Chairman Alvis It's 2:00 pm and I call to order the August 25th, 2026, meeting of the Texas Transportation Commission Audit Subcommittee in Austin, Texas. Note for the record, public notice of this meeting, containing all items on the agenda, was filed with the Secretary of State, 12:19 p.m. on Monday, August 17th, 2026, which is at least seven days prior to the meeting, in accordance with Government Code 551.044. At this time, I would like to ask that before we begin today's meeting, you place all cell phones and other communication devices in the silent or off mode. All speakers should say their name and title before speaking. Thank you and I will now turn the meeting over to Chief Audit Compliance Officer Parsons Townsend. Chief Townsend Thank you chairman. At this time, I ask for everyone's full attention to the screen as we show the Greer Building safety video describing emergency exits and other emergency procedures. Greer Safety Video Narrator Attention Please. The following is a safety briefing to help ensure your personal safety while at the Texas Department of Transportation Greer Building. In case of a medical emergency, please call 911. The automated external defibrillator unit is located here on level 1 in the main lobby at the security booth. First aid kits are marked and located on each floor. Fire extinguishers are market and located on each floor. In the event of an evacuation proceed to the nearest exit. Once outside proceed to the west parking lot of the Greer building located at the corner of congress avenue and 11th street. In case of tornado or inclement weather, stay inside, move away from exterior walls and windows. The designated shelters are stairwells, basement, interior hallways, and centrally located restrooms. In case of active shooter or bomb threat, follow instructions from the public address system and onsite security personnel for more details. Thank you for your time, have a safe and productive meeting. Chief Townsend I now turn the meeting back over to you Chairman Alvis. Chairman Alvis Now we will open with comments from my fellow commissioner. Commissioner Gordon, do you have any comments you would like to offer at this time? Commissioner Gordon I do not have any comments. Chairman Alvis. Thank you. We will not consider the approval of the minutes from the May 20th, 2026 Audit Subcommittee meeting. Draft minutes have been provided. May I have a motion? Commissioner Gordon Motion to approve. Chairman Alvis Second motion. All in favor, say aye. Chairman Alvis and Commission Gordon Aye. Aye. Chairman Alvis Motion carries. I will now turn the meeting over to Chief Townsend. Chief Townsend I thank Chairman. Item 3 is the Financial Management Division Update. Accounting Section Director, Megan Lowary, will present. Section Director Lowary Good afternoon. My name is Megan Lowary. I'm the accounting section director in the financial management division. I'm presenting the results of the recently completed completed internal controls testing over financial reporting. In 2014, the commission designated this engagement as the spirit of Sarbanes-Oxley initiative. The objectives of the SOX testing are to strengthen internal controls over financial reporting, to provide assurance regarding the adequacy of internal controls over financial reporting, and to meet the spirit of SOX requirements as directed by the commission. In 2026, the Compliance Division supported the Financial Management Division Spirit Initiative by testing the operating effectiveness of 16 key controls over financial reporting. Financial management selects the controls for testing each year on a rotating basis. Compliance confirmed that the testing cover texts most material accounts, including included in the audited annual Comprehensive Financial Reports. At the end of the engagement, the Compliance Division provided a final report with the results of the testing. The testing results were that all controls were appropriately designed and operating effectively. Fiscal year 2026 testing covered areas such as debt issuance oversight, general IT controls, payment review and approval, and federal billing reconciliation. Financial Management Division looks forward to partnering with the Compliance Division again for the 2027 Spirit of SOX Engagement. Financial management will complete a risk assessment and select the controls for testing, while Compliance will test the operating effectiveness of those controls using data from the first three quarters of the fiscal year. Throughout the year, the two divisions will work together to identify opportunities to strengthen key controls over financial reporting. That concludes my presentation. I'm happy to answer any questions. Chairman Alvis Thank you so much, Megan. Great. I will not consider The approval of the audit and compliance performance metric minute order and the order has been provided. Do I have a motion. Commissioner Gordon Motion to approve. The audit report. Chairman Alvis Seconded. All in favor? Chairman Alvis and Commissioner Gordon Aye. Aye. Chairman Alvis Motion carries, I will not turn the meeting over to Chief Townsend. Chief Townsend Okay. Moving on from item four, we'll go to item five, the Compliance Division update, Cheryl Durkop. Director Durkop Good afternoon. Chairman Alvis... Commissioner Gordon. The Compliance division will be presenting a summary of investigations for the first, excuse me, the fourth quarter fiscal year 2026, as well as our FY 27 compliance work plan. The summary of investigations includes fraud, waste and abuse as well as EEO investigations. Our fourth quarter data does include investigations from June and July. August is not in this data set yet. Overall for the quarter, we received 183 allegations. We initiated 29 investigations and substantiated 18 of the 33 investigations that we closed, resulting in a substantiation rate of 55%. During the fourth quarter, we