(a) The board shall:
(1) appoint an internal auditor who reports directly to the board and serves at the will of the board; and
(2) provide staff and other resources to the internal auditor as appropriate.
(b) The internal auditor shall prepare an annual audit plan using risk assessment techniques to rank high-risk functions in the department. The internal auditor shall submit the annual audit plan to the board for consideration and approval. The board may change the plan as necessary or advisable.

(c) The internal auditor may bring before the board an issue outside of the annual audit plan that requires the immediate attention of the board.
(d) The internal auditor may not be assigned any operational or management responsibilities that impair the ability of the internal auditor to make an independent examination of the department’s operations. The internal auditor may provide guidance or other advice before an operational or management decision is made but may not make the decision, approve the decision, or otherwise violate this subsection.
(e) The department shall give the internal auditor unrestricted access to the activities and records of the department unless restricted by other law.