HOUSTON COMMUNITY COLLEGE
Internal Audit Policies and Procedures
	Internal Audit Charter	

PURPOSE

The purpose of the internal audit function is to strengthen Houston Community College System’s (HCCS) ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.
The internal audit function enhances HCCS’s:
•	Successful achievement of its objectives.
•	Governance, risk management, and control processes.
•	Decision-making and oversight.
•	Reputation and credibility with its stakeholders.
•	Ability to serve the public interest.
HCCS’s internal audit function is most effective when:
•	Internal auditing is performed by competent professionals in conformance with The IIA’s Global Internal Audit StandardsTM, which are set in the public interest.
•	The internal audit function is independently positioned with direct accountability to the board.
•	Internal auditors are free from undue influence and committed to making objective assessments.
Commitment to Adhering to the Global Internal Audit Standards
The HCCS’s internal audit function will adhere to the mandatory elements of The Institute of Internal Auditors' International Professional Practices Framework, which are the Global Internal Audit Standards and Topical Requirements (the Standards). The chief audit executive (CAE) will report annually to the board and senior management regarding the internal audit function’s conformance with the Standards, which will be assessed through a quality assurance and improvement program.

MANDATE

Authority
Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve the HCCS operations. The Department helps HCCS accomplish its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The HCCS’s board grants the internal audit function the mandate to provide the board and senior management with objective assurance, advice, insight, and foresight. The internal audit function’s authority is created by its direct reporting relationship to the board. The CAE will have unrestricted access to and communicate and interact directly with the Audit Committee Chair, including in private meetings without management present. The Board of Trustees authorizes the Department to:
•	Have full, free, and unrestricted access to all functions, activities, properties, manual and automated information systems, personnel, and non-privileged records pertinent to carrying out any engagement, subject to accountability for confidentiality and safeguarding of records and information.
•	Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques required to accomplish audit objectives, and issue reports.
•	Obtain assistance from necessary HCCS personnel, as well as other specialized services from within or outside HCCS to complete engagements.
•	Require written responses to audit observations describing corrective action that will be taken to adequately resolve the deficiencies, the responsible parties, and the expected completion dates. Deficient corrective action plans will be reported to the Board of Trustees for resolution.
Independence, Organization Position, and Reporting Relationships
To provide for the independence of the internal audit function to perform audit services and responsibilities without interference from management, its personnel report to the Chief Audit Executive (“CAE”), who reports functionally to the Audit Committee of the Board of Trustees and administratively (i.e., day-to-day operations) to the Chancellor. This positioning provides the organizational authority and status to bring matters directly to senior management and escalate matters to the board, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity.
The CAE will confirm to the board, at least annually, the organizational independence of the internal audit function. The CAE will disclose to the board any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results.

Charter and Mandate Revisions
Circumstances may justify a follow-up discussion between the chief audit executive, board, and senior management on the internal audit mandate or other aspects of the internal audit charter. Any changes to this Charter require the approval of the Board Audit Committee.

BOARD OVERSIGHT

To establish, maintain, and assure that the Department has sufficient authority to fulfill its duties, the Board Audit Committee will:
1.	Annually approve and recommend the Internal Audit Department Charter and Audit Committee Charter for Board approval.
2.	Periodically review the Internal Audit Charter and Audit Committee Charter to ensure it encompasses any required revisions.
3.	Approve and recommend the Annual Internal Audit Work Plan for Board approval.
4.	Review the audit reports, audits in progress, and future audits at regularly scheduled meetings.
5.	Establish a schedule of regular meetings.
6.	Establish a means of unrestricted access to and direct communication between the Chairman of the Audit Committee and the CAE, including private meetings without senior management present.
7.	Review significant observations and management action plans to address those observations in the audit reports.
8.	Monitor the status of management action plans for progress on significant observations.
9.	Ensure a quality assurance and improvement program has been established.
10.	Review Internal Audit’s Strategic Plan.
11.	Review the internal audit function’s human resources administration and budget.
12.	Make appropriate inquiries of senior management and the CAE to determine whether scope or resource limitations are inappropriate.

13.	Provide input to the Chancellor for the annual evaluation of the Internal Audit Director.
14.	Approve the remuneration of the Internal Audit Director.
15.	Provide input to the Board concerning the selection of the Internal Audit Director from the three (3) candidates recommended by the Chancellor.
16.	Provide input to the Board concerning approval of the Chancellor’s recommendation to terminate the Internal Audit Director.

CAE ROLES AND RESPONSIBILITIES

Ethics and Professionalism
The chief audit executive will ensure that internal auditors:
•	Conform with the Global Internal Audit Standards, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality.
•	Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organization and be able to recognize conduct that is contrary to those expectations.
•	Encourage and promote an ethics-based culture in the organization.
•	Report organizational behavior that is inconsistent with the organization’s ethical expectations, as described in applicable policies and procedures.
Objectivity
The reporting relationships of the CAE enhance departmental independence, promote comprehensive audit coverage and encourage adequate consideration of audit reports and recommendations. To maintain objectivity, the CAE and the audit staff shall have no direct authority over the activities they review. Internal Audit may not develop policies and procedures for a function they might audit or direct the actions of the personnel in the performance of that function. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including:
•	Performing operational duties for HCCS.
•	Initiating or approving transactions external to the internal audit function.

•	Directing the activities of any HCCS employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors.
•	Assessing specific operations for which they had responsibility within the previous year.
Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance.

