New York State - Executive - EXC - Article 45
ARTICLE 45 INTERNAL CONTROL RESPONSIBILITIES OF STATE AGENCIES
Section 950. Definitions.
951. Internal control responsibilities.
952. Internal audit responsibilities.
953. Independent audits of the executive chamber and the division of the budget.
954. Independent audits of the department of audit and control and the department of law.
§ 950. Definitions. As used in this article, the following terms shall have the following meanings:
1. "Internal control". A process that integrates the activities, plans, attitudes, policies, systems, resources and efforts of the people of an organization working together, and that is designed to provide reasonable assurance that the organization will achieve its objectives and mission. The objectives of an internal control system include, but are not limited to: the safeguarding of assets; checking the accuracy and reliability of accounting data and financial reporting; promoting the effectiveness and efficiency of operations; ensuring compliance with applicable laws and regulations; and encouraging adherence to prescribed managerial policies. Internal control review processes are used periodically to evaluate the ongoing internal control system and to assess and monitor the implementation of necessary corrective actions.
2. "Internal audit". An appraisal activity established by the management of an organization for the review of operations as a means of assuring conformance with management policies and the effectiveness of internal control, and conducted in conformance with generally accepted standards for internal auditing.
3. "State agency". Any state department, state university of New York, city university of New York, board, bureau, division, commission, committee, council, office or other governmental entity performing a governmental or proprietary function for the state, or any combination thereof as provided in subdivision two of section nine hundred fifty-one of this article, except any public authority or public benefit corporation, the judiciary or the state legislature.
4. "Judiciary". The courts and court-related programs, including the office of court administration, of the state-funded portion of the unified court system and all components thereof as provided in subdivision two of section two hundred forty-nine-a of the judiciary law.
5. "State legislature". The legislature of the state of New York, including all components thereof as provided in subdivision two of section ninety of the legislative law.
6. "Covered authority". Any public authority or public benefit corporation, other than a bi-state authority or public benefit corporation, a majority of whose members are appointed by the governor or serve as members by virtue of holding state offices to which they were appointed by the governor, or any combination thereof.
§ 951. Internal control responsibilities. 1. The head of each state agency shall:
a. establish and maintain for the agency guidelines for a system of internal control that are in accordance with this article and internal control standards;
b. establish and maintain for the agency a system of internal control and a program of internal control review. The program of internal control review shall be designed to identify internal control weaknesses, identify actions that are needed to correct these weaknesses, monitor the implementation of necessary corrective actions and periodically assess the adequacy of the agency's ongoing internal control;
c. make available to each officer and employee of the agency a clear and concise statement of the generally applicable management policies and standards with which the officer or employee of such agency shall be expected to comply. Such statement shall emphasize the importance of effective internal control to the agency and the responsibility of each officer and employee for effective internal control;
d. designate an internal control officer, who shall report to the head of the agency, to implement and review the internal control responsibilities established pursuant to this section;
e. implement education and training efforts to ensure that officers and employees within such agency have achieved adequate awareness and understanding of internal control standards and, as appropriate, evaluation techniques; and
f. periodically evaluate the need for an internal audit function.
2. In order to identify all state agencies and their responsibilities for the purposes of implementing the provisions of this article, the director of the division of the budget shall issue and update as necessary a schedule which lists all covered state agencies.
