N.Y. PBA Law § 2932

§ 2932. Internal audit responsibilities. 1. The governing board of\neach covered authority or its designee shall determine, and periodically\nreview the determination of, whether an internal audit function within\nthe covered authority is required. Establishment of such function shall\nbe based upon an evaluation of exposure to risk, costs and benefits of\nimplementation, and any other factors that are determined to be\nrelevant. In the event it is determined that an internal audit function\nis required, the governing board of each covered authority shall\nestablish an internal audit function which operates in accordance with\ngenerally accepted professional standards for internal auditing. Any\nsuch internal audit function shall be directed by an internal audit\ndirector who shall report directly to the governing board of the\nauthority. Internal audit director appointments shall be based on\nappropriate internal auditing credentials of the proposed appointee,\nconsistent with generally accepted standards for internal auditing,\nincluding internal auditing education and experience. The internal audit\nfunction shall evaluate the authority's internal controls and\noperations, identify internal control weaknesses that have not been\ncorrected and make recommendations to correct these weaknesses.\n 2. In the event the governing board does not establish an internal\naudit function pursuant to subdivision one of this section it shall\nnevertheless establish and maintain the program of internal control\nreview required by section twenty-nine hundred thirty-one of this title.\n