To enact sections 126.40 to 126.43 of the Revised Code to create an Office of Internal Auditing within the Office of Budget and Management, to establish the State Audit Committee, and to prescribe their respective and interrelated functions.

Section 1. That sections 126.40, 126.41, 126.42, and 126.43 of the Revised Code be enacted to read as follows:

Sec. 126.40.  (A) As used in sections 126.40 to 126.43 of the Revised Code, "state agency" means the administrative departments listed in section 121.02 of the Revised Code, the department of taxation, and the bureau of workers' compensation.

(B) The office of internal auditing is hereby created in the office of budget and management to conduct internal audits of state agencies or divisions of state agencies to improve their operations in the areas of risk management, internal controls, and governance. The director of budget and management, with the approval of the governor and approval by a majority vote of the senate, shall appoint for the office of internal auditing a chief internal auditor who meets the qualifications specified in division (C) of this section. The chief internal auditor shall serve at the director's pleasure and be responsible for the administration of the office of internal auditing consistent with sections 126.40 to 126.43 of the Revised Code.

The office of internal auditing shall conduct programs for the internal auditing of state agencies. The programs shall include an annual internal audit plan, approved by the state audit committee, that utilizes risk assessment techniques and identifies the specific audits to be conducted during the year. The programs also shall include periodic audits of each state agency's major systems and controls, including those systems and controls pertaining to accounting, administration, and electronic data processing. Upon the request of the office of internal auditing, each state agency shall provide office employees access to all records and documents necessary for the performance of an internal audit.

(C) The chief internal auditor of the office of internal auditing shall hold at least a bachelor's degree and be one of the following:

(1) A certified internal auditor, a certified government auditing professional, or a certified public accountant, who also has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least six years of auditing experience;

(2) An auditor who has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least ten years of auditing experience.

(D) The chief internal auditor, subject to the direction and control of the director of budget and management, may appoint and maintain any staff necessary to carry out the duties assigned by sections 126.40 to 126.43 of the Revised Code to the office of internal auditing or to the chief internal auditor.

Sec. 126.41.  (A)(1) There is hereby created the state audit committee, consisting of the following five members: the director of budget and management; two public members appointed by the speaker of the house of representatives; and two public members appointed by the president of the senate.

Each public member of the committee shall serve a three-year term commencing on the first day of August in the appropriate year and ending on the thirty-first day of July in the appropriate year, except for the initial public members. With respect to the initial appointments of the public members, the term of the first public member appointed by the speaker of the house of representatives shall be for a one-year term, the term of the second public member appointed by the speaker of the house of representatives shall be for a three-year term, and the term of the initial public members appointed by the president of the senate shall be for two-year terms. The term for the initial public members shall begin on August 1, 2007. Public members may be reappointed to serve one additional term.

The committee shall include one public member who is a financial expert; one public member who is an active, inactive, or retired certified public accountant; one public member who is familiar with governmental financial accounting; and one public member who is a representative of the public.

Any vacancy on the committee shall be filled in the same manner as provided in this division, and, when applicable, the person appointed to fill a vacancy shall serve the remainder of the predecessor's term.

(2) Members of the committee shall receive reimbursement for actual and necessary expenses incurred in the discharge of their duties.

(3) The director of budget and management shall serve as the committee's chairperson.

(B) The state audit committee shall do all of the following:

(1) Ensure that the internal audits conducted by the office of internal auditing in the office of budget and management conform to the institute of internal auditors' international standards for the professional practice of internal auditing and to the institute of internal auditors' code of ethics;

(2) Review the process used by the office of budget and management to prepare its annual budgetary financial report and the state's comprehensive annual financial report required under division (A)(9) of section 126.21 of the Revised Code;

(3) Review unaudited financial statements submitted to the auditor of state and communicate with external auditors as required by government auditing standards;

(4) Perform the additional functions imposed upon it by section 126.42 of the Revised Code.

