The annual audit plan developed by the internal auditor must be approved by the state agency’s governing board or by the administrator of a state agency if the state agency does not have a governing board. Audit reports must be reviewed by the state agency’s governing board and the administrator.