The Manual does not detail the process to generate a Blanket Purchase Order (BPO). The detailed procurement methodology used to generate BPOs needs to be added to the Manual. The procurement process flowcharts provided by IA can serve as a guide in developing formal procedures.
?The thresholds of Contract Award under Signature Authority in Guideline No.
3, approved by the Chancellor, Senior Vice Chancellor, and the Board of Trustees, need to be reviewed and updated. The thresholds need to be included in the Manual.
?The existing rule in the Manual that restricts single-item purchases through a BPO to a maximum of $700 is not practical and should be reconsidered. IA recommends removing or revising this limitation to better reflect operational realities and procurement needs.	The Procurement department will update the Procedures Manual containing internal processes and Procurement Guidelines containing information for district end-users by November 1, 2025. The Guidelines will also include updated Signature Authority thresholds. In addition, Procurement will remove the $700 per-item restriction for blanket purchases.	Executive Director Purchasing/ Procurement Operations	In Progress 11/1/2025	
	2	IA noted that in FY 2024, thirty-three departments, and in FY 2025, twenty-nine departments were issued multiple Blanket Purchase Orders (BPOs) for similar goods and services from the same suppliers. BPOs are intended to streamline procurement and reduce administrative workload. Issuing multiple BPOs to the same department for recurring purchases from the same vendor diminishes the efficiency gains. To optimize procurement operations and reduce processing time, HCC should adopt a policy of issuing a single BPO per fiscal year per department for each supplier, where feasible. This approach would enhance
consistency and reduce administrative overhead.	The Procurement department will address the matter of multiple Blanket Purchase Orders for similar products and services from the same suppliers by reinforcing this best-practice concept in training sessions conducted throughout the year. Moreover, we plan to manage food orders through America To Go via Direct Pay instead of Blanket Purchase Order since the former method is more efficient while still maintaining budgetary controls on spending. The expected completion date for the change to Direct Pay would be December 18, 2025, if approved. Training will occur throughout FY26 as planned with 12 sessions
occurring by August 31, 2026	Executive Director Purchasing/ Procurement Operations	In Progress (Direct Pay - 12/18/2025) (Training - 8/31/2026)