To amend sections 124.341 and 5703.21 and to enact sections 126.45 to 126.48 of the Revised Code to create an Office of Internal Auditing within the Office of Budget and Management, to establish the State Audit Committee, and to prescribe their respective and interrelated functions.

Section 1. That sections 124.341 and 5703.21 be amended and sections 126.45, 126.46, 126.47, and 126.48 of the Revised Code be enacted to read as follows:

Sec. 124.341.  (A) If an employee in the classified or unclassified civil service becomes aware in the course of employment of a violation of state or federal statutes, rules, or regulations or the misuse of public resources, and the employee's supervisor or appointing authority has authority to correct the violation or misuse, the employee may file a written report identifying the violation or misuse with the supervisor or appointing authority. In addition to or instead of filing a written report with the supervisor or appointing authority, the employee may file a written report with the office of internal auditing created under section 126.45 of the Revised Code.

If the employee reasonably believes that a violation or misuse of public resources is a criminal offense, the employee, in addition to or instead of filing a written report with the supervisor or, appointing authority, or the office of internal auditing, may report it to a prosecuting attorney, director of law, village solicitor, or similar chief legal officer of a municipal corporation, to a peace officer, as defined in section 2935.01 of the Revised Code, or, if the violation or misuse of public resources is within the jurisdiction of the inspector general, to the inspector general in accordance with section 121.46 of the Revised Code. In addition to that report, if the employee reasonably believes the violation or misuse is also a violation of Chapter 102., section 2921.42, or section 2921.43 of the Revised Code, the employee may report it to the appropriate ethics commission.

(B) Except as otherwise provided in division (C) of this section, no officer or employee in the classified or unclassified civil service shall take any disciplinary action against an employee in the classified or unclassified civil service for making any report authorized by division (A) of this section, including, without limitation, doing any of the following:

(1) Removing or suspending the employee from employment;

(2) Withholding from the employee salary increases or employee benefits to which the employee is otherwise entitled;

(3) Transferring or reassigning the employee;

(4) Denying the employee promotion that otherwise would have been received;

(5) Reducing the employee in pay or position.

(C) An employee in the classified or unclassified civil service shall make a reasonable effort to determine the accuracy of any information reported under division (A) of this section. The employee is subject to disciplinary action, including suspension or removal, as determined by the employee's appointing authority, for purposely, knowingly, or recklessly reporting false information under division (A) of this section.

(D) If an appointing authority takes any disciplinary or retaliatory action against a classified or unclassified employee as a result of the employee's having filed a report under division (A) of this section, the employee's sole and exclusive remedy, notwithstanding any other provision of law, is to file an appeal with the state personnel board of review within thirty days after receiving actual notice of the appointing authority's action. If the employee files such an appeal, the board shall immediately notify the employee's appointing authority and shall hear the appeal. The board may affirm or disaffirm the action of the appointing authority or may issue any other order as is appropriate. The order of the board is appealable in accordance with Chapter 119. of the Revised Code.

(E) As used in this section:

(1) "Purposely," "knowingly," and "recklessly" have the same meanings as in section 2901.22 of the Revised Code.

(2) "Appropriate ethics commission" has the same meaning as in section 102.01 of the Revised Code.

(3) "Inspector general" means the inspector general appointed under section 121.48 of the Revised Code.

Sec. 126.45.  (A) As used in sections 126.45 to 126.48 of the Revised Code, "state agency" means the administrative departments listed in section 121.02 of the Revised Code, the department of taxation, and the bureau of workers' compensation.

(B) The office of internal auditing is hereby created in the office of budget and management to conduct internal audits of state agencies or divisions of state agencies to improve their operations in the areas of risk management, internal controls, and governance. The director of budget and management, with the approval of the governor, shall appoint for the office of internal auditing a chief internal auditor who meets the qualifications specified in division (C) of this section. The chief internal auditor shall serve at the director's pleasure and be responsible for the administration of the office of internal auditing consistent with sections 126.45 to 126.48 of the Revised Code.

