(a) The internal auditor shall:
(1) report directly to the state agency's governing board or the administrator of the state agency if the state agency does not have a governing board;
(2) develop an annual audit plan;
(3) conduct audits as specified in the audit plan and document deviations;
(4) prepare audit reports;
(5) conduct quality assurance reviews in accordance with professional standards as provided by Section 2102.011 and periodically take part in a comprehensive external peer review; and
(6) conduct economy and efficiency audits and program results audits as directed by the state agency's governing board or the administrator of the state agency if the state agency does not have a governing board.
(b) The program of internal auditing conducted by a state agency must provide for the auditor to:
(1) have access to the administrator; and
(2) be free of all operational and management responsibilities that would impair the auditor's ability to review independently all aspects of the state agency's operation.