A BILL TO BE ENTITLED
AN ACT to provide that the state auditor may audit information systems, to direct the state auditor to provide recommendations on corrective action to underperforming state agencies, and to make other amendments relating to the office of the state auditor.
The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 93B‑4 reads as rewritten:
"§ 93B‑4.  Audit of occupational licensing boards by the State Auditor; payment of costs.
(a)	The State Auditor shall audit occupational licensing boards from time to time to ensure their proper operation. The books, records, and operations of each occupational licensing board shall be subject to audit by the State Auditor pursuant to Article 5A of Chapter 147 of the General Statutes. In accordance with G.S. 147‑64.7(b), the State Auditor may contract with independent professionals to meet the requirements of this section.
(b)	Each occupational licensing board with a budget of at least fifty thousand dollars ($50,000) shall conduct an annual financial audit of its operations and may provide a copy to the State Auditor."
SECTION 2.  G.S. 147‑64.4 reads as rewritten:
"§ 147‑64.4.  Definitions.
The following definitions apply in this Article:
…
(2a)	Audit. – An independent review or examination of State agency organizations, programs, activities, and functions. The purpose of an audit is to help ensure full accountability and assist State agency officials and employees in carrying out their responsibilities. An audit must include at least one of the elements provided by this subdivision. It is not intended or desirable that every audit include all four elements, and audits of economy and efficiency and program results shall be selected when their use will meet the needs of the expected users of the audit results. The elements of an audit are as follows:
…
d.	Information systems: to evaluate risks relevant to information system assets, assess whether controls are in place to reduce or mitigate those risks, and verify information systems and applications are appropriate for State agency needs, efficient, and adequately controlled to ensure valid, reliable, and timely operations.
…
(4)	State agency. – Any department, political subdivision, institution, board, commission, committee, division, bureau, officer, official, or any other entity for which the State has oversight responsibility, including but not limited to, any university, mental or specialty hospital, community college, or clerk of court."
SECTION 3.  G.S. 147‑64.6 reads as rewritten:
"§ 147‑64.6.  Duties and responsibilities.
(a)	General Duty. – It is the policy of the General Assembly to provide for the auditing and investigation of State agencies by the impartial, independent State Auditor.
(b)	Areas of Examination. – The duties of the Auditor are independently to examine into and make findings of fact on whether State agencies have done or are doing all of the following:
…
(6a)	Are developing, maintaining, and operating information systems, including hardware, software, network communications, and data, in compliance with applicable laws, rules, and best practices and maintaining appropriate levels of data confidentiality, integrity, and availability within those systems.
…
(c)	Responsibilities. – The Auditor is responsible for the following acts and activities:
…
(5)	The Auditor may contract with federal audit agencies, or any governmental agency, on a cost reimbursable basis, for the Auditor to perform audits of federal grants and programs administered by State agencies in accordance with agreements negotiated between the Auditor and the contracting federal audit agencies or any governmental agency. In instances where the grantee State agency subgrants these federal funds to local governments, regional councils of government, and other local groups or private or semiprivate institutions or agencies, the Auditor may examine the books and records of these subgrantees to the extent necessary to determine eligibility and proper use in accordance with State and federal laws.
The Auditor shall charge and collect from the contracting federal audit agencies, or any governmental agencies, the actual cost of all the audits of the grants and programs contracted by the Auditor to do. Amounts collected under these arrangements shall be deposited in the State Treasury and budgeted in the Department of State Auditor and shall be available to hire sufficient personnel to perform these contracted audits and to pay for related travel, supplies, and other necessary expenses.
…
(14)	The Auditor shall notify the General Assembly, the Governor, the Chief Executive Officer of each agency audited, and other persons as the Auditor deems appropriate that an audit report has been published, its subject and title, and the locations, including State libraries, at which the report is available. The Auditor shall then distribute copies of the report only to those who request a report. The copies shall be in written or electronic form, as requested. The Auditor shall also file an electronic copy of the audit report in the Auditor's office that shall be a permanent public record. In addition, the Auditor may publish on his or her website any reports from audits of State agencies not directly conducted by the Auditor. If the report is the result of an investigation of a unit of local government subject to Article 3 of Chapter 159 of the General Statutes, the Auditor shall notify the Local Government Commission that a report has been published with respect to that unit of local government. Nothing in this subsection authorizes the publication of information if disclosure is otherwise prohibited by law.
…
(d)	Reports and Work Papers. – 
(1)	The Auditor shall maintain for 10 years a complete file of all audit reports and reports of other examinations, investigations, surveys, and reviews issued under the Auditor's authority. Audit reports, work papers, and other evidence and related supportive material directly pertaining to the work of the Auditor's office shall be retained according to an agreement between the Auditor and State Archives.
(2)	Work papers and related supportive material, whether maintained by the Auditor's office in its audit files or retained by State Archives, are not public records under Chapter 132 of the General Statutes and shall be kept confidential.
(3)	Notwithstanding G.S. 126‑24, pertinent work papers and other supportive material related to an audit or investigation made pursuant to this section shall be, unless otherwise prohibited by law, made available for inspection by duly authorized representatives of the State and federal government who desire access to and inspection of the records in connection with some matter officially before them, including criminal investigations.

…."
SECTION 4.  Article 5A of Chapter 147 of the General Statutes is amended by adding a new section to read:
"§ 147‑64.6E.  Corrective action.
(a)	If the Auditor finds that a State agency is deficient in the areas of examination provided by G.S. 147‑64.6(b), the Auditor shall include, as part of the audit report, one or more recommendations to the State agency to correct each deficiency. One year after receiving the recommendation, the State agency shall submit a progress report to the Joint Legislative Oversight Committee on General Government and the Office of the State Auditor so they may determine whether the State agency has made significant progress in correcting any identified deficiency in a timely manner.
(b)	If the Joint Legislative Oversight Committee on General Government finds that the State agency has failed to make significant progress in correcting a deficiency in a timely manner, the Committee may direct the State agency to appear before a legislative committee to provide information regarding the deficiency and corrective action taken by the State agency."
SECTION 5.(a)  G.S. 147‑64.7A reads as rewritten:
"§ 147‑64.7A.  Obstruction of audit.
Any person that (i) willfully makes or causes to be made to the State Auditor or the State Auditor's designated representatives any false, misleading, or unfounded report that interferes with the performance of any audit, special review, or investigation or (ii) hinders or obstructs the State Auditor or the State Auditor's designated representatives in the performance of their statutory duties is guilty of a Class 2 misdemeanor."
SECTION 5.(b)  This section becomes effective December 1, 2023, and applies to offenses committed on or after that date.
SECTION 6.  Except as otherwise provided, this act becomes effective October 1, 2023.