Internal Audit may be asked to participate in management committees or project teams, to analyze controls built into processes, development systems, or analyze security products. Because Internal Audit is not a management decision-making function, decisions to develop, adopt and implement policies or procedures as a result of an internal audit advisory service must be made by management. The performance of these audits or reviews does not relieve management of any assigned responsibilities. The internal audit activity must be independent, and internal auditors must be objective in performing their work.
Managing the Internal Audit Function
In accordance with Board Policy, Internal Audit is responsible for assessing the various functions and control systems within HCCS and for advising management concerning their condition. The fulfillment of this accountability includes:
•	Developing a flexible risk based annual internal audit plan with input from Senior Management and the Board of Trustees as required by IIA Standard 2010. A1 and submit the audit plan to the Audit Committee for review and the Board for approval.
•	Reviewing and adjusting the plan, as necessary, in response to changes in the organization’s business, risks, operations, programs, systems, and controls with Audit Committee review and Board approval.
•	Meeting regularly with the Board Audit Committee to provide updates by reviewing audits performed, audits in progress, future audits, and sufficiency of the Department resources.
•	Conducting independent and constructive audits to review effectiveness of controls, financial records, operations, or to review departmental records, the proper recording of transactions, and compliance with applicable rules, regulations, policies, and procedures, including evaluation for potential fraud and effectiveness of fraud controls.

•	Analyzing data obtained for evidence of deficiencies in controls, integrity, duplication of effort, or lack of compliance with College policies and procedures.
•	Conducting audits that examine the effectiveness of the governance, risk management, and internal control processes in promoting the achievement of strategic objectives concerning all reporting, operations, safeguarding of assets, and compliance.
•	Follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of internal audit services to the board and senior management quarterly and for each engagement as appropriate.
•	Investigating allegations of fraud, waste, abuse and other wrongdoing as appropriate and in accordance with Board Policy, and coordinating such investigations as needed with Legal Counsel or the HCCS Police.
•	Evaluating the design, implementation, and effectiveness of HCCS ethics-related objectives, programs, and activities.
•	Assessing whether information technology governance effectively supports HCCS strategies and objectives.
•	Offering Advisory services; Internal Control or Fraud training; Control Self- Assessment (CSA) services, and other audit technique workshops as warranted.
•	Coordinating audit efforts with those of external financial auditors and acting as a liaison for other external auditors.
•	Coordinating efforts with other control monitoring functions within HCCS (risk management, compliance, security, legal, ethics, safety and environment, police, human resources, and information technology).
•	Identify and consider trends and emerging issues that could impact HCCS and communicate to the board and senior management.
•	Maintaining a professional audit staff with sufficient knowledge, skills, experience, and professional certifications to meet the requirements of this Charter and ensure that personnel in the Department have appropriate continuing education to foster advancement of technical knowledge and skills.
Quality Assurance and Improvement Program
The CAE will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program will include external and internal assessments of the internal audit function’s conformance with the Global Internal Audit Standards, as well as performance measurement to assess the internal audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program will assess compliance with laws

and/or regulations relevant to internal auditing. The assessment will include plans to address the internal audit function’s deficiencies and opportunities for improvement.
Annually, the CAE will communicate with the board and senior management about the internal audit function’s quality assurance and improvement program, including the results of internal self-assessments and external assessments. External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside HCCS. The assessment team must include at least one assessor holding an active Certified Internal Auditor® credential.
Communication with the Board and Senior Management
The CAE will communicate with the board and senior management regarding:
•	The internal audit function’s mandate.
•	The internal audit plan and performance relative to its plan.
•	Internal audit budget.
•	Significant revisions to the internal audit plan and budget.
•	Potential impairments to independence, including relevant disclosures as applicable.
•	Results from the quality assurance and improvement program, which include the internal audit function’s conformance with The IIA’s Global Internal Audit Standards and action plans to address the internal audit function’s deficiencies and opportunities for improvement.
•	Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the board.
•	Results of assurance and advisory services.
•	Resource requirements.
•	Management’s responses to risk that the internal audit function determines may be unacceptable or acceptance of a risk that is beyond HCCS’s risk appetite.

SCOPE AND TYPES OF INTERNAL AUDIT SERVICES
The scope of internal audit services covers the entire breadth of the organization, including all HCCS’s activities, assets, and personnel. The scope of internal audit activities also encompasses but is not limited to objective examinations of evidence to provide independent assurance and advisory services to the board and management on

the adequacy and effectiveness of governance, risk management, and control processes for HCCS.
HCCS internal audit services include:
Operational: These are projects in which some activity or other management assertion is evaluated so that improvements to operating efficiency and effectiveness can be made. These can also be projects in which the object is to develop new information on an activity so that management can use that information in their decision-making process.
Compliance: Reviews focused on ensuring compliance with laws, regulations and HCC policies.
Information Technology: Governance assessments in support of HCC’s strategies and objectives.
Advisory Services: Consulting projects that improve management of risks, add value, and improve the organization’s operations, including special projects requested by the Board or management, participating in HCC committees and task forces, and providing investigation services.
Administrative: Administrative projects within the department such as performing enterprise risk assessments, preparing the next fiscal year’s audit plan, performing quality assurance, preparing the Annual Audit Report, newsletters, and lunch & learns.
Observation action plan follow-ups: These are on-going status reviews on the resolution of deficiencies identified in past audits to ensure management completed action plans.

Document History
•	Amended September 19, 2013
•	Amended October 20, 2016
•	Amended August 17, 2017
•	Approved with no revisions August 1, 2018
•	Approved with no revisions February 5, 2020
•	Amended April 21, 2021
•	Amended April 20, 2022
•	Approved with no revisions April 19, 2023
•	Approved with no revisions April 17, 2024
•	Amended April 16, 2025