substantiated several cases of falsified documentation, including falsifying hot mix test results and falsified employee timesheets. I do have three significant investigations that I would like to highlight for you today. First, we substantiated an investigation where it was determined that the material process inspector did not perform quality assurance testing and falsified rice gravity test results for hot mixed material on at least 23 sublots. So this employee was terminated. And our second investigation we substantiated involved for employees who participated in a six hour charter fishing trip to Galveston on a date when they were scheduled to be at a multi-day conference. In Houston. All four of these employees did report a full day's work on their timesheets, although there was no evidence to support at any of the four attended the expo. In addition, one of the employees misused their text vehicle by traveling between the expo and Houston and personal activities in Galveston. All four of these employees were also terminated. The third investigation we substantiated involving TxDOT's Communications Division 2026 Conference Division employees participated in planning vendor hosted events that involved food and alcoholic beverages, and participated in procurement activities in connection with the conference. Three employees resigned in lieu of termination. Are there any questions I can answer involving the fourth quarter summary? Commissioner Gordon No questions. Chairman Alvis No questions for me, Cheryl. Thank you. Director Durkop So what you're seeing here are the results of investigations that were closed during the fourth quarter, organized by allegation category. Workplace harassment and employees conduct are the most common allegations investigated this quarter. However, the majority of the workplace harassment cases investigated were unsupported. During the fourth quarter, we did substantiate cases of employment misconduct, including inaccurate recording of time, vehicle misuse, misuse of state property, unauthorized outside employment. This next slide covers the allegations by category over the last 12 months. We have continued to see a decrease in substantiated investigations of workplace harassment over the past six months. Unfortunately, we are seeing an increase in substantiated third party investigations, and this is due in part to the identification of the falsified laboratory equipment calibration results at third party labs. In fiscal year 25. We had 8 third parties that were referred to sanctions, and in fiscal year 26, we had 9 entities that were referred to sanctions, which did result in 5 departments with two cases that are currently in appeal. Were there any questions I can answer regarding investigations for the fourth quarter? Commissioner Gordon No questions. Director Durkop Thank you. Our Fiscal year 2027 work plan. We did complete a risk assessment that was focused on fraud, compliance and third party risks incorporating input from across TxDOT. This input helps to drive what our annual plan will look like. The top risks that we identified included third party risk management, sub recipient grant management, conflicts of interest, and falsification of documentation. Our external audit group will be conducting risk based audits of external entities to include local governments, traffic safety grants, sub recipients, and airport improvements sub recipients. Our grant compliance group will be focused on outreach, training and assisting TxDOT divisions and grant recipients and maintain compliance to maintain compliance with state and federal regulations. So are there any questions about our external plan for the year. Chairman Alvis No, Cheryl. Commissioner Gordon No questions. Director Durkop Compliance engagements this year will focus, will have a major focus on the continued development of our monitoring detection program. Our data analytics team is currently collaborating with multiple divisions to detect potential fraud and abuse related to fuel card activities, duplicated testing, p-card transactions, and fuel misuse. We're also continuing to work with operational divisions to better understand the daily fraud risks, for example MTD and the duplication of calibration results. This is a continuing issue, that unfortunately, we expect to see continue seeing. Our investigation section will continue with outreach activities and investigations. We will also be focusing on educational campaigns with both the districts and divisions, and participate in training during TxDOT and industry conferences. So that concludes my presentation. Are there any questions I can answer? Chairman Alvis Questions? No questions. Commissioner Gordon No questions. Chairman No questions, Cheryl. Good job, thank you. Chief Townsend Thank you, Cheryl. Moving on. Item six is the Internal Audit Division update. The Division Director Craig Otto will present. Director Otto Thanks. Good afternoon. Two items that go through. First one will be item 6a, which was the local government project oversight audit. Overall the engagement ring was a yellow which is a priority three. There were four overall findings noted. I mainly talk about one two of them to give you some perspective of where we feel the greatest areas of improvement will be. Major impacts, risks found, were around control improvements or where control improvements were needed around permitting unallowable costs. That's ultimately what we're trying to do here is the local governments are working with their contractors, TxDOT, primarily districts, is obligated to provide oversight. And then as reimbursements come in, TxDOT needs to review documentation, information to provide their agreement so that reimbursements can then be provided back to local government. So pretty, pretty straightforward. The scope of our work was in relation to 19 local government projects, and there were 7 districts that