Garza/Gonzalez & Associates

Garza/Gonzalez & AssociatesCERTIFIED PUBLIC ACCOUNTANTSTEXAS STATE SECURITIES BOARDAustin, TexasINTERNAL AUDIT PLANFor Fiscal Year 2022207 Arden GroveSan Antonio, TX 78215210/227-1389Fax 227-0716

TEXAS STATE SECURITIES BOARDAustin, TexasInternal Audit PlanFor Fiscal Year 2022TABLE OF CONTENTSPageInternal Auditor’s Report .1I.Methodology . 2-4II. Audit Scope .4III. Internal Audit Plan .5ATTACHMENTSAttachment A - Risk Assessment Summary.6Attachment B - History of Areas Audited .7

Garza/Gonzalez & AssociatesCERTIFIED PUBLIC ACCOUNTANTSBoard Members and Audit Committee MembersTexas State Securities BoardAustin, TexasEnclosed is the Texas State Securities Board’s (SSB) proposed Internal Audit Plan (Plan) that was preparedfor audits and other functions to be performed in fiscal year 2022. This Plan determines the scope of internalaudit activities and is the source for assignment and prioritization of internal audit responsibilities for fiscalyear 2022. Specific planning for audit procedures is a naturally ongoing process; thus, the Plan is reviewedannually and may be revised by the Board or Audit Committee, as necessary.This Plan has been prepared by Garza/Gonzalez & Associates, an independent Certified Public Accountingfirm, following Generally Accepted Auditing Standards, International Standards for the ProfessionalPractice of Internal Auditing, and the Institute of Internal Auditors’ Code of Ethics contained in theProfessional Practices Framework.May 9, 2022207 Arden GroveSan Antonio, TX 78215210/227-1389Fax 227-07161

TEXAS STATE SECURITIES BOARDAustin, TexasInternal Audit PlanFor Fiscal Year 2022I. MethodologySSB’s fiscal year 2022 Internal Audit Plan (Plan) was prepared utilizing a risk assessment process, where wereviewed various documents; and, questionnaires completed by SSB’s Audit Committee Chair, Commissioner,and other staff, as documented below.The following documents were reviewed and considered in our risk assessment process: Organizational ChartsFinancial and Non-Financial ReportsPolicies and ProceduresApplicable Laws and RegulationsAudits and/or Monitoring Reports from Third Party AgenciesPrior Internal Audit ReportsQuestionnaires were developed for completion by SSB’s Audit Committee Chair; Commissioner; and, DivisionDirectors, to update our understanding of each division, and its role within the overall scheme of SSB. Thequestionnaires included topics; such as, issues and/or concerns, recent changes in key personnel, time elapsedsince last audit or review, status of past audit findings, and regulatory compliance requirements (e.g., TAC 202,Information Security Standards; contract management; and, benefits proportionality). Utilizing the informationobtained through the completed questionnaires and background information reviewed, 11 audit areas wereidentified as the potential audit topics. A risk analysis was completed for each of the 11 potential audit topics andthen compiled to develop SSB’s overall risk assessment.The following 8 risk factors were considered for each potential audit topic:1. MaterialityMeasure of the auditable unit’s financial materiality based onthe dollar amount per year of assets, receipts, or disbursementsfor which the unit is responsible; or, non-financial materialitybased on the degree of its responsibility related to theagency’s primary mission.2. Time since Last Audit or ReviewMeasure of the number of years between the date of the previousaudit or review and the date of the risk assessment.3. Results of Prior Audit or ReviewMeasure of the results of the prior audit or review.4. Adequacy of Staffing LevelsMeasure of the adequacy of the auditable unit’s staffing level asit relates to the achievement of its objectives.2

TEXAS STATE SECURITIES BOARDInternal Audit PlanMeasure of the existence of policies and procedures documentingthe auditable unit's activities.5. Policies and Procedures6. Compliance with Contracts, Laws, Measure of the complexity of contracts, laws, and/or regulationsfor which the auditable unit is responsible for ensuringand Regulationscompliance.7. Susceptibility ofAbuse, or Fraud8. Issues or ConcernsTheft,Waste, Measure of the auditable unit’s risk and controls in place as itrelates to theft, waste, abuse, or fraud.Measure of issues or concerns expressed in completedquestionnaires.Risk AssessmentFollowing are the results of the risk assessment performed for the 11 potential audit topics identified:HIGH RISKMODERATE RISKLOW RISKConducting Inspections1Human Resources and PayrollProcessing Cash Receipts/Disbursements/MailProcurement/Contract Management/HUBAccounting/Financial Reporting/Fixed Assets/TravelProcessing DealerApplications2Processing Securities Applications2Complaints Process1Records ManagementEnforcement1Information Technology12Includes Performance Measures.Includes Performance Measures and Registration & Filing Fees.This report includes the “Risk Assessment Summary” as Attachment A; and, the “History of Areas Audited” asAttachment B, which lists audits and/or reviews performed from fiscal year 2012 through 2022 for the above 11potential audit topics.In the prior 3 years, the internal auditor performed the following internal audit functions:Fiscal Year 2021: Risk Assessment & Preparation of the Internal Audit Plan Enforcement Follow-up of Prior Year Internal Audits Preparation of the Internal Audit Annual Report3

