(a) The director, with the approval of the board, shall appoint an internal auditor who reports directly to the board and serves at the pleasure of the board.
(b) The internal auditor shall:
(1) prepare an annual audit plan using risk assessment techniques to rank high-risk functions in the department; and
(2) submit the annual audit plan to the director and board for consideration and approval or change as necessary or advisable.
(c) The internal auditor may bring before the director or board an issue outside the annual audit plan that requires the immediate attention of the director or board.
(d) The internal auditor may not be assigned any operational or management responsibilities that impair the ability of the internal auditor to make an independent examination of the department’s operations.
(e) The department shall give the internal auditor unrestricted access to activities and records of the department unless restricted by other law.