Internal auditor; appointment; duties.

A. The board, with the recommendation and assistance of the chief executive officer, shall employ an internal auditor. The internal auditor, who shall be an employee of the authority, shall be qualified by training and experience as an auditor and management analyst and have at least five years of auditing experience. The internal auditor shall take direction as needed from the chief executive officer and be accountable to the board. B. The internal auditor shall conduct and coordinate comprehensive audits for all aspects of the lottery, provide management analysis expertise and carry out any other duties specified by the board and by law. The internal auditor shall specifically: (1) conduct, or provide for through a competitive bid process, an annual financial audit and observation audits of drawings; (2) create an annual audit plan to be approved by the board; (3) search for means of better efficiency and cost savings and waste prevention; (4) examine the policy and procedure needs of the lottery and determine compliance; (5) ensure that proper internal controls exist; (6) perform audits that meet or exceed governmental audit standards; and (7) submit audit reports on a quarterly basis to the board, the chief executive officer, the state auditor and the legislative finance committee. C. The internal auditor shall conduct audits as needed in the areas of: (1) personnel security; (2) lottery retailer security; (3) lottery contractor security; (4) security of manufacturing operations of lottery contractors; (5) security against lottery ticket counterfeiting and alteration and other means of fraudulently winning; (6) security of drawings among entries or finalists; (7) computer security; (8) data communications security; (9) database security; (10) systems security; (11) lottery premises and warehouse security; (12) security in distribution; (13) security involving validation and payment procedures; (14) security involving unclaimed prizes; (15) security aspects applicable to each particular lottery game; (16) security of drawings in games whenever winners are determined by drawings; (17) the completeness of security against locating winners in lottery games with preprinted winners by persons involved in their production, storage, distribution, administration or sales; and (18) any other aspects of security applicable to any particular lottery game and to the lottery and its operations. D. Specific audit findings related to security invasion techniques are confidential and may be reported only to the chief executive officer or his designee, the board, the governor and the attorney general.