New York Consolidated Laws, Public Authorities Law - PBA § 2932. Internal audit responsibilities

1. The governing board of each covered authority or its designee shall determine, and periodically review the determination of, whether an internal audit function within the covered authority is required.  Establishment of such function shall be based upon an evaluation of exposure to risk, costs and benefits of implementation, and any other factors that are determined to be relevant.  In the event it is determined that an internal audit function is required, the governing board of each covered authority shall establish an internal audit function which operates in accordance with generally accepted professional standards for internal auditing.  Any such internal audit function shall be directed by an internal audit director who shall report directly to the governing board of the authority.  Internal audit director appointments shall be based on appropriate internal auditing credentials of the proposed appointee, consistent with generally accepted standards for internal auditing, including internal auditing education and experience.  The internal audit function shall evaluate the authority's internal controls and operations, identify internal control weaknesses that have not been corrected and make recommendations to correct these weaknesses.

2. In the event the governing board does not establish an internal audit function pursuant to subdivision one of this section it shall nevertheless establish and maintain the program of internal control review required by section twenty-nine hundred thirty-one of this title.