Section 2932. Internal audit responsibilities

1. The governing board of
  each covered authority or its designee shall determine, and periodically
  review the determination of, whether an internal audit  function  within
  the  covered authority is required. Establishment of such function shall
  be based upon an evaluation of exposure to risk, costs and  benefits  of
  implementation,  and  any  other  factors  that  are  determined  to  be
  relevant. In the event it is determined that an internal audit  function
  is  required,  the  governing  board  of  each  covered  authority shall
  establish an internal audit function which operates in  accordance  with
  generally  accepted  professional  standards  for internal auditing. Any
  such internal audit function shall be  directed  by  an  internal  audit
  director  who  shall  report  directly  to  the  governing  board of the
  authority. Internal  audit  director  appointments  shall  be  based  on
  appropriate  internal  auditing  credentials  of the proposed appointee,
  consistent with generally  accepted  standards  for  internal  auditing,
  including internal auditing education and experience. The internal audit
  function   shall   evaluate   the   authority's  internal  controls  and
  operations, identify internal control  weaknesses  that  have  not  been
  corrected and make recommendations to correct these weaknesses.
    2.  In  the  event  the governing board does not establish an internal
  audit function pursuant to subdivision one  of  this  section  it  shall
  nevertheless  establish  and  maintain  the  program of internal control
  review required by section twenty-nine hundred thirty-one of this title.