§ 952. Internal audit responsibilities. 1. The director of the division of the budget, after reviewing the evaluation of the head of each state agency as to the need for an internal audit function, shall issue and, at the director's discretion, periodically revise a schedule of state agencies (other than the department of audit and control and the department of law) which are required to establish and maintain an internal audit function. The comptroller and the attorney general or their designees shall determine, and periodically review such determination of, whether an internal audit function within their respective departments is required. Establishment of such function shall be based upon an evaluation of exposure to risk, costs and benefits of implementation, and any other factors that are determined to be relevant. The head of each state agency listed in the budget director's schedule, and the comptroller and the attorney general if they or their designees so determine, shall establish an internal audit function which operates in accordance with generally accepted professional standards for internal auditing. Any such internal audit function shall be directed by an internal audit director who shall report directly to the head of such state agency. Notwithstanding any other provision of law, each internal audit director shall be appointed by the head of the state agency based on appropriate internal auditing credentials of the proposed appointee, consistent with generally accepted standards for internal auditing, including internal auditing education and experience. The position of internal audit director shall be an exempt position and except in the case of the department of audit and control and department of law, such appointment shall be subject to the approval of the director of the budget. For agencies for which an independent audit is not required pursuant to sections nine hundred fifty-three and nine hundred fifty-four of this article, the internal audit function shall evaluate the agency's internal controls and operations. The internal audit function shall also identify internal control weaknesses that have not been corrected and make recommendations to correct these weaknesses.
2. In the event the head of a state agency does not establish an internal audit function pursuant to subdivision one of this section, he or she shall nevertheless establish and maintain the program of internal control review required by section nine hundred fifty-one of this article.
§ 953. Independent audits of the executive chamber and the division of the budget. 1. At least once every three years, the independent certified public accountant or accountants selected pursuant to this section shall conduct audits of the internal controls of the executive chamber and the division of the budget, either as a single audit or separately. Such audits shall be performed in accordance with generally accepted government auditing standards and shall include a report on whether the executive chamber and division of the budget's internal controls are established and functioning in a manner that provides reasonable assurance that they meet the objectives of internal control as defined in section nine hundred fifty of this article. The report shall identify the internal controls both evaluated and not evaluated and shall identify internal control weaknesses that have not been corrected and actions that are recommended to correct these weaknesses. If any such internal control weaknesses are significant or material with respect to the entity, the independent auditor shall so state. The governor and the director of the budget shall make available to the public the results of such audits, including any related management letters. The governor and director of the budget and any officer or employee of the executive chamber and the division of the budget shall make available upon request to such independent certified public accountants all books and records relevant to such independent audits.
2. The governor and the director of the budget, either separately or jointly, shall request proposals from independent certified public accountants for audits of the internal controls of the executive chamber and the division of the budget. The requests for proposals shall include a reference to the requirements for audits conducted pursuant to subdivision one of this section. The governor and the director of the budget shall select such independent auditor or auditors in accordance with a competitive procedure including an evaluation, based on quality and price factors, of those proposals received in response to such requests for proposals.
§ 954. Independent audits of the department of audit and control and the department of law. 1. At least once every three years, the independent certified public accountants selected pursuant to this section shall conduct audits of the internal controls of the department of audit and control and the department of law, respectively. Such audits shall be performed in accordance with generally accepted government auditing standards and shall include a report on whether the departments' internal controls are established and functioning in a manner that provides reasonable assurance that they meet the objectives of internal control as defined in section nine hundred fifty of this article. The report shall identify the internal controls both evaluated and not evaluated and shall identify internal control weaknesses that have not been corrected and actions that are recommended to correct these weaknesses. If any such internal control weaknesses are significant or material with respect to such departments, the independent auditors shall so state. The comptroller and the attorney general shall make available to the public the results of such audits, including any related management letters. The comptroller and attorney general and any officer or employee of such departments shall make available upon request to such independent certified public accountants all books and records relevant to such independent audits.
2. The comptroller and the attorney general shall request proposals from independent certified public accountants for audits of the internal controls of their respective departments. The requests for proposals shall include a reference to the requirements for audits conducted pursuant to subdivision one of this section. The comptroller and attorney general shall select such independent auditors in accordance with a competitive procedure including an evaluation, based on quality and price factors, of those proposals received in response to such requests for proposals.
3. Whenever the comptroller or the comptroller's appointee is a member of any board, commission, committee, council, or corporation, which constitutes a state agency, the governing body of such board, commission, committee, council, or corporation shall select an independent auditor for the purpose of conducting audits of internal controls in accordance with this section.
