(1) The agency internal audit director may:

1. (a) furnish independent analyses, appraisals, and recommendations that may, depending upon the audit scope, identify:

   1. (i) the adequacy of the state agency's systems of internal control;
   2. (ii) the efficiency and effectiveness of agency management in carrying out assigned responsibilities; and
   3. (iii) the agency's compliance with applicable laws, rules, and regulations;
2. (b) submit audit reports directly to the agency head and to the audit committee, if one has been established;

3. (c) conduct internal audits of state agency programs, activities, and functions that may consist of one or more of the following objectives:

   1. (i) to verify the accuracy and reliability of agency records;
   2. (ii) to assess compliance with management policies, plans, procedures, and regulations;
   3. (iii) to assess compliance with applicable laws, rules, and regulations;
   4. (iv) to evaluate the efficient and effective use of agency resources; and
   5. (v) to verify the appropriate protection of agency assets;
4. (d) prepare audit reports of findings;
5. (e) review and evaluate internal controls over the state agency's accounting systems, administrative systems, electronic data processing systems, and all other major systems necessary to ensure the fiscal and administrative accountability of the state agency;
6. (f) develop audit plans containing the information required by Subsection (2) to be based on the findings of periodic risk assessments;
7. (g) upon request, make a copy of the approved audit plan available to the state auditor, legislative auditor, or other appropriate external auditor to assist in planning and coordination of any external financial, compliance, electronic data processing, or performance audit;
8. (h) determine the scope and assignment of the audits;
9. (i) perform an audit of a special program, activity, function, or organizational unit at the direction of the agency head;
10. (j) maintain the classification of any public records consistent with Title 63G, Chapter 2, Government Records Access and Management Act;
11. (k) be subject to the same penalties as the custodian of those public records for violating Title 63G, Chapter 2, Government Records Access and Management Act; and
12. (l) identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts of interest.

(2)

1. (a) The audit plan required by this section shall:

   1. (i) identify the individual audits to be conducted during each year;
   2. (ii) identify the related resources to be devoted to each of the respective audits;
   3. (iii) ensure that internal controls are reviewed periodically as determined by the agency head or the audit committee, if one has been established; and
   4. (iv) ensure that audits that evaluate the efficient and effective use of agency resources are adequately represented in the plan.
2. (b) The agency internal audit director shall submit the audit plan to the agency head and the audit committee, if one has been established, for approval.

(3) The agency internal audit director shall ensure that:

1. (a) audits are conducted in accordance with professional auditing standards such as those published by the Institute of Internal Auditors, Inc., the American Institute of Certified Public Accountants and, when required by other law, regulation, agreement, contract, or policy, in accordance with Government Auditing Standards, issued by the Comptroller General of the United States;
2. (b) all reports of audit findings issued by internal audit staff shall include a statement that the audit was conducted according to the appropriate standards;
3. (c) public release of reports of audit findings comply with the conditions specified by the state laws and rules governing the state agency;
4. (d) copies of all reports of audit findings issued by the internal audit staff are available to the Offices of the Legislative Auditor General and the State Auditor upon request; and
5. (e) significant audit matters that cannot be appropriately addressed by the agency internal audit office are referred to either the Office of Legislative Auditor General or the Office of the State Auditor.