§ 2116-b. Internal audit function. 1. No later than July first, two thousand six, each school district shall establish an internal audit function to be in operation no later than the following December thirty-first. Such function shall include: (a) development of a risk assessment of district operations, including but not limited to, a review of financial policies and procedures and the testing and evaluation of district internal controls; (b) an annual review and update of such risk assessment; and (c) preparation of reports, at least annually or more frequently as the trustees or board of education may direct, which analyze significant risk assessment findings, recommend changes for strengthening controls and reducing identified risks, and specify timeframes for implementation of such recommendations.

2. School districts of less than eight teachers, school districts with actual general fund expenditures totaling less than five million dollars in the previous school year, or school districts with actual enrollment of less than one thousand five hundred students in the previous school year shall be exempt from this requirement. Any school district claiming such exemption shall annually certify to the commissioner that such school district meets the requirements set forth in this subdivision.

3. The commissioner, in consultation with the comptroller, is authorized to promulgate regulations with respect to the internal audit function as is necessary for the proper performance of its duties, including standards, qualifications and training for audit personnel. In developing such regulations, the commissioner shall consider the differing needs, capabilities and environments of school districts of varying sizes across the state.

4. A district shall be permitted to utilize existing district personnel to fulfill this function, but such persons shall not have any responsibility for other business operations of the district while performing such function.

5. A district shall be permitted to use (a) inter-municipal cooperative agreements, (b) shared services to the extent authorized by section nineteen hundred fifty of this title, or (c) independent contractors, to fulfill this function as long as personnel or entities performing the internal audit function comply with any regulations issued by the commissioner and meet professional auditing standards for independence between the auditor and the district.

6. Personnel or entities performing the internal audit function shall report directly to the trustees or board of education of each district. The district audit committee established under section twenty-one hundred sixteen-c of this article shall assist in the oversight of the internal audit function on behalf of the trustees or board.

7. Nothing in this section shall be construed as requiring a school district in any city with a population of one hundred twenty-five thousand or more to replace or modify an existing internal audit function where such function already exists by special or local law, so long as the superintendent of the district annually certifies to the commissioner that the existing internal audit function meets or exceeds the requirements of this section.