Ohio Rev. Code Ann. § 126.47 – Annual internal audit plan

(A) The state audit committee created by section 126.46 of the Revised Code shall ensure that the office of internal audit in the office of budget and management has an annual internal audit plan that identifies the internal audits of state agencies or divisions of state agencies scheduled for the next fiscal year. The chief internal auditor of the office of internal audit shall submit the plan to the state audit committee for review and comment before the beginning of each fiscal year. The chief internal auditor may submit a revised internal audit plan for review and comment at any time the director of budget and management believes there is reason to modify the previously submitted plan for a fiscal year.
(B) To determine the state agencies or divisions of state agencies that are to be internally audited, the office of internal audit, in the formulation of an annual or revised internal audit plan, and the state audit committee, in reviewing a submitted annual or revised internal audit plan, shall consider the following factors:
1. (1) The risk for fraud, waste, or abuse of public money within an agency or division;
2. (2) The length of time since an agency or division was last subject to an internal audit;
3. (3) The size of an agency or division, and the amount of time and resources necessary to audit it;
4. (4) Any other factor the state audit committee determines to be relevant.
(C) All internal audits shall be directed by employees of the office of internal audit.
(D) After the conclusion of an internal audit, the chief internal auditor shall submit a preliminary report of the internal audit's findings and recommendations to the state audit committee and to the director of the state agency involved. The state agency or division of the state agency covered by the preliminary report shall be provided an opportunity to respond within thirty days after receipt of the preliminary report. The response shall include a corrective action plan for any recommendations in the preliminary report that are not disputed by the agency or division. Any response received by the office of internal audit within that thirty-day period shall be included in the office's final report of the internal audit's findings and recommendations. The final report shall be issued by the office of internal audit within thirty days after the termination of the thirty-day response period. Copies of the final report shall be submitted to the state audit committee, the governor, and the director of the state agency involved. The state audit committee shall determine an appropriate method for making the preliminary and final reports available for public inspection in a timely manner. Any suspected fraud or other illegal activity discovered by the office of internal audit during an internal audit shall be reported immediately to the state audit committee, the director of the state agency in which the fraud or illegal activity is suspected to have occurred, and the auditor of state.
(E) The chief internal auditor shall prepare an annual report and submit the report to the governor, the president of the senate, the speaker of the house of representatives, and the auditor of state. The office of budget and management shall make the report available to the public by posting it on the office's web site before the first of August of each year.