§ 2116-b. Internal audit function. 1. No later than July first, two
thousand six, each school district shall establish an internal audit
function to be in operation no later than the following December
thirty-first. Such function shall include: (a) development of a risk
assessment of district operations, including but not limited to, a
review of financial policies and procedures and the testing and
evaluation of district internal controls; (b) an annual review and
update of such risk assessment; and (c) preparation of reports, at least
annually or more frequently as the trustees or board of education may
direct, which analyze significant risk assessment findings, recommend
changes for strengthening controls and reducing identified risks, and
specify timeframes for implementation of such recommendations.

2. School districts of less than eight teachers, school districts with
actual general fund expenditures totaling less than five million dollars
in the previous school year, or school districts with actual enrollment
of less than one thousand five hundred students in the previous school
year shall be exempt from this requirement. Any school district claiming
such exemption shall annually certify to the commissioner that such
school district meets the requirements set forth in this subdivision.

3. The commissioner, in consultation with the comptroller, is
authorized to promulgate regulations with respect to the internal audit
function as is necessary for the proper performance of its duties,
including standards, qualifications and training for audit personnel. In
developing such regulations, the commissioner shall consider the
differing needs, capabilities and environments of school districts of
varying sizes across the state.

4. A district shall be permitted to utilize existing district
personnel to fulfill this function, but such persons shall not have any
responsibility for other business operations of the district while
performing such function.

5. A district shall be permitted to use (a) inter-municipal
cooperative agreements, (b) shared services to the extent authorized by
section nineteen hundred fifty of this title, or (c) independent
contractors, to fulfill this function as long as personnel or entities
performing the internal audit function comply with any regulations
issued by the commissioner and meet professional auditing standards for
independence between the auditor and the district.

6. Personnel or entities performing the internal audit function shall
report directly to the trustees or board of education of each district.
The district audit committee established under section twenty-one
hundred sixteen-c of this article shall assist in the oversight of the
internal audit function on behalf of the trustees or board.

7. Nothing in this section shall be construed as requiring a school
district in any city with a population of one hundred twenty-five
thousand or more to replace or modify an existing internal audit
function where such function already exists by special or local law, so
long as the superintendent of the district annually certifies to the
commissioner that the existing internal audit function meets or exceeds
the requirements of this section.