were part of our sampling process. Go to the next slide. The oversight details get a little bit further into some of the details of the areas that I'd like to discuss. Primarily was established [garbled audio]. One was sort of the monitoring. There were areas that TxDOT typically needs to engage in upfront, specifically in the district. So on site visits, you know, establishing and understanding, working with the local governments to know the project, to make sure that they're aware progress is being made, etc. And then secondly, we'll talk a little bit about the reimbursement reviews, which again is important, making sure that the local governments are only receiving allowable types of reimbursements. And we'll get into a couple examples of things that TxDOT and some of these districts also need to to work on for areas of improvement. So is it relates to the monitoring of areas. So for instance one is the Buy America compliance with the districts. We noted 13 of 19 projects for 68% did not always demonstrate and retain on site validation. Doesn't, you know, when we ask for information to be provided, the district should be obtaining something from the local governments so that we can then ascertain, as with the reimbursement process goes along, that the information is there when something is unable to be provided to us. You know, that's basically where we'll stop and we'll make the declaration that, you know, there's a chance, potential, chance that there may have been unallowable expenditures and specifically with Buy America. You know, we've done audits in the past on this area. It can be a very challenging and difficult process with so much materials coming in. And I'm sure as you both know, laws are changing and that's evolving as well. So again, areas of improvement there are making sure that not only we demonstrate that we are there on site seeing this product being put in, but also making sure we retain the documentation so we can create that audit trail, if we are ever asked. Secondly, 61% of the projects did not have documentation for onsite observations. So what I was alluding to upfront, that was where the districts will determine and document what their plan is, the frequency of their visits, and things of that nature. And that then should correspond to when they go out to the local governments. There should be a better understanding of how the project is moving along and what type of information the district should be expecting to see as it relates to the reimbursement process, which most will get into here. As it relates to that 78% of lines. So what we would do is we would take not only the invoice, but we look at the lineup specifically. And one of the things the tests that we did is we looked at the original contract that was established and where we noted quantity changes or unit cost changes. That typically means there was probably a change order. And so one of the things that needs to happen is that information needs to flow to the district so that they give their approval and understanding of what changes may have occurred. In that case, we noted about $276,000 of items that there was not support that was able to be provided to my audit teams for them to make the declaration that, yes, they did see this. Again, retention is one of the things that we're stressing a lot with the districts to make sure that you keep that that trail in place. Secondly, there were also line items, 44% that didn't provide reimbursement documentation. So one of the things that we had had determined was there may have been, let's say, 13 on 19 projects where information wasn't received, but for those ones that were or did have documentation, we sampled those line items in there, just making sure that the reimbursement process is working the way it should. And that's where we came up with 44% of those line items. So there are situations where we sometimes didn't have the documentation and sometimes where we did have the documentation. When we looked at those instances where documentation was retained, we still found some areas of improvement where we have to make sure we retain and substantiate what, you know, review was performed by the districts. Lastly, and this one is fairly straightforward, so the local government typically needs to make a or should make a contractor payment that would then trigger the reimbursement process. So there was 27% or 8 of the 30 reimbursements that we tested. We're unable to get that confirmation. In areas for needing improvement is the district validation up front and then also understanding on the reimbursement side, that's important that we have sort of standardized parameters of how the district should go about reviewing these reimbursements. Oftentimes, it's up to the reviewer to determine how many lines are going to choose. Clearly, you know, sometimes risk can rise in a particular line item, and that may be something that TPD may want to direct and help the districts understand. This may be an area of vulnerability. So let's make sure that we are looking at potentially, let's say, salaries, things of that nature. So making sure that you audit trail stays intact is critical and important in this process. Any questions as it relates to the local government project or site details that I laid out here? Chairman Alvis You're saying that there was, if I understood you right, a percentage where we reimbursed county, but they hadn't yet paid their contractor? Director Otto Well. We asked... Chairman Alvis We didn't have verification that they had already paid them? Director Otto Correct. We want that. We want to see. Did you make... Chairman Alvis That not supposed to pay until they had. Correct. Director Otto Yeah. Chairman Alvis Okay. Director Otto Now we're seeking that information. So the districts are going to be out there. Chairman Alvis Part of the question. Commissioner Gordon Thank you. No. Okay. Director Otto