(a) An institution of higher education may not exercise the acquisition authority granted by § 51.9335 or 73.115 unless the institution complies with this section. An institution that is determined under Subsection (j) to not be in compliance with this section is subject to the laws governing acquisition of goods and services by state agencies, including Subtitle D, Title 10, Government Code, and Chapter 2254, Government Code.
(b) The board of regents of an institution of higher education by rule shall establish for each institution under the management and control of the board:
(1) a code of ethics for the institution’s officers and employees, including provisions governing officers and employees authorized to execute contracts for the institution or to exercise discretion in awarding contracts, subject to Subsection (c);
(2) policies for the internal investigation of suspected defalcation, misappropriation, and other fiscal irregularities and an institutional or systemwide compliance program designed to promote ethical behavior and ensure compliance with all applicable policies, laws, and rules governing higher education, including research and health care to the extent applicable;
(3) a contract management handbook that provides consistent contracting policies and practices and contract review procedures, including a risk analysis procedure, subject to Subsection (d);
(4) contracting delegation guidelines, subject to Subsections (e) and (f);
(5) training for officers and employees authorized to execute contracts for the institution or to exercise discretion in awarding contracts, including training in ethics, selection of appropriate procurement methods, and information resources purchasing technologies; and
(6) internal audit protocols, subject to Subsection (g).

(c) The code of ethics governing an institution of higher education must include:
(1) general standards of conduct and a statement that each officer or employee is expected to obey all federal, state, and local laws and is subject to disciplinary action for a violation of those laws;
(2) policies governing conflicts of interest, conflicts of commitment, and outside activities, ensuring that the primary responsibility of officers and employees is to accomplish the duties and responsibilities assigned to that position;
(3) a conflict of interest policy that prohibits employees from having a direct or indirect financial or other interest, engaging in a business transaction or professional activity, or incurring any obligation that is in substantial conflict with the proper discharge of the employee’s duties related to the public interest;
(4) a conflict of commitment policy that prohibits an employee’s activities outside the institution from interfering with the employee’s duties and responsibilities to the institution;
(5) a policy governing an officer’s or employee’s outside activities, including compensated employment and board service, that clearly delineates the nature and amount of permissible outside activities and that includes processes for disclosing the outside activities and for obtaining and documenting institutional approval to perform the activities;
(6) a policy that prohibits an officer or employee from acting as an agent for another person in the negotiation of the terms of an agreement relating to the provision of money, services, or property to the institution;
(7) a policy governing the use of institutional resources; and
(8) a policy providing for the regular training of officers and employees on the policies described by this subsection.
(d) An institution of higher education shall establish contract review procedures and a contract review checklist that must be reviewed and approved by the institution’s legal counsel before implementation. The review procedures and checklist must include:
(1) a description of each step of the procedure that an institution must use to evaluate and process contracts;
(2) a checklist that describes each process that must be completed before contract execution; and
(3) a value threshold that initiates the required review by the institution’s legal counsel unless the contract is a standard contract previously approved by the counsel.
(e) An institution of higher education’s policies governing contracting authority must clearly specify the types and values of contracts that must be approved by the board of regents and the types and values of contracts for which contracting authority is delegated by the board to the chief executive officer and by the chief executive officer to other officers and employees of the institution. An officer or employee may not execute a document for the board unless the officer or employee has authority to act for the board and the authority is exercised in compliance with applicable conditions and restrictions.
(f) An institution of higher education may not enter into a contract with a value of more than $1 million, including any amendment, extension, or renewal of the contract that increases the value of the original contract to more than $1 million, unless the institution’s board of regents approves the contract, expressly delegates authority to exceed that amount, or expressly adopts an exception for that contract. The board must approve any amendment, extension, or renewal of a contract with a value that exceeds 25 percent of the value of the original contract approved by the board unless the authority to exceed the approved amount is expressly delegated by the board or an exception is expressly adopted by the board for that contract.
(g) The board of regents of an institution of higher education shall adopt standards for internal audits conducted by the institution to provide a systematic, disciplined approach to evaluate and improve the effectiveness of the institution’s risk management, control, and governance processes related to contracts and to require risk-based testing of contract administration. The internal auditor must have full and unrestricted access to all institutional property, personnel, and records. An internal auditor must report directly to the board of regents in accordance with Chapter 2102, Government Code.
(h) The chief auditor of an institution of higher education shall annually assess whether the institution has adopted the rules and policies required by this section and shall submit a report of findings to the state auditor. In auditing the purchase of goods and services by the institution, the state auditor shall determine whether an institution has adopted the required rules and policies.
(i) If the state auditor determines that an institution of higher education has failed to adopt the required rules and policies, the auditor shall report that failure to the legislature and to the institution’s board of regents and shall, in consultation with the institution, adopt a remediation plan to bring the institution into compliance. If the institution fails to comply within the time established by the state auditor, the auditor shall find the institution to be in noncompliance and report that finding to the legislature and comptroller.
(j) In accordance with a schedule adopted by the state auditor in consultation with the comptroller, the authority of an institution of higher education to acquire goods and services as provided by § 51.9335 or 73.115 is suspended if the institution fails to comply with the remediation plan under Subsection (i) within the time established by the state auditor. As a result of the suspension, the laws, including Subtitle D, Title 10, Government Code, and Chapter 2254, Government Code, governing acquisition of goods and services by state agencies from which the institution is otherwise exempt, shall apply to the institution’s acquisition of goods and services.