§ 952. Internal audit responsibilities. 1. The director of the
division of the budget, after reviewing the evaluation of the head of
each state agency as to the need for an internal audit function, shall
issue and, at the director's discretion, periodically revise a schedule
of state agencies (other than the department of audit and control and
the department of law) which are required to establish and maintain an
internal audit function. The comptroller and the attorney general or
their designees shall determine, and periodically review such
determination of, whether an internal audit function within their
respective departments is required. Establishment of such function shall
be based upon an evaluation of exposure to risk, costs and benefits of
implementation, and any other factors that are determined to be
relevant. The head of each state agency listed in the budget director's
schedule, and the comptroller and the attorney general if they or their
designees so determine, shall establish an internal audit function which
operates in accordance with generally accepted professional standards
for internal auditing. Any such internal audit function shall be
directed by an internal audit director who shall report directly to the
head of such state agency. Notwithstanding any other provision of law,
each internal audit director shall be appointed by the head of the state
agency based on appropriate internal auditing credentials of the
proposed appointee, consistent with generally accepted standards for
internal auditing, including internal auditing education and experience.
The position of internal audit director shall be an exempt position and
except in the case of the department of audit and control and department
of law, such appointment shall be subject to the approval of the
director of the budget. For agencies for which an independent audit is
not required pursuant to sections nine hundred fifty-three and nine
hundred fifty-four of this article, the internal audit function shall
evaluate the agency's internal controls and operations. The internal
audit function shall also identify internal control weaknesses that have
not been corrected and make recommendations to correct these weaknesses.

2. In the event the head of a state agency does not establish an
internal audit function pursuant to subdivision one of this section, he
or she shall nevertheless establish and maintain the program of internal
control review required by section nine hundred fifty-one of this
article.