Article 79.
Internal Auditing.
§ 143-745. Definitions; intent; applicability.
(a) For the purposes of this section:
(1) "Agency head" means the Governor, a Council of State member, a cabinet secretary, the President of The University of North Carolina, the President of the Community College System, the State Controller, and other independent appointed officers with authority over a State agency.
(2) "State agency" means each department created pursuant to Chapter 143A or 143B of the General Statutes, and includes all institutions, boards, commissions, authorities, by whatever name, that is a unit of the executive branch of State government, including The University of North Carolina, and the Community Colleges System Office. The term does not include a unit of local government.
(b) This Article applies only to a State agency that:
(1) Has an annual operating budget that exceeds ten million dollars ($10,000,000);
(2) Has more than 100 full-time equivalent employees; or
(3) Receives and processes more than ten million dollars ($10,000,000) in cash in a fiscal year. (2007-424, s. 1; 2009-516, s. 2; 2013-406, s. 1; 2016-126, 4th Ex. Sess., s. 9.)
§ 143-746. Internal auditing required.
(a) Requirements. - A State agency shall establish a program of internal auditing that:
(1) Promotes an effective system of internal controls that safeguards public funds and assets and minimizes incidences of fraud, waste, and abuse.
(2) Determines if programs and business operations are administered in compliance with federal and state laws, regulations, and other requirements.
(3) Reviews the effectiveness and efficiency of agency and program operations and service delivery.
(4) Periodically audits the agency's major systems and controls, including:
a. Accounting systems and controls.
b. Administrative systems and controls.
c. Information technology systems and controls.
(a1) Key Performance Indicators and Criteria. - In addition to the requirements of subsection (a) of this section, each agency head shall be responsible for ensuring that agency's internal audit unit meets the required key indicators and criteria established by the Council under G.S. 143-747(c)(3a).
(b) Internal Audit Standards. - Internal audits shall comply with current Standards for the Professional Practice of Internal Auditing issued by the Institute for Internal Auditors or, if appropriate, Government Auditing Standards issued by the Comptroller General of the United States. Each agency head shall annually certify to the Council that the audit plan was developed and the audit reports were conducted and reported in accordance with required standards.
(c) Appointment and Qualifications of Internal Auditors. - Any State employee who performs the internal audit function shall meet the minimum qualifications for internal auditors established by the Office of State Human Resources, in consultation with the Council of Internal Auditing.
(d) Director of Internal Auditing. - The agency head shall appoint a Director of Internal Auditing who shall report to, as designated by the agency head, (i) the agency head, (ii) the chief deputy or chief of staff, or (iii) the agency governing board, or subcommittee thereof, if such a governing board exists. The Director of Internal Auditing shall be organizationally situated to avoid impairments to independence as defined in the auditing standards referenced in subsection (b) of this section.
(e) Insufficient Personnel. - If a State agency has insufficient personnel to comply with this section, the Office of State Budget and Management shall provide technical assistance.
(f) Reporting Fraudulent Activity. - If an internal audit conducted pursuant to this section results in a finding that a private person or entity has received public funds as a result of fraud, misrepresentation, or other deceptive acts or practices while doing business with the State agency, the internal auditor shall submit a detailed written report of the finding, and any additional necessary supporting documentation, to the State Purchasing Officer. A report submitted under this subsection may include a recommendation that the private person or entity be debarred from doing business with the State or a political subdivision thereof. (2007-424, s. 1; 2013-382, s. 9.1(c); 2013-406, s. 1; 2015-241, s. 25.1(a); 2015-268, s. 7.4; 2021-180, s. 24.5(a).)
§ 143-747. Council of Internal Auditing.
(a) The Council of Internal Auditing is created, consisting of the following members:
(1) The State Controller who shall serve as Chair.
(2) The State Budget Officer.
(3) The Secretary of Administration.
(4) The Attorney General. The Attorney General may appoint a designee.
(5) The Secretary of Revenue.
(6) The State Auditor who shall serve as a nonvoting member. The State Auditor may appoint a designee.
(7) One member appointed by the General Assembly upon the recommendation of the President Pro Tempore of the Senate pursuant to G.S. 120-121. The member appointed must be a certified public accountant licensed in this State who has experience with internal auditing and is in good standing with the North Carolina State Board of Certified Public Accountant Examiners. The member shall be appointed for a term of four years and shall serve until a successor is appointed. A vacancy for a member appointed under this subdivision shall be filled by the appointing authority set forth in this subdivision to serve the remainder of the unexpired term.
(8) One member appointed by the General Assembly upon the recommendation of the Speaker of the House of Representatives pursuant to G.S. 120-121. The member appointed must be a certified public accountant licensed in this State who has experience with internal auditing and is in good standing with the North Carolina State Board of Certified Public Accountant Examiners. The member shall be appointed for a term of four years and shall serve until a successor is appointed. A vacancy for a member appointed under this subdivision shall be filled by the appointing authority set forth in this subdivision to serve the remainder of the unexpired term.