Section 950. Definitions.
951. Internal control responsibilities.
952. Internal audit responsibilities.
953. Independent audits of the executive chamber and the division of the budget.
954. Independent audits of the department of audit and control and the department of law.
§ 950. Definitions. As used in this article, the following terms shall have the following meanings:
1. "Internal control". A process that integrates the activities, plans, attitudes, policies, systems, resources and efforts of the people of an organization working together, and that is designed to provide reasonable assurance that the organization will achieve its objectives and mission. The objectives of an internal control system include, but are not limited to: the safeguarding of assets; checking the accuracy and reliability of accounting data and financial reporting; promoting the effectiveness and efficiency of operations; ensuring compliance with applicable laws and regulations; and encouraging adherence to prescribed managerial policies. Internal control review processes are used periodically to evaluate the ongoing internal control system and to assess and monitor the implementation of necessary corrective actions.
2. "Internal audit". An appraisal activity established by the management of an organization for the review of operations as a means of assuring conformance with management policies and the effectiveness of internal control, and conducted in conformance with generally accepted standards for internal auditing.
3. "State agency". Any state department, state university of New York, city university of New York, board, bureau, division, commission, committee, council, office or other governmental entity performing a governmental or proprietary function for the state, or any combination thereof as provided in subdivision two of section nine hundred fifty-one of this article, except any public authority or public benefit corporation, the judiciary or the state legislature.
4. "Judiciary". The courts and court-related programs, including the office of court administration, of the state-funded portion of the unified court system and all components thereof as provided in subdivision two of section two hundred forty-nine-a of the judiciary law.
5. "State legislature". The legislature of the state of New York, including all components thereof as provided in subdivision two of section ninety of the legislative law.
6. "Covered authority". Any public authority or public benefit corporation, other than a bi-state authority or public benefit corporation, a majority of whose members are appointed by the governor or serve as members by virtue of holding state offices to which they were appointed by the governor, or any combination thereof.
§ 951. Internal control responsibilities. 1. The head of each state agency shall:
a. establish and maintain for the agency guidelines for a system of internal control that are in accordance with this article and internal control standards;
b. establish and maintain for the agency a system of internal control and a program of internal control review. The program of internal control review shall be designed to identify internal control weaknesses, identify actions that are needed to correct these weaknesses, monitor the implementation of necessary corrective actions and periodically assess the adequacy of the agency's ongoing internal control;
c. make available to each officer and employee of the agency a clear and concise statement of the generally applicable management policies and standards with which the officer or employee of such agency shall be expected to comply. Such statement shall emphasize the importance of effective internal control to the agency and the responsibility of each officer and employee for effective internal control;
d. designate an internal control officer, who shall report to the head of the agency, to implement and review the internal control responsibilities established pursuant to this section;
e. implement education and training efforts to ensure that officers and employees within such agency have achieved adequate awareness and understanding of internal control standards and, as appropriate, evaluation techniques; and
f. periodically evaluate the need for an internal audit function.
2. In order to identify all state agencies and their responsibilities for the purposes of implementing the provisions of this article, the director of the division of the budget shall issue and update as necessary a schedule which lists all covered state agencies.
