WIXLIB

2018 Internal Audit Annual Report2018 Internal Audit Annual ReportOctober 9, 2018October 9, 20181

Table of ContentsI.Compliance with Texas Government Code, Section 2102.0153II.Benefits Proportionality Audit Requirements for Higher Education Institutions4III. Internal Audit Plan for Fiscal Year 20185IV. Consulting and Nonaudit Services Completed11V.12Quality Assurance ReviewVI. Approved Internal Audit Plan for Fiscal Year 201928VII. External Audit Services Procured in Fiscal Year 201839VIII. Reporting Suspected Fraud and Abuse40Note: The outline of the annual report as listed above is prescribed by the Texas State Auditors Office per the Texas Internal Auditing Act.2

I. Compliance with House Bill 16(Texas Government Code, Section 2102.015)Requirements: Within 30 days of approval, an entity should post the following information on its Internet Web site:–An approved fiscal year 2019 audit plan, as provided by Texas Government Code, Section 2102.008.–A fiscal year 2018 internal audit annual report, as required by Texas Government Code, Section 2102.009. 2102.015.Required Updates–Detailed summary of weaknesses, deficiencies, wrongdoings, or other concerns, if any raised by the audit plan orannual report–Summary of action taken by the agency to address concerns, if any, that are raised by the audit plan or annual reportCompliance:The information required above will be included in this annual report and, once approved by the Alamo Colleges Board ofTrustees, will be posted to the Board of Trustees page on the Alamo Colleges Web site at Alamo.edu.333

II. Benefits Proportionality Audit Requirementsfor Higher Education InstitutionsNote: The requirements in this section of the annual report are not applicable for communitycolleges44

III. Internal Audit Plan for Fiscal Year 2018(Status as of August 31, 2018)FY 2018 Audit Plan ProjectsStatusPhase1Enterprise Risk Management and Safety (full scope audit) -2Tobin Lofts – (Public-Private Housing Partnership)(Confidential & Privileged Attorney Work Product) -3Full-Time Temporary Faculty Utilization (targeted review) -4Software Acquisition, Implementation, and Management (full scope audit) -5Construction Contracts and Project Management – DSO (full scope audit)In ProgressFieldwork6Software Licensing Compliance (full scope audit) -7District Institutional Research - Internal Reporting (Performance Mgmt.) (full scope) -8Procurement and Contract Management (full scope audit)In ProgressFieldwork9Independent Contract Workers (Joint Employer Liability Risks) (full scope audit)In ProgressPlanning10 Title IX Compliance (scope TBD)Deferred-11 Issues Follow-UpOngoing-5

Internal Audit Plan for Fiscal Year 2018 (Continued)(Status as of August 31, 2018)FY 2018 Audit Plan ProjectsStatusPhase--13 Business Office (Bursar) (Process Review) -14 International Programs (Process Review) -15 External Quality Assessment Review (Independent Quality Review of Internal Audit) -16 Internal Quality Assessment Review (Annual Self Assessment of Internal Audit) -FY 2018 Special Requests12 No Special Requests Received as of August 31, 2018.FY 2018 Process Reviews and Consulting Engagements3 6

Internal Audit Plan for Fiscal Year 2018 (Continued)(Status as of August 31, 2018)FY 2018 Audit Plan ProjectsStatusPhase-FY 2018 Investigations17 EthicsPoint (Case #542) Investigation (Case Received August 15, 2017) -18 EthicsPoint (Case #557) Investigation (Case Received January 5, 2018) -19 EthicsPoint (Case #577) Investigation (Case Received April 5, 2018) -20 EthicsPoint (Case #586) Investigation (Case Received May 3, 2018) -21 EthicsPoint (Case #587) Investigation (Case Received May 9, 2018) -22 Allegation of Misappropriation of Assets (Case Received October 31, 2017) -3 7

III. FY 2018 Summary of on Recommendations related to emergencyexercises, training, and outdated rosters. Internal controls related to safety andemergency information improvements.Management will continue toschedule exercises, supportmembers, provide training,and improve communications.SoftwareReview projectAcquisition,management methodologyImplementation, and processes and controls.Management Project management guidelines andtemplates were developed and updatedannually.NoneFull-Time Temporary Assess the use of full-timeFaculty Utilizationtemporary faculty (FTTs). The number of FTTs was increasing andseveral had been employed for more thantwo years.Management will consideramending hiring practicesprocedure.Business Office(Bursar) ProcessReview Recommendations related to inconsistentprocesses and additional security devices. Internal controls related to procedures andcash counts.Management will improveprocesses for safeguardingassets, consider additionalsecurity devices, and developwritten procedures.Enterprise RiskManagement andSafetyReview emergencyresponse andcommunications.Review physical security,internal controls, and cashhandling functions.88

III. FY 2018 Summary of Results iationSoftware LicenseComplianceEvaluate software licenseprocesses and compliancewith licensing requirements. Recommendations related to improvingmonitoring processes, licensingprocedures, and training.Management will enhance thesoftware managementprogram, develop procedures,and provide training.InstitutionalResearchEnsure communication andreports are accurate,complete, and timely. Internal controls related to formalprocedures, tracking system, andmonitoring access to data.Management will improvedocumentation for reportrequests and receive trainingrelated to monitoring access totheir server.InternationalPrograms ProcessReviewReview the policies,procedures, and processesused to manage andoperate the program. Recommendations related to clarifyingdetails of the business plan, updatingtravel warnings, and improving expenseand wire transfers.Management will documentbusiness plan projections,revise board policy, andimprove compliance withpolicies and proceduresrelated to reimbursement andwire transfer requests.Tobin Lofts – (Public-Private Housing Partnership) - Confidential & Privileged Attorney Work Product99

