N.Y. Executive Law § 952: Internal audit responsibilities

§ 952. Internal audit responsibilities. 1. The director of the

division of the budget, after reviewing the evaluation of the head of

each state agency as to the need for an internal audit function, shall

issue and, at the director's discretion, periodically revise a schedule

of state agencies (other than the department of audit and control and

the department of law) which are required to establish and maintain an

internal audit function. The comptroller and the attorney general or

their designees shall determine, and periodically review such

determination of, whether an internal audit function within their

respective departments is required. Establishment of such function shall

be based upon an evaluation of exposure to risk, costs and benefits of

implementation, and any other factors that are determined to be

relevant. The head of each state agency listed in the budget director's

schedule, and the comptroller and the attorney general if they or their

designees so determine, shall establish an internal audit function which

operates in accordance with generally accepted professional standards

for internal auditing. Any such internal audit function shall be

directed by an internal audit director who shall report directly to the

head of such state agency. Notwithstanding any other provision of law,

each internal audit director shall be appointed by the head of the state

agency based on appropriate internal auditing credentials of the

proposed appointee, consistent with generally accepted standards for

internal auditing, including internal auditing education and experience.

The position of internal audit director shall be an exempt position and

except in the case of the department of audit and control and department

of law, such appointment shall be subject to the approval of the

director of the budget. For agencies for which an independent audit is

not required pursuant to sections nine hundred fifty-three and nine

hundred fifty-four of this article, the internal audit function shall

evaluate the agency's internal controls and operations. The internal

audit function shall also identify internal control weaknesses that have

not been corrected and make recommendations to correct these weaknesses.

2. In the event the head of a state agency does not establish an

internal audit function pursuant to subdivision one of this section, he

or she shall nevertheless establish and maintain the program of internal

control review required by section nine hundred fifty-one of this

article.