§ 952. Internal audit responsibilities. 1. The director of the division of the budget, after reviewing the evaluation of the head of each state agency as to the need for an internal audit function, shall issue and, at the director's discretion, periodically revise a schedule of state agencies (other than the department of audit and control and the department of law) which are required to establish and maintain an internal audit function. The comptroller and the attorney general or their designees shall determine, and periodically review such determination of, whether an internal audit function within their respective departments is required. Establishment of such function shall be based upon an evaluation of exposure to risk, costs and benefits of implementation, and any other factors that are determined to be relevant. The head of each state agency listed in the budget director's schedule, and the comptroller and the attorney general if they or their designees so determine, shall establish an internal audit function which operates in accordance with generally accepted professional standards for internal auditing. Any such internal audit function shall be directed by an internal audit director who shall report directly to the head of such state agency. Notwithstanding any other provision of law, each internal audit director shall be appointed by the head of the state agency based on appropriate internal auditing credentials of the proposed appointee, consistent with generally accepted standards for internal auditing, including internal auditing education and experience. The position of internal audit director shall be an exempt position and except in the case of the department of audit and control and department of law, such appointment shall be subject to the approval of the director of the budget. For agencies for which an independent audit is not required pursuant to sections nine hundred fifty-three and nine hundred fifty-four of this article, the internal audit function shall evaluate the agency's internal controls and operations. The internal audit function shall also identify internal control weaknesses that have not been corrected and make recommendations to correct these weaknesses.
2. In the event the head of a state agency does not establish an internal audit function pursuant to subdivision one of this section, he or she shall nevertheless establish and maintain the program of internal control review required by section nine hundred fifty-one of this article.
§ 953. Independent audits of the executive chamber and the division of the budget. 1. At least once every three years, the independent certified public accountant or accountants selected pursuant to this section shall conduct audits of the internal controls of the executive chamber and the division of the budget, either as a single audit or separately. Such audits shall be performed in accordance with generally accepted government auditing standards and shall include a report on whether the executive chamber and division of the budget's internal controls are established and functioning in a manner that provides reasonable assurance that they meet the objectives of internal control as defined in section nine hundred fifty of this article. The report shall identify the internal controls both evaluated and not evaluated and shall identify internal control weaknesses that have not been corrected and actions that are recommended to correct these weaknesses. If any such internal control weaknesses are significant or material with respect to the entity, the independent auditor shall so state. The governor and the director of the budget shall make available to the public the results of such audits, including any related management letters. The governor and director of the budget and any officer or employee of the executive chamber and the division of the budget shall make available upon request to such independent certified public accountants all books and records relevant to such independent audits.
2. The governor and the director of the budget, either separately or jointly, shall request proposals from independent certified public accountants for audits of the internal controls of the executive chamber and the division of the budget. The requests for proposals shall include a reference to the requirements for audits conducted pursuant to subdivision one of this section. The governor and the director of the budget shall select such independent auditor or auditors in accordance with a competitive procedure including an evaluation, based on quality and price factors, of those proposals received in response to such requests for proposals.
§ 954. Independent audits of the department of audit and control and the department of law. 1. At least once every three years, the independent certified public accountants selected pursuant to this section shall conduct audits of the internal controls of the department of audit and control and the department of law, respectively. Such audits shall be performed in accordance with generally accepted government auditing standards and shall include a report on whether the departments' internal controls are established and functioning in a manner that provides reasonable assurance that they meet the objectives of internal control as defined in section nine hundred fifty of this article. The report shall identify the internal controls both evaluated and not evaluated and shall identify internal control weaknesses that have not been corrected and actions that are recommended to correct these weaknesses. If any such internal control weaknesses are significant or material with respect to such departments, the independent auditors shall so state. The comptroller and the attorney general shall make available to the public the results of such audits, including any related management letters. The comptroller and attorney general and any officer or employee of such departments shall make available upon request to such independent certified public accountants all books and records relevant to such independent audits.
2. The comptroller and the attorney general shall request proposals from independent certified public accountants for audits of the internal controls of their respective departments. The requests for proposals shall include a reference to the requirements for audits conducted pursuant to subdivision one of this section. The comptroller and attorney general shall select such independent auditors in accordance with a competitive procedure including an evaluation, based on quality and price factors, of those proposals received in response to such requests for proposals.
3. Whenever the comptroller or the comptroller's appointee is a member of any board, commission, committee, council, or corporation, which constitutes a state agency, the governing body of such board, commission, committee, council, or corporation shall select an independent auditor for the purpose of conducting audits of internal controls in accordance with this section.