(a1) The Council shall hire an Executive Director as selected by a majority of the Council. The Executive Director shall serve at the will of the Council and be exempt from the provisions of the North Carolina Human Resources Act under Chapter 126 of the General Statutes.
(a2) The Council shall hire two full-time employees, as selected by a majority of the Council, to provide assistance to the Executive Director and to other staff of the Council of Internal Auditing. The employees shall perform any duties delegated by the Executive Director, serve at the will of the Council, and are exempt from the provisions of the North Carolina Human Resources Act under Chapter 126 of the General Statutes.
(b) The Council, including the position of Executive Director, shall be supported by the Office of State Budget and Management.
(c) The Council shall:
(1) Hold meetings at the call of the Chair or upon written request to the Chair by two members of the Council.
(2) Keep minutes of all proceedings.
(3) Promulgate guidelines for the uniformity and quality of State agency internal audit activities.
(3a) Establish required minimum key performance indicators and criteria that comply with the Professional Practice of Internal Auditing issued by the Institute for Internal Auditors.
(4) Recommend the number of internal audit employees required by each State agency.
(5) Develop internal audit guides, technical manuals, and suggested best internal audit practices.
(6) Administer an independent peer review system for each State agency internal audit activity; specify the frequency of such reviews consistent with applicable national standards; and assist agencies with selection of independent peer reviewers from other State agencies.
(7) Provide central training sessions, professional development opportunities, and recognition programs for internal auditors.
(8) Administer a program for sharing internal auditors among State agencies needing temporary assistance and assembly of interagency teams of internal auditors to conduct internal audits beyond the capacity of a single agency.
(9) Maintain a central database of all annual internal audit plans; topics for review proposed by internal audit plans; internal audit reports issued and individual findings and recommendations from those reports.
(10) Require reports in writing from any State agency relative to any internal audit matter.
(11) If determined necessary by a majority vote of the council:
a. Conduct hearings relative to any attempts to interfere with, compromise, or intimidate an internal auditor.
b. Inquire as to the effectiveness of any internal audit unit.
c. Authorize the Chair to issue subpoenas for the appearance of any person or internal audit working papers, report drafts, and any other pertinent document or record regardless of physical form needed for the hearing.
(11a) Gather and assess the extent to which State agencies have met the minimum key performance indicators and criteria required under subdivision (3a) of this subsection. The Council shall report its findings to the Joint Legislative Commission on Governmental Operations on or before December 31, 2022, and annually thereafter.
(12) No later than November 1 of each year, issue a report that shall include, but not be limited to, service efforts and accomplishments of State agency internal auditors and proposed legislation for consideration by the Governor and General Assembly. The annual report shall be prepared by the Office of State Budget and Management and shall be submitted to the Joint Legislative Oversight Committee on General Government. (2007-424, s. 1; 2013-406, s. 1; 2021-180, ss. 24.5(b), 37.1(f); 2022-6, s. 10.2.)
§ 143-748. Confidentiality of internal audit work papers.
Internal audit work papers are confidential except as otherwise provided in this section or upon subpoena issued by a duly authorized court. A published internal audit report is a public record as defined in G.S. 132-1 to the extent it does not include information which is confidential under State or federal law or would compromise the security of a State agency. An internal auditor shall maintain for 10 years a complete file of all audit reports and reports of other examinations, investigations, surveys, and reviews conducted under the internal auditor's authority. Audit work papers and other evidence and related supportive material directly pertaining to the work of the internal auditor's office shall be retained in accordance with Chapter 132 of the General Statutes. Unless otherwise prohibited by law and to promote intergovernmental cooperation and avoid unnecessary duplication of audit effort, audit work papers related to released audit reports shall be made available for inspection by duly authorized representatives of the State and federal government in connection with some matter officially before them. (2013-406, s. 1.)
§ 143-749. Obstruction of audit.
It shall be a Class 2 misdemeanor for any officer, employee, or agent of a State agency subject to the provisions of this Article to willfully make or cause to be made to a State agency internal auditor or the internal auditor's designated representatives any false, misleading, or unfounded report for the purpose of interfering with the performance of any audit, special review, or investigation or to hinder or obstruct the State agency internal auditor or the internal auditor's designated representatives in the performance of their duties. (2013-406, s. 1.)
§ 143-750: Reserved for future codification purposes.
§ 143-751: Reserved for future codification purposes.
§ 143-752: Reserved for future codification purposes.
§ 143-753: Reserved for future codification purposes.
§ 143-754: Reserved for future codification purposes.