Thank you. Item 6b. This is our the internal audit plan review. Just to give you a little bit of insight on this. So this is just for preliminary approval and review. Parsons tomorrow will go in front of the full Transportation Commission to get approval of that. And ordered the Texas Internal Auditing Act requires us to create internal audit plan using risk assessment techniques for the 2027 plan. There are 20 risk based audit engagements, those, I believe, have been provided to you in your information. What that capsulated is as we go through all of our interviews, including working with for some other external parties, as well as district engineers, division directors, administration, yourself, that's going to cover about 33% of the risks that were identified. One other thing to incorporate is our Q4. Any any audit usually started or in or trying to finish in Q4. There's a likelihood that those may carry over. So we have 5 of those from the 26 plan. The goal I know Parsons is like, you know, let's let's plan on September, you know, if not any later than that. Typically, we should be far enough along that we should bring the closure any carriers from a preceding year. Another thing to mention as it relates to the audit plan Parsons is the chief audit compliance officer. And through me and working with my team, we have to make sure we have adequate resources, which we do also have adequate budget, which we do, and also trying to make sure that we address these risks in an adequate time period. And it's also important to make sure that he's able to confirm that to the board, that we have an independence To continue onto the next slide. This is basically just an illustration of 5 areas. These have been pretty sustained areas of what we'll look at. There's project delivery, financial management, asset recovery, program optimization right. And technology and cybersecurity as well as governance, third party monitoring. And I'll go into some examples of what we'll be looking at as part of the plan as it relates to project delivery, an area that has come to our attention that we're looking to work with the districts and various other divisions around our scheduling, construction, project scheduling. You know, the community, of course, wants things done fast, and we want to make sure that we have the tools in place to make sure that we can visibly see, communicate and be transparent to that. We're also going to look at physical security. We've been in a process. I've been here 14 years now and pretty much ever since I started. A lot of districts still don't have a fully comprehensive security platform for all their facilities. And so we're going to provide Marc and his team. You know, I'm working with SSD, of course, to make sure that there's agreement of where we need to put our focus and make sure that that is. Addressed in the financial asset recovery one area. Again, in the RTI research technology indication, an area we have not audited in a while, but, you know, has the fortitude of making sure, you know, sure, that there's research project continuing upwards of almost $93 million. We're going to go in there, take a look and make sure from what we're spending money on, are we getting what we expect in return? Also, making sure that we understand the scope of work follows. As such. The program optimization third area site, formerly Site Manager now has been implemented. And so we're going to oftentimes what happens with major rollouts like this. We come in on the back side. It's called a post implementation review. Try to make sure that all the, you know, attributes and promises, the things that we're supposed to be put in are, are there are working, and we help facilitate where we can get areas of improvement to address quicker. If there are concerns from users, you know, we pass those on and we try to assimilate and understand what that risk may be, and oftentimes things can be remediated. Next we have in the IT space always consistently looking at this year round in regards to safeguarding the access of our data, especially in the AI space. Now there's so much that we have to guard, and it has done an outstanding job getting out in front of this, unlike other agencies across the state. So I know Marc, um, is you know, especially with on as well as Anh, our CIO and have communicated to the broader text family, this is something we need to use, and we want to make sure that, of course, we're keeping an eye on that. Lastly, in the governance third party monitoring space, there have been some organizational changes in areas like flight services and ferries. So very operations. So we want to make sure that we're out there working with the teams also, talking with those that previously oversaw to make sure that we're running these programs as efficiently and effectively as possible and then giving Marc a heads up where we may have some opportunities to improve. So are there any questions as it relates to the Fi 2027 audit plans for post? Chairman Alvis No. It's great. Commissioner Gordon No questions. Chairman Alvis Okay. Thank you. Chief Townsend All right. With all agenda items completed, I now turn the meeting back to you, Chairman. Chairman Alvis We will not meet in executive session today with all agenda items concluded. Are there any other comments? Commissioner Gordon No comments. Chairman Alvis We plan to conduct the next Texas Transportation Commission Audit Subcommittee December 16th, 2026. There will be no other comments. May I have a motion to adjourn? Commissioner Gordon So moved. Chairman Alvis Second, all in favor say aye. Chairman Alvis and Commissioner Gordon Aye. Aye. Chairman Alvis Motion carries. Please note for the record, it is two... Executive Director Williams Disregard that. [referring to his accidental saying of Aye during the adjournment vote] Chairman Alvis Note for the record, it is 2:56 pm, and this meeting stands adjourned.