To amend section 124.341 and to enact sections 126.40 to 126.43 of the Revised Code to create an Office of Internal Auditing within the Office of Budget and Management, to establish the State Audit Committee, and to prescribe their respective and interrelated functions.

Section 1. That section 124.341 be amended and sections 126.40, 126.41, 126.42, and 126.43 of the Revised Code be enacted to read as follows:

Sec. 124.341.  (A) If an employee in the classified or unclassified civil service becomes aware in the course of employment of a violation of state or federal statutes, rules, or regulations or the misuse of public resources, and the employee's supervisor or appointing authority has authority to correct the violation or misuse, the employee may file a written report identifying the violation or misuse with the supervisor or appointing authority. In addition to or instead of filing a written report with the supervisor or appointing authority, the employee may file a written report with the office of internal auditing created under section 126.40 of the Revised Code.

If the employee reasonably believes that a violation or misuse of public resources is a criminal offense, the employee, in addition to or instead of filing a written report with the supervisor or appointing authority, may report it to a prosecuting attorney, director of law, village solicitor, or similar chief legal officer of a municipal corporation, to a peace officer, as defined in section 2935.01 of the Revised Code, or, if the violation or misuse of public resources is within the jurisdiction of the inspector general, to the inspector general in accordance with section 121.46 of the Revised Code. In addition to that report, if the employee reasonably believes the violation or misuse is also a violation of Chapter 102., section 2921.42, or section 2921.43 of the Revised Code, the employee may report it to the appropriate ethics commission.

(B) Except as otherwise provided in division (C) of this section, no officer or employee in the classified or unclassified civil service shall take any disciplinary action against an employee in the classified or unclassified civil service for making any report authorized by division (A) of this section, including, without limitation, doing any of the following:

(1) Removing or suspending the employee from employment;

(2) Withholding from the employee salary increases or employee benefits to which the employee is otherwise entitled;

(3) Transferring or reassigning the employee;

(4) Denying the employee promotion that otherwise would have been received;

(5) Reducing the employee in pay or position.

(C) An employee in the classified or unclassified civil service shall make a reasonable effort to determine the accuracy of any information reported under division (A) of this section. The employee is subject to disciplinary action, including suspension or removal, as determined by the employee's appointing authority, for purposely, knowingly, or recklessly reporting false information under division (A) of this section.

(D) If an appointing authority takes any disciplinary or retaliatory action against a classified or unclassified employee as a result of the employee's having filed a report under division (A) of this section, the employee's sole and exclusive remedy, notwithstanding any other provision of law, is to file an appeal with the state personnel board of review within thirty days after receiving actual notice of the appointing authority's action. If the employee files such an appeal, the board shall immediately notify the employee's appointing authority and shall hear the appeal. The board may affirm or disaffirm the action of the appointing authority or may issue any other order as is appropriate. The order of the board is appealable in accordance with Chapter 119. of the Revised Code.

(E) As used in this section:

(1) "Purposely," "knowingly," and "recklessly" have the same meanings as in section 2901.22 of the Revised Code.

(2) "Appropriate ethics commission" has the same meaning as in section 102.01 of the Revised Code.

(3) "Inspector general" means the inspector general appointed under section 121.48 of the Revised Code.

Sec. 126.40.  (A) As used in sections 126.40 to 126.43 of the Revised Code, "state agency" means the administrative departments listed in section 121.02 of the Revised Code, the department of taxation, and the bureau of workers' compensation.

(B) The office of internal auditing is hereby created in the office of budget and management to conduct internal audits of state agencies or divisions of state agencies to improve their operations in the areas of risk management, internal controls, and governance. The director of budget and management, with the approval of the governor, shall appoint for the office of internal auditing a chief internal auditor who meets the qualifications specified in division (C) of this section. The chief internal auditor shall serve at the director's pleasure and be responsible for the administration of the office of internal auditing consistent with sections 126.40 to 126.43 of the Revised Code.