The office of internal auditing shall conduct programs for the internal auditing of state agencies. The programs shall include an annual internal audit plan, reviewed by the state audit committee, that utilizes risk assessment techniques and identifies the specific audits to be conducted during the year. The programs also shall include periodic audits of each state agency's major systems and controls, including those systems and controls pertaining to accounting, administration, and electronic data processing. Upon the request of the office of internal auditing, each state agency shall provide office employees access to all records and documents necessary for the performance of an internal audit.

The director of budget and management shall assess a charge against each state agency for which the office of internal auditing conducts internal auditing programs under sections 126.45 to 126.48 of the Revised Code so that the total amount of these charges is sufficient to cover the costs of the operation of the office of internal auditing.

(C) The chief internal auditor of the office of internal auditing shall hold at least a bachelor's degree and be one of the following:

(1) A certified internal auditor, a certified government auditing professional, or a certified public accountant, who also has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least six years of auditing experience;

(2) An auditor who has held a PA registration or a CPA certificate authorized by Chapter 4701. of the Revised Code for at least four years and has at least ten years of auditing experience.

(D) The chief internal auditor, subject to the direction and control of the director of budget and management, may appoint and maintain any staff necessary to carry out the duties assigned by sections 126.45 to 126.48 of the Revised Code to the office of internal auditing or to the chief internal auditor.

Sec. 126.46.  (A)(1) There is hereby created the state audit committee, consisting of the following five members: one public member appointed by the governor; two public members appointed by the speaker of the house of representatives, one of which may be a person who is recommended by the minority leader of the house of representatives; and two public members appointed by the president of the senate, one of which may be a person who is recommended by the minority leader of the senate. Not more than two of the four members appointed by the speaker of the house of representatives and the president of the senate shall belong to or be affiliated with the same political party. The member appointed by the governor shall be a person who is external to the management structure associated with the preparation of financial statements of state government and shall have the program and management expertise required to perform the duties of the committee's chairperson.

Each member of the committee shall serve a three-year term, except for the initial members. With respect to the initial appointments of the members, the first member appointed by the speaker of the house of representatives shall serve a one-year term, the second member appointed by the speaker of the house of representatives shall serve a three-year term, the initial members appointed by the president of the senate shall serve two-year terms, and the initial member appointed by the governor shall serve a three-year term. Members may be reappointed to serve one additional term.

The committee shall include one member who is a financial expert; one member who is an active, inactive, or retired certified public accountant; one member who is familiar with governmental financial accounting; and one member who is a representative of the public.

Any vacancy on the committee shall be filled in the same manner as provided in this division, and, when applicable, the person appointed to fill a vacancy shall serve the remainder of the predecessor's term.

(2) Members of the committee shall receive reimbursement for actual and necessary expenses incurred in the discharge of their duties.

(3) The member of the committee appointed by the governor shall serve as the committee's chairperson.

(4) Initial appointments of committee members shall be made not later than thirty days after the effective date of this section.

(5) Members of the committee shall be subject to the disclosure statement requirements of section 102.02 of the Revised Code.

(B) The state audit committee shall do all of the following:

(1) Ensure that the internal audits conducted by the office of internal auditing in the office of budget and management conform to the institute of internal auditors' international standards for the professional practice of internal auditing and to the institute of internal auditors' code of ethics;

(2) Review and comment on the process used by the office of budget and management to prepare its annual budgetary financial report and the state's comprehensive annual financial report required under division (A)(9) of section 126.21 of the Revised Code;

(3) Review and comment on unaudited financial statements submitted to the auditor of state and communicate with external auditors as required by government auditing standards;

(4) Perform the additional functions imposed upon it by section 126.47 of the Revised Code.

(C) As used in this section, "financial expert" means a person who has all of the following:

(1) An understanding of generally accepted accounting principles and financial statements;

(2) The ability to assess the general application of those principles in connection with accounting for estimates, accruals, and reserves;

(3) Experience preparing, auditing, analyzing, or evaluating financial statements presenting accounting issues that generally are of comparable breadth and level of complexity to those likely to be presented by a state agency's financial statements, or experience actively supervising one or more persons engaged in those activities;

(4) An understanding of internal controls and procedures for financial reporting; and

(5) An understanding of audit committee functions.

