(1)    There is created in the board an internal audit subunit, under the supervision of the internal auditor. The internal auditor shall report directly to the board and shall appoint all employees necessary to carry out the duties of the internal auditor. The internal auditor shall appoint all employees outside the classified service. The internal auditor shall fix the compensation of all employees appointed by the internal auditor, but the board may provide for bonus compensation to employees.

   (2)   The internal auditor may review any activity, information or investment of the board and have access to records of the board and any external party under contract with the board and shall do all of the following:

      (a)    Plan and conduct audit activities, risk assessments, research projects and management reviews under the direction of the board and in accordance with policies, principles and directives determined by the board.

      (b)    Coordinate and assist with external audits and reviews of the board.

      (c)    Through periodic internal audits, monitor for compliance with applicable legal requirements and with the board’s contractual agreements any bank, savings and loan association, savings bank, or credit union with which the board has entered into a custodial agreement under s. 25.17 (11); any investment advisers with which the board has contracted to manage and control board assets under s. 25.18 (2) (e); and any other external parties with which the board has contracted to provide investment services to the board.