N.Y. EXC Law § 952

§ 952. Internal audit responsibilities. 1. The director of the\ndivision of the budget, after reviewing the evaluation of the head of\neach state agency as to the need for an internal audit function, shall\nissue and, at the director's discretion, periodically revise a schedule\nof state agencies (other than the department of audit and control and\nthe department of law) which are required to establish and maintain an\ninternal audit function. The comptroller and the attorney general or\ntheir designees shall determine, and periodically review such\ndetermination of, whether an internal audit function within their\nrespective departments is required. Establishment of such function shall\nbe based upon an evaluation of exposure to risk, costs and benefits of\nimplementation, and any other factors that are determined to be\nrelevant. The head of each state agency listed in the budget director's\nschedule, and the comptroller and the attorney general if they or their\ndesignees so determine, shall establish an internal audit function which\noperates in accordance with generally accepted professional standards\nfor internal auditing. Any such internal audit function shall be\ndirected by an internal audit director who shall report directly to the\nhead of such state agency. Notwithstanding any other provision of law,\neach internal audit director shall be appointed by the head of the state\nagency based on appropriate internal auditing credentials of the\nproposed appointee, consistent with generally accepted standards for\ninternal auditing, including internal auditing education and experience.\nThe position of internal audit director shall be an exempt position and\nexcept in the case of the department of audit and control and department\nof law, such appointment shall be subject to the approval of the\ndirector of the budget. For agencies for which an independent audit is\nnot required pursuant to sections nine hundred fifty-three and nine\nhundred fifty-four of this article, the internal audit function shall\nevaluate the agency's internal controls and operations. The internal\naudit function shall also identify internal control weaknesses that have\nnot been corrected and make recommendations to correct these weaknesses.\n 2. In the event the head of a state agency does not establish an\ninternal audit function pursuant to subdivision one of this section, he\nor she shall nevertheless establish and maintain the program of internal\ncontrol review required by section nine hundred fifty-one of this\narticle.\n