III. FY 2018 Summary of Corrective ActionProjectFY 2016 and Prior Year Projects(Six Audit Reports)Report DateIssue Countas Open Issuesas of9/1/2018% Closed5742%Enterprise Risk Management and Safety Audit11/22/201777Tobin Lofts Operations Audit11/22/201741Software Acquisition, Implementation andManagement Audit3/29/201811Business Office (Bursar) Process Review6/28/201862Software License Compliance Audit7/19/20183Institutional Research Audit8/27/20183International Programs Process %40%2148%Note: Verbal recommendations communicated with management during audits are not included in the issue count above .1010

IV. Consulting and Nonaudit Services Completed Ten consulting, investigative, or nonaudit engagements were performed in FY2018 Business Office (Bursar) Process ReviewInternational Programs Process ReviewSix Investigations Completed – Five of the six were EthicsPoint Hotline CasesTobin Lofts - Advisory Services to Legal DepartmentFull-Time Temporary Faculty Utilization Targeted Review Consulting services provided to management included: Tobin Lofts (Public–Private Housing Partnership) – Internal Audit provided services to theAlamo Colleges District Legal Department (Confidential & Privileged Attorney Work Product) Management Special Requests for Services At the request of the Chancellor, the Internal Audit Department performed a targeted review ofFull-Time Temporary Faculty Utilization. Based on the Chancellor’s request he submitted toInternal Audit in 2017, this review was included on the Approved FY 2018 Internal Audit Plan.1111

Quality Assurance andImprovement Program(QAIP)12

V. Quality Assurance and Improvement Program Internal Audit maintains an ongoing Quality Assurance and ImprovementProgram (QAIP). Periodic reviews are performed through self and external assessments. Annual self-assessment was conducted during March and April of 2018. Last external quality assessment was completed in May 2018. Next external quality assessment is scheduled for Spring 2021. Overall ratings were “Generally Conforms” on both internal and externalassessments. “Generally Conforms” means structures, polices, and procedures, as well asprocesses applied, comply with the requirements of the IIA Standards, theIIA Code of Ethics, and Generally Accepted Government Auditing Standards.1313

External Quality Assessment Review ofthe Internal Audit DepartmentReview Completed May 201814

15

16

17

18

19

20

21

FY 2018 Accomplishments Continued to update and refine the internal audit methodology and procedures Developed preparation materials for the May 2018 External Qualify Assessment Reviewof the Internal Audit Department. Internal Audit received the highest rating of “GenerallyConforms.” Updated the Internal Audit Department Procedures Manual supporting compliance withthe IIA Standards and the Board-approved Internal Audit Protocols. The Internal Audit Department is fully staffed and did not have any staffturnover during FY 2018. Continued enhancing employee development and continuing professionaleducation (CPE) opportunities. On track for an average of 120 hours of CPEand other training for CY 2018.2222

FY 2018 Accomplishments (continued) One Internal Audit staff member obtained Quality Texas Foundation ExaminerTraining (using the Baldrige Model) and was a member of the site review teamof an organization in Houston for the Texas Award for Performance Excellence(TAPE). Continued expanded support for Internal Audit staff to obtain additionalprofessional certifications. One Internal Audit staff member obtained theCertified Internal Auditor (CIA) professional certification in April of 2018. Twoother Internal Audit staff members are currently working on obtaining the CIAcertification.2323

FY 2018 Accomplishments (continued) Results: 75 percent (FY 2018) and 50 percent (FY 2017) increase in the number ofaudits completed versus the average completed FY 2013-2016. FY 2018 and FY 2017 metrics compared to the average of FY 2013-2016: Reduced the average hours per full scope project by 53 percent and 45 percent,respectively. Increased the total number of audits completed from the average of 4 to 7 and 6,respectively. Average audit process owner satisfaction rating – 4.75 of 5.0 (scale of 0 to 5) Reduced the number of open management corrective action plans from 38 inFY 2016 to 12 in FY 2017 and 21 in FY 2018. Percentage of staff holding professional certifications at 100 percent.2424

FY 2018 Accomplishments (continued)Average Hours Per Full Scope Audit1,5001,3961,200FY 2018 Audit Plan Target Average of 475 hours1,00890020165174958423300161317131094-0FY 2013FY 2014FY 2015FY 2016Average HoursFY 2017FY 2018Planned HoursFY 2013FY 2014AuditsOverall Customer SatisfactionFY 2015InvestigationsFY 2016Leadership SurveyBoard Survey PendingNo Board SurveyProcess Owner SurveyFY 2015Survey Sent;none returnedFY 2014No Board SurveyNo Board SurveyFY 2013FY 2016FY 2017Process ReviewsFY 2018Planned Engagements2018 Internal Audit Activity Time AllocationCompliance5%No Board Survey54.543.532.521.510.50FY 2018 Audit Plan Target 1312707600Total Audits, Process Reviews,and Investigations CompletedFY 2017Board SurveyFY 6%Target 4.72525

Balanced Scorecard2626