The internal auditor:

• develops a risk assessment and ensures proper internal controls are in place and working;
• performs an annual update on the risk assessment;
• tests and evaluates one or more areas of the district’s operations periodically; and
• prepares reports analyzing risk assessment findings and recommends changes for strengthening internal controls and reducing identified risks.

The internal auditor must report directly to the board.