Sec. 126.47.  (A) The state audit committee created by section 126.46 of the Revised Code shall ensure that the office of internal auditing in the office of budget and management has an annual internal audit plan that identifies the internal audits of state agencies or divisions of state agencies scheduled for the next fiscal year. The chief internal auditor of the office of internal auditing shall submit the plan to the state audit committee for review and comment before the beginning of each fiscal year. The chief internal auditor may submit a revised internal audit plan for review and comment at any time the director of budget and management believes there is reason to modify the previously submitted plan for a fiscal year.

(B) To determine the state agencies or divisions of state agencies that are to be internally audited, the office of internal auditing, in the formulation of an annual or revised internal audit plan, and the state audit committee, in reviewing a submitted annual or revised internal audit plan, shall consider the following factors:

(1) The risk for fraud, waste, or abuse of public money within an agency or division;

(2) The length of time since an agency or division was last subject to an internal audit;

(3) The size of an agency or division, and the amount of time and resources necessary to audit it;

(4) Any other factor the state audit committee determines to be relevant.

(C) All internal audits shall be conducted only by employees of the office of internal auditing.

(D) After the conclusion of an internal audit, the chief internal auditor shall submit a preliminary report of the internal audit's findings and recommendations to the state audit committee and to the director of the state agency involved. The state agency or division of the state agency covered by the preliminary report shall be provided an opportunity to respond within thirty days after receipt of the preliminary report. The response shall include a corrective action plan for any recommendations in the preliminary report that are not disputed by the agency or division. Any response received by the office of internal auditing within that thirty-day period shall be included in the office's final report of the internal audit's findings and recommendations. The final report shall be issued by the office of internal auditing within thirty days after the termination of the thirty-day response period. Copies of the final report shall be submitted to the state audit committee, the governor, and the director of the state agency involved. The state audit committee shall determine an appropriate method for making the preliminary and final reports available for public inspection in a timely manner.

Any suspected fraud or other illegal activity discovered by the office of internal auditing during the conduct of an internal audit shall be reported immediately to the state audit committee, the director of the state agency in which the fraud or illegal activity is suspected to have occurred, and the auditor of state.

(E) The chief internal auditor shall prepare an annual report and submit the report to the governor, the president of the senate, the speaker of the house of representatives, and the auditor of state. The office of budget and management shall make the report available to the public by posting it on the office's web site before the first of July of each year.

Sec. 126.48.  Any preliminary or final report of an internal audit's findings and recommendations which is produced by the office of internal auditing in the office of budget and management and all work papers of the internal audit are confidential and are not public records under section 149.43 of the Revised Code until the final report of an internal audit's findings and recommendations is submitted to the state audit committee, the governor, and the director of the state agency involved.

Sec. 5703.21.  (A) Except as provided in divisions (B) and (C) of this section, no agent of the department of taxation, except in the agent's report to the department or when called on to testify in any court or proceeding, shall divulge any information acquired by the agent as to the transactions, property, or business of any person while acting or claiming to act under orders of the department. Whoever violates this provision shall thereafter be disqualified from acting as an officer or employee or in any other capacity under appointment or employment of the department.

(B)(1) For purposes of an audit pursuant to section 117.15 of the Revised Code, or an audit of the department pursuant to Chapter 117. of the Revised Code, or an audit, pursuant to that chapter, the objective of which is to express an opinion on a financial report or statement prepared or issued pursuant to division (A)(7) or (9) of section 126.21 of the Revised Code, the officers and employees of the auditor of state charged with conducting the audit shall have access to and the right to examine any state tax returns and state tax return information in the possession of the department to the extent that the access and examination are necessary for purposes of the audit. Any information acquired as the result of that access and examination shall not be divulged for any purpose other than as required for the audit or unless the officers and employees are required to testify in a court or proceeding under compulsion of legal process. Whoever violates this provision shall thereafter be disqualified from acting as an officer or employee or in any other capacity under appointment or employment of the auditor of state.

(2) For purposes of an internal audit pursuant to section 126.45 of the Revised Code, the officers and employees of the office of internal auditing in the office of budget and management charged with conducting the internal audit shall have access to and the right to examine any state tax returns and state tax return information in the possession of the department to the extent that the access and examination are necessary for purposes of the internal audit. Any information acquired as the result of that access and examination shall not be divulged for any purpose other than as required for the internal audit or unless the officers and employees are required to testify in a court or proceeding under compulsion of legal process. Whoever violates this provision shall thereafter be disqualified from acting as an officer or employee or in any other capacity under appointment or employment of the office of internal auditing.

