Chapter 578 Oregon Laws 2009

AN ACT

HB 3139

Relating to state agency internal audits; creating new provisions; and amending ORS 184.360 and 353.160.

Be It Enacted by the People of the State of Oregon:

SECTION 1. ORS 184.360 is amended to read:

          184.360. (1) As used in this section[,]:

          (a) “Executive department” has the meaning given that term in ORS 174.112.

          (b) “State government” has the meaning given that term in ORS 174.111.

          (2) It is the policy of this state that internal audit activities within state government be coordinated to promote effectiveness.

          (3) The Oregon Department of Administrative Services shall adopt rules setting standards and policies for internal audit functions within state government. The rules shall include, but are not limited to:

          (a) Standards for internal audits that are consistent with and incorporate commonly recognized industry standards and practices; and

          (b) Policies and procedures that ensure the integrity of the internal audit process.

(4) Each agency of the executive department required to have an internal audit function shall produce a risk assessment of the entire agency that conforms to audit standards established by nationally recognized entities such as the United States Government Accountability Office or the Institute of Internal Auditors. The agency shall use its risk assessment as the basis for the selection and performance of at least one internal audit per calendar year.

          (5) Each agency of the executive department required to have an internal audit function shall audit a component of its governance and risk management processes at least once every five years and file a report with the Oregon Department of Administrative Services.

          [(4)] (6) Not later than December 31 of each calendar year, the Oregon Department of Administrative Services shall prepare and submit a report to the Joint Legislative Audit Committee. In the absence of the Joint Legislative Audit Committee, the department shall submit the report to the Joint Committee on Ways and Means or the Emergency Board. The report shall describe internal audit activities that have occurred in state government during the calendar year in which the report is prepared.

SECTION 2. (1) An agency of the executive department that completes a risk assessment or internal audit under ORS 184.360, or that prepares an independent audit under ORS 353.160, shall file the completed risk assessment or internal audit with the Division of Audits of the Office of the Secretary of State.

          (2) Nothing in this section affects the constitutional duties and authority of the Secretary of State to audit public accounts.

SECTION 3. ORS 353.160 is amended to read:

          353.160. Nothing in this chapter [shall affect] affects the constitutional duties and authority of the Secretary of State to audit public accounts. However, the Oregon Health and Science University shall conduct independent audits if [such] the audits are considered advisable by the university. [Such] Subject to section 2 of this 2009 Act, the audits [shall be] are subject to the exclusive discretion and control of the university. The audits are [and shall be] subject to disclosure pursuant to ORS 192.410 to 192.505.

Approved by the Governor June 25, 2009

Filed in the office of Secretary of State June 25, 2009

Effective date January 1, 2010

__________