The office of internal auditing shall conduct programs for the internal auditing of state agencies. The programs shall include an annual internal audit plan, approved by the state audit committee, that utilizes risk assessment techniques and identifies the specific audits to be conducted during the year. The programs also shall include periodic audits of each state agency's major systems and controls, including those systems and controls pertaining to accounting, administration, and electronic data processing. Upon the request of the office of internal auditing, each state agency shall provide office employees access to all records and documents necessary for the performance of an internal audit.

The director of budget and management shall assess a charge against each state agency for which the office of internal auditing conducts internal auditing programs under sections 126.40 to 126.43 of the Revised Code so that the total amount of these charges is sufficient to cover the costs of the operation of the office of internal auditing.

(C) The chief internal auditor of the office of internal auditing shall hold at least a bachelor's degree and be one of the following:

(1) A certified internal auditor, a certified government auditing professional, or a certified public accountant, who also has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least six years of auditing experience;

(2) An auditor who has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least ten years of auditing experience.

(D) The chief internal auditor, subject to the direction and control of the director of budget and management, may appoint and maintain any staff necessary to carry out the duties assigned by sections 126.40 to 126.43 of the Revised Code to the office of internal auditing or to the chief internal auditor.

Sec. 126.41.  (A)(1) There is hereby created the state audit committee, consisting of the following five members: one member appointed by the governor; two public members appointed by the speaker of the house of representatives; and two public members appointed by the president of the senate. Not more than two of the four public members appointed by the speaker of the house of representatives and the president of the senate shall belong to or be affiliated with the same political party. The member appointed by the governor shall be a person who is external to the management structure associated with the preparation of financial statements of state government and shall have the program and management expertise required to perform the duties of the committee's chairperson.

Each public member of the committee shall serve a three-year term commencing on the first day of August in the appropriate year and ending on the thirty-first day of July in the appropriate year, except for the initial public members. With respect to the initial appointments of the public members, the term of the first public member appointed by the speaker of the house of representatives shall be for a one-year term, the term of the second public member appointed by the speaker of the house of representatives shall be for a three-year term, and the term of the initial public members appointed by the president of the senate shall be for two-year terms. The term for the initial public members shall begin on August 1, 2007. Public members may be reappointed to serve one additional term.

The committee shall include one public member who is a financial expert; one public member who is an active, inactive, or retired certified public accountant; one public member who is familiar with governmental financial accounting; and one public member who is a representative of the public.

Any vacancy on the committee shall be filled in the same manner as provided in this division, and, when applicable, the person appointed to fill a vacancy shall serve the remainder of the predecessor's term.

(2) Members of the committee shall receive reimbursement for actual and necessary expenses incurred in the discharge of their duties.

(3) The member of the committee appointed by the governor shall serve as the committee's chairperson.

(B) The state audit committee shall do all of the following:

(1) Ensure that the internal audits conducted by the office of internal auditing in the office of budget and management conform to the institute of internal auditors' international standards for the professional practice of internal auditing and to the institute of internal auditors' code of ethics;

(2) Review the process used by the office of budget and management to prepare its annual budgetary financial report and the state's comprehensive annual financial report required under division (A)(9) of section 126.21 of the Revised Code;

(3) Review unaudited financial statements submitted to the auditor of state and communicate with external auditors as required by government auditing standards;

(4) Perform the additional functions imposed upon it by section 126.42 of the Revised Code.

(C) As used in this section, "financial expert" means a person who has all of the following:

(1) An understanding of generally accepted accounting principles and financial statements;

(2) The ability to assess the general application of those principles in connection with accounting for estimates, accruals, and reserves;

(3) Experience preparing, auditing, analyzing, or evaluating financial statements presenting accounting issues that generally are of comparable breadth and level of complexity to those likely to be presented by a state agency's financial statements, or experience actively supervising one or more persons engaged in those activities;

(4) An understanding of internal controls and procedures for financial reporting; and

(5) An understanding of audit committee functions.

Sec. 126.42.  (A) The state audit committee created by section 126.41 of the Revised Code shall ensure that the office of internal auditing in the office of budget and management has an annual internal audit plan that identifies the internal audits of state agencies or divisions of state agencies scheduled for the next fiscal year. The chief internal auditor of the office of internal auditing shall submit the plan to the state audit committee for approval before the beginning of each fiscal year. The chief internal auditor may submit a revised internal audit plan for approval at any time the director of budget and management believes there is reason to modify the previously submitted plan for a fiscal year.

