SECTIONS 13885-13888

13885.  The Legislature finds and declares as follows: (a) Recent corporate scandals and federal legislation, such as theSarbanes-Oxley Act of 2002 (P.L. 107-204), focus attention on theimportance of internal audit activity to public accountability andgovernance. (b) Ensuring the independence of internal auditors of stateagencies and that their findings are reported to the appropriatelevels of government is critical to safeguarding public funds and thepublic trust.13886.  (a)  Any governing body that oversees a state agency thatperforms or reviews internal audits shall establish an auditcommittee that generally meets the frameworks recommended by theAmerican Institute of Certified Public Accountants, as set forth inthe publication entitled "AICPA Audit Committee Toolkit: GovernmentOrganizations." (b) For purposes of this chapter, "governing body" means a board,commission, board of trustees, council, or other similar body thatoversees a state agency.13886.5.  (a) The Controller, the Director of Finance, and therespective staffs thereof, and all state agencies that have their owninternal auditors or that conduct internal audits or internal auditactivities, shall conduct internal audit activity under the generaland specified standards of internal auditing prescribed by theInstitute of Internal Auditors or the Government Auditing Standardsissued by the Comptroller General of the United States, asappropriate. (b) Nothing in this article is intended to limit the rights orobligations of internal auditors to conduct internal audits and auditactivities in accordance with other laws and regulations that mayapply to a particular entity.13887.  (a) In order to achieve independence and objectivitypursuant to Section 13886, for any state agency that does not reportto a governing body, the internal auditor operations shall meet allof the following requirements: (1) The chief internal auditor shall be accountable to the head ordeputy head of the state agency. (2) The chief internal auditor shall report audit findings andrecommendations made under his or her jurisdiction to the head ordeputy head of the state agency and to the general counsel to thestate agency, if applicable. (3) The operations shall be organizationally outside the staff orline management function of the unit under audit. (b) In order to achieve independence and objectivity as requiredby the standards identified in Section 13886, for any state agencythat is overseen by a governing body, the internal audit operationsshall meet all of the following requirements: (1) The chief internal auditor shall be accountable to the auditcommittee of the governing body. (2) The chief internal auditor shall report audit findings andrecommendations made under his or her jurisdiction to the auditcommittee and the general counsel to the governing body. (3) The operations shall be organizationally outside the staff orline management function of the unit under audit.13887.5.  (a) When the chief internal auditor of a state agencybelieves that senior management in the state agency has accepted alevel of residual risk that may be unacceptable to the organizationor that senior management has otherwise not taken appropriate actionin response to a finding or recommendation by its internal auditors,the chief internal auditor shall discuss the matter with seniormanagement and the general counsel to the state agency. If thatdecision regarding residual risk or the need for appropriate actionin response to an audit finding or recommendation, or both, does notresolve the issue, the chief internal auditor and general counselshall jointly report the matter to the next highest level ofmanagement as pertains to the state agency, including, but notlimited to, the chair of the governing body overseeing the stateagency, the agency secretary, the Governor's office, or theappropriate constitutional officer. (b) If the decision regarding residual risk or the need forappropriate action in response to an audit finding or recommendationthat could have a significant impact on the state's fiscaloperations, the performance of a significant government program, orthe delivery of a significant government service, or other similarsignificant or critical government services, as determined by thechief internal auditor, is still not resolved after making thedisclosures required pursuant to subdivision (a), the chief internalauditor shall report the matter to the Joint Legislative AuditCommittee and the State Auditor. At the direction of the JointLegislative Audit Committee, the State Auditor shall investigate adisclosure made pursuant to subdivision (b) and report the results ofthe investigation in accordance with Chapter 6.5 (commencing withSection 8543) of Division 1. The disclosure requirements of thissubdivision shall not apply to any chief internal auditor who reportsand makes disclosures to an audit committee, as described insubdivision (b) of Section 13887. (c) Any chief internal auditor who makes a disclosure pursuant tothis section shall receive all protection available under theCalifornia Whistleblower Protection Act (Article 3 (commencing withSection 8547) of Chapter 6.5 of Division 1).13888.  (a) If an internal auditor employed by a state agency has agood faith belief that the agency management is interfering with theinternal auditor's or auditors' ability to comply with the provisionsof this part, that the internal auditor or auditors are underpressure to modify or limit findings or recommendations, or thatsenior management is not taking appropriate action in response to anaudit finding or recommendation, the internal auditor may report theinformation supporting that good faith belief to the State Auditor. (b) The State Auditor may investigate any report made pursuant tosubdivision (a) and if the allegations are substantiated, shallreport his or her findings pursuant to Chapter 6.5 (commencing withSection 8545) of Division 1. (c) Any internal auditor making a report pursuant to this sectionshall receive all protection available under the CaliforniaWhistleblower Protection Act (Article 3 (commencing with Section8547) of Chapter 6.5 of Division 1).