(a) "Executive department" has the meaning given that term in ORS 174.112.
(b) "State government" has the meaning given that term in ORS 174.111.
(2) It is the policy of this state that internal audit activities within state government be coordinated to promote effectiveness.
(3) The Oregon Department of Administrative Services shall adopt rules setting standards and policies for internal audit functions within state government. The rules shall include, but are not limited to:
(a) Standards for internal audits that are consistent with and incorporate commonly recognized industry standards and practices; and
(b) Policies and procedures that ensure the integrity of the internal audit process.
(4) Each agency of the executive department required to have an internal audit function shall produce a risk assessment of the entire agency that conforms to audit standards established by nationally recognized entities such as the United States Government Accountability Office or the Institute of Internal Auditors. The agency shall use its risk assessment as the basis for the selection and performance of at least one internal audit per calendar year.
(5) Each agency of the executive department required to have an internal audit function shall audit a component of its governance and risk management processes at least once every five years and file a report with the Oregon Department of Administrative Services.
(6) Not later than December 31 of each calendar year, the Oregon Department of Administrative Services shall prepare a report describing internal audit activities that have occurred in state government during the calendar year in which the report is prepared. The department shall submit the report to the Joint Legislative Audit Committee. In the absence of the Joint Legislative Audit Committee, the department shall submit the report to the Joint Committee on Ways and Means, the Joint Interim Committee on Ways and Means, the Emergency Board or another committee of the Legislative Assembly designated by the President of the Senate and the Speaker of the House of Representatives to receive the report. [2005 c.373 §1; 2009 c.578 §1; 2012 c.107 §6]