Section 952. Internal audit responsibilities

1.  The  director  of  the
  division of the budget, after reviewing the evaluation of  the  head  of
  each  state  agency as to the need for an internal audit function, shall
  issue and, at the director's discretion, periodically revise a  schedule
  of  state  agencies  (other than the department of audit and control and
  the department of law) which are required to establish and  maintain  an
  internal  audit  function.  The  comptroller and the attorney general or
  their  designees  shall  determine,   and   periodically   review   such
  determination  of,  whether  an  internal  audit  function  within their
  respective departments is required. Establishment of such function shall
  be based upon an evaluation of exposure to risk, costs and  benefits  of
  implementation,  and  any  other  factors  that  are  determined  to  be
  relevant. The head of each state agency listed in the budget  director's
  schedule,  and the comptroller and the attorney general if they or their
  designees so determine, shall establish an internal audit function which
  operates in accordance with generally  accepted  professional  standards
  for  internal  auditing.  Any  such  internal  audit  function  shall be
  directed by an internal audit director who shall report directly to  the
  head  of  such state agency. Notwithstanding any other provision of law,
  each internal audit director shall be appointed by the head of the state
  agency  based  on  appropriate  internal  auditing  credentials  of  the
  proposed  appointee,  consistent  with  generally accepted standards for
  internal auditing, including internal auditing education and experience.
  The position of internal audit director shall be an exempt position  and
  except in the case of the department of audit and control and department
  of  law,  such  appointment  shall  be  subject  to  the approval of the
  director of the budget. For agencies for which an independent  audit  is
  not  required  pursuant  to  sections  nine hundred fifty-three and nine
  hundred fifty-four of this article, the internal  audit  function  shall
  evaluate  the  agency's  internal  controls and operations. The internal
  audit function shall also identify internal control weaknesses that have
  not been corrected and make recommendations to correct these weaknesses.
    2. In the event the head of a  state  agency  does  not  establish  an
  internal  audit function pursuant to subdivision one of this section, he
  or she shall nevertheless establish and maintain the program of internal
  control review required  by  section  nine  hundred  fifty-one  of  this
  article.