(a) The governing board of a state agency or the administrator of a state agency that does not have a governing board shall appoint an internal auditor.
(b) An internal auditor must:
(1) be a certified public accountant or a certified internal auditor; and
(2) have at least three years of auditing experience.

(c) The state agency shall employ additional professional and support staff the administrator determines necessary to implement an effective program of internal auditing.
(d) The governing board of a state agency, or the administrator of a state agency if the state agency does not have a governing board, shall periodically review the resources dedicated to the internal audit program and determine if adequate resources exist to ensure that risks identified in the annual risk assessment are adequately covered within a reasonable time frame.