(a) The State Auditor shall conduct audits of all departments, including institutions of higher education, as specified in the audit plan. At the direction of the committee, the State Auditor shall conduct an audit or investigation of any entity receiving funds from the state.
(b) The State Auditor shall conduct the audits in accordance with generally accepted auditing standards as prescribed by the American Institute of Certified Public Accountants, the Governmental Accounting Standards Board, the United States General Accounting Office, or other professionally recognized entities that prescribe auditing standards.

(c) The State Auditor shall recommend the audit plan for the state for each year to the committee. In devising the plan, the State Auditor shall consider recommendations concerning coordination of agency functions made jointly by representatives of the Legislative Budget Board, Sunset Advisory Commission, and State Auditor’s Office. The State Auditor shall also consider the extent to which a department has received a significant increase in appropriations, including a significant increase in federal or other money passed through to the department, and shall review procurement activities for compliance with Section 2161.123. The plan shall provide for auditing of federal programs at least as often as required under federal law and shall ensure that audit requirements of all bond covenants and other credit or financial agreements are satisfied. The committee shall review and approve the plan.
(d) At any time during an audit or investigation, the State Auditor may require the assistance of the administrative head, official, auditor, accountant, or other employees of the entity being audited or investigated.
(e) The State Auditor is entitled to access to all of the books, accounts, confidential or unconfidential reports, vouchers, or other records of information in any department or entity subject to audit, including access to all electronic data. However, the State Auditor has access to information and data the release of which is restricted under federal law only with the approval of the appropriate federal administrative agency, and the State Auditor shall have access to copyrighted or restricted information obtained by the Office of the Comptroller of Public Accounts under subscription agreements and utilized in the preparation of economic estimates only for audit purposes.
(f) The State Auditor may conduct financial audits, compliance audits and investigations, and, with specific authority from the committee, economy and efficiency audits, effectiveness audits, and special audits as defined by this chapter and specified in the audit plan.
(g) To the extent that the performance of the powers and duties of the State Auditor under law is not impeded or otherwise hindered, the State Auditor shall make reasonable efforts to coordinate requests for employee assistance under Subsection (d) or requests for access to books, accounts, vouchers, records, or data under Subsection (e) so as not to hinder the daily operations of the audited entity.
(h) The State Auditor may not conduct audits of private entities concerning collection or remittance of taxes or fees to the state if the entity is subject to audit by another state agency for the taxes or fees.
(i) If the State Auditor decides a change in an accounting system is necessary, the State Auditor shall consider the present system of books, records, accounts, and reports to ensure that the transition will be gradual and that the past and present records will be coordinated into the new system.
(j) In devising the audit plan under Subsection (c), the State Auditor shall perform risk assessments as required by law. The process of assessing risks to the state is the first stage of auditing, and all records of risk assessment are part of the working papers of the State Auditor. Accordingly, all documentation of risk assessments by the State Auditor is exempt from disclosure under Section 552.116.
(k) In devising the audit plan under Subsection (c), the State Auditor shall consider the performance of audits on contracts entered into by the Health and Human Services Commission that exceed $100 million in annual value, including a contract between the commission and a managed care organization. The State Auditor shall collaborate with the financial managers in the Medicaid/CHIP Division of the commission in performing an audit described by this subsection. An audit described by this subsection:
(1) may be limited in scope to target an area of the contract that the State Auditor determines poses the highest financial risk to this state; and
(2) must determine whether the entity contracting with the commission has spent state money in accordance with the purposes authorized in the contract.
(l) The State Auditor may contract with a private auditor to audit a contract under Subsection (k).
(m) In devising the audit plan under Subsection (c), the State Auditor shall consider the performance of audits of programs operated by health and human services agencies that:
(1) have not recently received audit coverage; and
(2) have expenditures of less than $100 million per year.