(3) As provided by section 6103(d)(2) of the Internal Revenue Code, any federal tax returns or federal tax information that the department has acquired from the internal revenue service, through federal and state statutory authority, may be disclosed to the auditor of state or the office of internal auditing solely for purposes of an audit of the department.

(C) Division (A) of this section does not prohibit any of the following:

(1) Divulging information contained in applications, complaints, and related documents filed with the department under section 5715.27 of the Revised Code or in applications filed with the department under section 5715.39 of the Revised Code;

(2) Providing information to the office of child support within the department of job and family services pursuant to section 3125.43 of the Revised Code;

(3) Disclosing to the board of motor vehicle collision repair registration any information in the possession of the department that is necessary for the board to verify the existence of an applicant's valid vendor's license and current state tax identification number under section 4775.07 of the Revised Code;

(4) Providing information to the administrator of workers' compensation pursuant to sections 4123.271 and 4123.591 of the Revised Code;

(5) Providing to the attorney general information the department obtains under division (J) of section 1346.01 of the Revised Code;

(6) Permitting properly authorized officers, employees, or agents of a municipal corporation from inspecting reports or information pursuant to rules adopted under section 5745.16 of the Revised Code;

(7) Providing information regarding the name, account number, or business address of a holder of a vendor's license issued pursuant to section 5739.17 of the Revised Code, a holder of a direct payment permit issued pursuant to section 5739.031 of the Revised Code, or a seller having a use tax account maintained pursuant to section 5741.17 of the Revised Code, or information regarding the active or inactive status of a vendor's license, direct payment permit, or seller's use tax account;

(8) Releasing invoices or invoice information furnished under section 4301.433 of the Revised Code pursuant to that section;

(9) Providing to a county auditor notices or documents concerning or affecting the taxable value of property in the county auditor's county. Unless authorized by law to disclose documents so provided, the county auditor shall not disclose such documents;

(10) Providing to a county auditor sales or use tax return or audit information under section 333.06 of the Revised Code.

Section 2. That existing sections 124.341 and 5703.21 of the Revised Code are hereby repealed.

Section 3.  (A) It is the intent of the General Assembly in the enactment of section 126.45 of the Revised Code that the primary internal audit function of state agencies as defined in that section will be carried out by the Office of Internal Auditing of the Office of Budget and Management.

(B) Before May 1, 2008, the Director of Budget and Management, in consultation with the Director of Administrative Services and the State Audit Committee created in section 126.46 of the Revised Code, shall develop a plan to commence operations of the Office of Internal Auditing. The plan shall do all of the following:

(1) Identify those existing employees within state agencies as defined in section 126.45 of the Revised Code who perform the function of an internal auditor and who will be transferred to the Office of Internal Auditing;

(2) Establish funds and appropriation authority that is necessary for the efficient and effective operation of the Office of Internal Auditing;

(3) Provide for a method to assess charges against the various state agencies for which the Office of Internal Auditing conducts internal auditing programs under sections 126.45 to 126.48 of the Revised Code so that the total amount of these charges is sufficient to cover the costs of the operation of the Office of Internal Auditing;

(4) Provide for the appropriate reduction in the appropriation authority of the state agencies from which existing employees who perform the function of internal auditor are transferred.

(C) The Controlling Board shall approve the plan before the Office of Budget and Management implements it.

(D) Subject to the layoff and displacement provisions of Chapter 124. of the Revised Code, all state agency employees who are identified by the plan as performing duties necessary to comply with sections 126.45 to 126.48 of the Revised Code shall be transferred, upon the approval of the Controlling Board, to the Office of Internal Auditing and shall retain their positions, compensation, and associated fringe benefits.

Section 4.  Section 5703.21 of the Revised Code is presented in this act as a composite of the section as amended by both Am. Sub. H.B. 530 and Am. Sub. S.B. 7 of the 126th General Assembly. The General Assembly, applying the principle stated in division (B) of section 1.52 of the Revised Code that amendments are to be harmonized if reasonably capable of simultaneous operation, finds that the composite is the resulting version of the section in effect prior to the effective date of the section as presented in this act.