§ 952. Internal audit responsibilities. 1. The director of the division of the budget, after reviewing the evaluation of the head of each state agency as to the need for an internal audit function, shall issue and, at the director's discretion, periodically revise a schedule of state agencies (other than the department of audit and control and the department of law) which are required to establish and maintain an internal audit function. The comptroller and the attorney general or their designees shall determine, and periodically review such determination of, whether an internal audit function within their respective departments is required. Establishment of such function shall be based upon an evaluation of exposure to risk, costs and benefits of implementation, and any other factors that are determined to be relevant. The head of each state agency listed in the budget director's schedule, and the comptroller and the attorney general if they or their designees so determine, shall establish an internal audit function which operates in accordance with generally accepted professional standards for internal auditing. Any such internal audit function shall be directed by an internal audit director who shall report directly to the head of such state agency. Notwithstanding any other provision of law, each internal audit director shall be appointed by the head of the state agency based on appropriate internal auditing credentials of the proposed appointee, consistent with generally accepted standards for internal auditing, including internal auditing education and experience. The position of internal audit director shall be an exempt position and except in the case of the department of audit and control and department of law, such appointment shall be subject to the approval of the director of the budget. For agencies for which an independent audit is not required pursuant to sections nine hundred fifty-three and nine hundred fifty-four of this article, the internal audit function shall evaluate the agency's internal controls and operations. The internal audit function shall also identify internal control weaknesses that have not been corrected and make recommendations to correct these weaknesses.

2. In the event the head of a state agency does not establish an internal audit function pursuant to subdivision one of this section, he or she shall nevertheless establish and maintain the program of internal control review required by section nine hundred fifty-one of this article.