(B) To determine the state agencies or divisions of state agencies that are to be internally audited, the office of internal auditing, in the formulation of an annual or revised internal audit plan, and the state audit committee, in approving a submitted annual or revised internal audit plan, shall consider the following factors:

(1) The risk for fraud, waste, or abuse of public money within an agency or division;

(2) The length of time since an agency or division was last subject to an internal audit;

(3) The size of an agency or division, and the amount of time and resources necessary to audit it;

(4) Any other factor the state audit committee determines to be relevant.

(C) All internal audits shall be conducted only by employees of the office of internal auditing.

(D) After the conclusion of an internal audit, the chief internal auditor shall submit a preliminary report of the internal audit's findings and recommendations to the state audit committee and to the director of the state agency involved. The state agency or division of the state agency covered by the preliminary report shall be provided an opportunity to respond within thirty days after receipt of the preliminary report. The response shall include a corrective action plan for any recommendations in the preliminary report that are not disputed by the agency or division. Any response received by the office of internal auditing within that thirty-day period shall be included in the office's final report of the internal audit's findings and recommendations. The final report shall be issued by the office of internal auditing within thirty days after the termination of the thirty-day response period. Copies of the final report shall be submitted to the state audit committee, the governor, and the director of the state agency involved. The state audit committee shall determine an appropriate method for making the preliminary and final reports available for public inspection in a timely manner.

Any suspected fraud or other illegal activity discovered by the office of internal auditing during the conduct of an internal audit shall be reported immediately to the state audit committee, the director of the state agency in which the fraud or illegal activity is suspected to have occurred, and the auditor of state.

(E) The chief internal auditor shall prepare an annual report and submit the report to the governor, the president of the senate, the speaker of the house of representatives, and the auditor of state. The office of budget and management shall make the report available to the public by posting it on the office's web site before the first of July of each year.

Sec. 126.43.  Any preliminary or final report of an internal audit's findings and recommendations which is produced by the office of internal auditing in the office of budget and management and all work papers of the internal audit are confidential and are not public records under section 149.43 of the Revised Code until the final report of an internal audit's findings and recommendations is submitted to the state audit committee, the governor, and the director of the state agency involved.

Section 2. That existing section 124.341 of the Revised Code is hereby repealed.

Section 3.  (A) It is the intent of the General Assembly in the enactment of section 126.40 of the Revised Code that the primary internal audit function of state agencies as defined in that section will be carried out by the Office of Internal Auditing of the Office of Budget and Management.

(B) Before May 1, 2008, the Director of Budget and Management, in consultation with the Director of Administrative Services and the State Audit Committee created in section 126.41 of the Revised Code, shall develop a plan to commence operations of the Office of Internal Auditing. The plan shall do all of the following:

(1) Identify those existing employees within state agencies as defined in section 126.40 of the Revised Code who perform the function of an internal auditor and who will be transferred to the Office of Internal Auditing;

(2) Establish funds and appropriation authority that is necessary for the efficient and effective operation of the Office of Internal Auditing;

(3) Provide for a method to assess charges against the various state agencies for which the Office of Internal Auditing conducts internal auditing programs under sections 126.40 to 126.43 of the Revised Code that the total amount of these charges is sufficient to cover the costs of the operation of the Office of Internal Auditing;

(4) Provide for the appropriate reduction in the appropriation authority of the state agencies from which existing employees who perform the function of internal auditor are transferred.

(C) The Controlling Board shall approve the plan before the Office of Budget and Management implements it.

(D) Subject to the layoff and displacement provisions of Chapter 124. of the Revised Code, all state agency employees who are identified by the plan as performing duties necessary to comply with sections 126.40 to 126.43 of the Revised Code shall be transferred, upon the approval of the Controlling Board, to the Office of Internal Auditing and shall retain their positions, compensation, and associated fringe benefits.