75th OREGON LEGISLATIVE ASSEMBLY--2009 Regular Session
 
NOTE:  Matter within  { +  braces and plus signs + } in an
amended section is new. Matter within  { -  braces and minus
signs - } is existing law to be omitted. New sections are within
 { +  braces and plus signs + } .
 
LC 3343
 
                           A-Engrossed
 
                         House Bill 3139
                   Ordered by the House May 19
             Including House Amendments dated May 19
 
Sponsored by Representative KOMP; Representative DEMBROW (at the
  request of Service Employees International Union)
 
 
                             SUMMARY
 
The following summary is not prepared by the sponsors of the
measure and is not a part of the body thereof subject to
consideration by the Legislative Assembly. It is an editor's
brief statement of the essential features of the measure.
 
    { - Requires state agencies with internal auditor to produce
at least one complete audit per year. Requires internal auditor
to file confidential report on completed internal audit to
Secretary of State. - }
   { +  Requires certain state agencies to produce risk
assessment and use risk assessment as basis for selection and
performance of at least one internal audit per calendar year.
Requires agencies to file completed risk assessment or internal
audit with Division of Audits of Office of Secretary of
State. + }
 
                        A BILL FOR AN ACT
Relating to state agency internal audits; creating new
  provisions; and amending ORS 184.360 and 353.160.
Be It Enacted by the People of the State of Oregon:
  SECTION 1. ORS 184.360 is amended to read:
  184.360. (1) As used in this section  { - , - }  { + :
  (a) 'Executive department' has the meaning given that term in
ORS 174.112.
  (b) + } 'State government' has the meaning given that term in
ORS 174.111.
  (2) It is the policy of this state that internal audit
activities within state government be coordinated to promote
effectiveness.
  (3) The Oregon Department of Administrative Services shall
adopt rules setting standards and policies for internal audit
functions within state government. The rules shall include, but
are not limited to:
  (a) Standards for internal audits that are consistent with and
incorporate commonly recognized industry standards and practices;
and
  (b) Policies and procedures that ensure the integrity of the
internal audit process.
   { +  (4) Each agency of the executive department required to
have an internal audit function shall produce a risk assessment
of the entire agency that conforms to audit standards established
by nationally recognized entities such as the United States
Government Accountability Office or the Institute of Internal
Auditors. The agency shall use its risk assessment as the basis
for the selection and performance of at least one internal audit
per calendar year.
  (5) Each agency of the executive department required to have an
internal audit function shall audit a component of its governance
and risk management processes at least once every five years and
file a report with the Oregon Department of Administrative
Services. + }
    { - (4) - }  { +  (6) + } Not later than December 31 of each
calendar year, the  { + Oregon + } Department  { + of
Administrative Services + } shall prepare and submit a report to
the Joint Legislative Audit Committee. In the absence of the
Joint Legislative Audit Committee, the department shall submit
the report to the Joint Committee on Ways and Means or the
Emergency Board. The report shall describe internal audit
activities that have occurred in state government during the
calendar year in which the report is prepared.
  SECTION 2.  { + (1) An agency of the executive department that
completes a risk assessment or internal audit under ORS 184.360,
or that prepares an independent audit under ORS 353.160, shall
file the completed risk assessment or internal audit with the
Division of Audits of the Office of the Secretary of State.
  (2) Nothing in this section affects the constitutional duties
and authority of the Secretary of State to audit public
accounts. + }
  SECTION 3. ORS 353.160 is amended to read:
  353.160. Nothing in this chapter   { - shall affect - }  { +
affects + } the constitutional duties and authority of the
Secretary of State to audit public accounts. However, the Oregon
Health and Science University shall conduct independent audits if
 { - such - }  { +  the + } audits are considered advisable by
the university.   { - Such - }  { +  Subject to section 2 of this
2009 Act, the + } audits   { - shall be - }  { +  are + } subject
to the exclusive discretion and control of the university { + .
The audits are + }   { - and shall be - }  subject to disclosure
pursuant to ORS 192.410 to 192.505.
                         ----------