(C) As used in this section, "financial expert" means a person who has all of the following:

(1) An understanding of generally accepted accounting principles and financial statements;

(2) The ability to assess the general application of those principles in connection with accounting for estimates, accruals, and reserves;

(3) Experience preparing, auditing, analyzing, or evaluating financial statements presenting accounting issues that generally are of comparable breadth and level of complexity to those likely to be presented by a state agency's financial statements, or experience actively supervising one or more persons engaged in those activities;

(4) An understanding of internal controls and procedures for financial reporting; and

(5) An understanding of audit committee functions.

Sec. 126.42.  (A) The state audit committee created by section 126.41 of the Revised Code shall ensure that the office of internal auditing in the office of budget and management has an annual internal audit plan that identifies the internal audits of state agencies or divisions of state agencies scheduled for the next fiscal year. The chief internal auditor of the office of internal auditing shall submit the plan to the state audit committee for approval before the beginning of each fiscal year. The chief internal auditor may submit a revised internal audit plan for approval at any time the director of budget and management believes there is reason to modify the previously submitted plan for a fiscal year.

(B) To determine the state agencies or divisions of state agencies that are to be internally audited, the office of internal auditing, in the formulation of an annual or revised internal audit plan, and the state audit committee, in approving a submitted annual or revised internal audit plan, shall consider the following factors:

(1) The risk for fraud, waste, or abuse of public money within an agency or division;

(2) The length of time since an agency or division was last subject to an internal audit;

(3) The size of an agency or division, and the amount of time and resources necessary to audit it;

(4) Any other factor the state audit committee determines to be relevant.

(C) All internal audits shall be conducted only by employees of the office of internal auditing.

(D) After the conclusion of an internal audit, the chief internal auditor shall submit a preliminary report of the internal audit's findings and recommendations to the state audit committee and to the director of the state agency involved. The state agency or division of the state agency covered by the preliminary report shall be provided an opportunity to respond within thirty days after receipt of the preliminary report. The response shall include a corrective action plan for any recommendations in the preliminary report that are not disputed by the agency or division. Any response received by the office of internal auditing within that thirty-day period shall be included in the office's final report of the internal audit's findings and recommendations. The final report shall be issued by the office of internal auditing within thirty days after the termination of the thirty-day response period. Copies of the final report shall be submitted to the state audit committee, the governor, and the director of the state agency involved. The state audit committee shall determine an appropriate method for making the preliminary and final reports available for public inspection in a timely manner.

Any suspected fraud or other illegal activity discovered by the office of internal auditing during the conduct of an internal audit shall be reported immediately to the state audit committee, the director of the state agency in which the fraud or illegal activity is suspected to have occurred, and the auditor of state.

(E) The chief internal auditor shall prepare an annual report and submit the report to the governor, the president of the senate, the speaker of the house of representatives, and the auditor of state. The office of budget and management shall make the report available to the public by posting it on the office's web site before the first of July of each year.

Sec. 126.43.  Any preliminary or final report of an internal audit's findings and recommendations which is produced by the office of internal auditing in the office of budget and management and all work papers of the internal audit are confidential and are not public records under section 149.43 of the Revised Code until the final report of an internal audit's findings and recommendations is submitted to the state audit committee, the governor, and the director of the state agency involved.

Section 2.  (A) Not later than six months after the effective date of this act, the Legislative Service Commission shall prepare a report on the existing internal audit structures of each state agency, as defined in section 126.40 of the Revised Code, and identify all state employees who are classified as an internal auditor or with job duties effectively similar to those of an internal auditor. The report shall include information about the total amounts budgeted for internal auditing purposes in each such state agency.

Each such state agency, upon request, shall provide the Legislative Service Commission with the requisite information to complete the portion of the report pertaining to that state agency.

The report shall be submitted to the Governor, the Speaker of the House of Representatives, the President of the Senate, and the Minority Leaders of the Senate and the House of Representatives upon its completion.

(B) Subject to the layoff and displacement provisions of Chapter 124. of the Revised Code, all state agency employees who are classified as internal auditors or whose job duties are effectively similar to those of an internal auditor, as determined by the report described in division (A) of this section, shall be transferred to the Office of Internal Auditing in the Office of Budget and Management on the effective date of this section, and shall retain their positions, compensation, and all associated fringe benefits.