TEXAS STATE SECURITIES BOARDInternal Audit PlanFiscal Year 2020: Risk Assessment & Preparation of the Internal Audit Plan Records Management Follow-up of Prior Year Internal Audits Preparation of the Internal Audit Annual ReportFiscal Year 2019: Risk Assessment & Preparation of the Internal Audit Plan Accounting & Financial Reporting Follow-up of Prior Year Internal Audits Preparation of the Internal Audit Annual ReportII. Audit ScopeIn accordance with the International Standards for the Professional Practice of Internal Auditing, the auditscope will encompass the examination and evaluation of the adequacy and effectiveness of SSB’s system ofinternal control and the quality of performance in carrying out assigned responsibilities. The audit scope includes: Reliability and Integrity of Financial and Operational Information – Review the reliability andintegrity of financial and operating information and the means used to identify, measure, classify, andreport such information. Compliance with Policies, Procedures, Laws, Regulations and Contracts – Review the systemsestablished to ensure compliance with those policies, procedures, laws, and regulations and contracts thatcould have a significant impact on operations and reports, and determine whether the organization is incompliance. Safeguarding of Assets – Review the means of safeguarding assets and, as appropriate, verify theexistence of such assets. Effectiveness and Efficiency of Operations and Programs – Appraise the effectiveness and efficiencywith which resources are employed. Achievement of the Organization’s Strategic Objectives – Review operations or programs to ascertainwhether results are consistent with established objectives and goals and whether the operations orprograms are being carried out as planned.4

TEXAS STATE SECURITIES BOARDInternal Audit PlanIII. Internal Audit PlanIn addition to performing the 2022 risk assessment for preparation of this Internal Audit Plan (Plan), this Plan alsoincludes one audit to be performed; a follow-up of the prior year audit recommendations; other tasks that may beassigned by the Board or Audit Committee during the year; and, preparation of the Internal Audit Annual Reportfor fiscal year 2022.The area recommended for internal audit and other functions to be performed for fiscal year 2022 are as follows:1. Completion of the Fiscal Year 2022 Risk Assessment and Preparation of this Internal Audit Plan2. Audit of Cash Receipts/Disbursements/Mail Processing AreaAn audit of this area will be performed to assess whether SSB’s established policies and procedures andinternal controls, as designed, are operating effectively, in ensuring accurate and timely performance ofcash receipts, disbursements, and mail functions.3. Follow-Up of Prior Year Internal Audits and Prepare the 2022 Internal Audit Annual ReportPerform follow-up procedures to determine the status of the prior year comments that were not fullyimplemented as of fiscal year 2021 and prepare the 2022 Internal Audit Annual Report. The follow-upaudit procedures will result in a determination that the recommendation is (1) Fully Implemented; (2)Substantially Implemented; (3) Incomplete/Ongoing; or (4) Not Implemented.4. Other TasksOther tasks as may be assigned by the Board or Audit Committee during the fiscal year.5

ATTACHMENTS

Attachment ATEXAS STATE SECURITIES BOARDRisk Assessment SummaryFor Fiscal Year 2022Potential Audit TopicHigh Risk 1761,31 Conducting Inspections23456789101110.00%16.50%16.00%RISK FACTOR WEIGHT15.00%12.50%123RISK FACTORS45MaterialityTime SinceLast Audit orReviewResults ofPreviousAudit orReviewAdequacy ofStaffingLevelsPolicies acts,Laws &Regulations78Susceptibility ofTheft, Waste,Abuse, orFraudIssues 0216.00110.00198.50Processing Dealer Applications 2Processing Securities Applications 2Enforcement 1Information Technology (includes Disaster Recovery 00160.50160.50159.00158.00Low Risk 153Processing Cash Receipts/ Disbursements/ Mail4Accounting/ Financial Reporting/ Fixed Assets/ TravelComplaints Process 1Records 151.00130.00126.50116.00Moderate Risk 153 - 1764Human Resources and PayrollProcurement/ Contract Management/ HUB 41Includes Performance Measures.Includes Performance Measures and Registration & Filing Fees.3Does not consider the FY22 ongoing audit being conducted by the State Auditor's Office.4Does not consider the FY22 Post-Payment audit performed by the Comptroller of Public Accounts since the report has not been released.2Risk Factor Rating:1 - Low Risk2 - Moderate Risk3 - High Risk6

Attachment BTEXAS STATE SECURITIES BOARDHistory of Areas AuditedFor Fiscal Year 2022POTENTIAL AUDIT TOPIC3Accounting & Financial Reporting (includes Fixed Assets & Travel)Complaints Process 12Conducting Inspections 14Enforcement 15Human Resources & Payroll6Information Technology (includes Disaster Recovery Plan)7Processing Cash Receipts/Disbursements/Mail8Processing Dealer Applications 29Processing Securities Applications 210Procurement/Contract Management/HUB11Records Management11Includes Performance Measures.2Includes Performance Measures and Registration & Filing Fees.201220132014A20152019C*20202021A2022 *C*A(1)Legend (audits/reviews with asterisk (*) are considered limited scope for the audit area)AFiscal Year Audited/Reviewed201620172018Internal audit performed by Garza/Gonzalez & Associates, CPAs.A1 Internal audit performed by Monday Rufus & Co.BSunset review performed by the Sunset Advisory Commission.CPost-Payment audit performed by the Comptroller of Public Accounts.DIT assessment performed by the Department of Information Resources (DIR) or a third-party vendor procured through DIR.EPolicy review performed by the Texas Workforce Commission.FAudit performed by the State Auditor's Office.7Partial fiscal year through April 2022

assigned by the Board or Audit Committee during the year; and, preparation of the Internal Audit Annual Report for fiscal year 2022. The area recommended for internal audit and other functions to be performed for fiscal year 2022 are as follows: 1. Completion of the Fiscal Year 2022 Risk Assessment and Preparation of this Internal Audit Plan 2.