HB 2052 — An Act amending the act of April 9, 1929 (P.L.177, No.175), known as The Administrative Code of 1929, providing for internal auditing; and imposing duties on the Auditor General.

PRINTER'S NO.   2630

                     THE GENERAL ASSEMBLY OF PENNSYLVANIA



                         HOUSE BILL
                         No. 2052
                                               Session of
                                                 2025

     INTRODUCED BY GROVE, NOVEMBER 19, 2025

     REFERRED TO COMMITTEE ON APPROPRIATIONS, NOVEMBER 19, 2025


                                    AN ACT
 1   Amending the act of April 9, 1929 (P.L.177, No.175), entitled
 2      "An act providing for and reorganizing the conduct of the
 3      executive and administrative work of the Commonwealth by the
 4      Executive Department thereof and the administrative
 5      departments, boards, commissions, and officers thereof,
 6      including the boards of trustees of State Normal Schools, or
 7      Teachers Colleges; abolishing, creating, reorganizing or
 8      authorizing the reorganization of certain administrative
 9      departments, boards, and commissions; defining the powers and
10      duties of the Governor and other executive and administrative
11      officers, and of the several administrative departments,
12      boards, commissions, and officers; fixing the salaries of the
13      Governor, Lieutenant Governor, and certain other executive
14      and administrative officers; providing for the appointment of
15      certain administrative officers, and of all deputies and
16      other assistants and employes in certain departments, boards,
17      and commissions; providing for judicial administration; and
18      prescribing the manner in which the number and compensation
19      of the deputies and all other assistants and employes of
20      certain departments, boards and commissions shall be
21      determined," providing for internal auditing; and imposing
22      duties on the Auditor General.
23      The General Assembly of the Commonwealth of Pennsylvania
24   hereby enacts as follows:
25      Section 1.    The act of April 9, 1929 (P.L.177, No.175), known
26   as The Administrative Code of 1929, is amended by adding an
27   article to read:
28                             ARTICLE XXVIII-J
 1                            INTERNAL AUDITING
 2   Section 2801-J.   Scope of article.
 3      This article relates to internal auditing to assist
 4   Commonwealth agencies.
 5   Section 2802-J.   Purpose.
 6      The purpose of this article is to establish guidelines for a
 7   program of internal auditing to assist each Commonwealth agency
 8   by furnishing independent analyses, appraisals and
 9   recommendations about the adequacy and effectiveness of the
10   Commonwealth agency's system of internal control policies and
11   procedures and the quality of performance in carrying out
12   assigned responsibilities.
13   Section 2803-J.   Definitions.
14      The following words and phrases when used in this article
15   shall have the meanings given to them in this section unless the
16   context clearly indicates otherwise:
17      "Administrator."   The executive head or governing board or
18   authority of a Commonwealth agency.
19      "Assurance services."     As follows:
20          (1)    Activities that are designed to help accomplish
21      objectives by bringing a systematic and disciplined approach
22      to evaluate and improve risk management, control or
23      governance processes.
24          (2)    The term includes an audit.
25      "Audit."   Any of the following:
26          (1)    A financial audit.
27          (2)    A compliance audit.
28          (3)    An operational audit.
29          (4)    An effectiveness audit.
30          (5)    An investigation.

20250HB2052PN2630                      - 2 -
 1    "Commonwealth agency."        Any of the following:
 2           (1)   A department, agency, office, bureau, commission,
 3    board, division or other entity or officer of the executive
 4    branch of the Commonwealth. The term includes any of the
 5    following:
 6                 (i)    The Office of the Governor.
 7                 (ii)    The Office of the Lieutenant Governor.
 8                 (iii)    The Office of Attorney General.
 9                 (iv)    The Department of the Auditor General.
10                 (v)    The Treasury Department.
11                 (vi)    An independent agency, as defined in section
12           102 of the act of February 14, 2008 (P.L.6, No.3), known
13           as the Right-to-Know Law.
14                 (vii)    An organization established by the
15           Constitution of Pennsylvania, a statute or an executive
16           order that performs or is intended to perform an
17           essential governmental function.
18           (2)   A judicial agency, as defined in section 102 of the
19    Right-to-Know Law.
20           (3)   A legislative agency, as defined in section 102 of
21    the Right-to-Know Law.
22    "Compliance audit."        An audit to determine if:
23           (1)   The audited entity has obligated, expended, received
24    and used State money in accordance with the purpose for which
25    that money has been appropriated or otherwise authorized by
26    law.
27           (2)   The audited entity has obligated, expended, received
28    and used State money in accordance with any limitations,
29    restrictions, conditions or mandatory directions imposed by
30    law on those obligations, expenditures, receipts or uses.

20250HB2052PN2630                      - 3 -
 1          (3)     The records, books and accounts of the audited
 2      entity fairly and accurately reflect its financial and fiscal
 3      operations relating to the obligation, receipt, expenditure
 4      and use of State money or money represented as being
 5      collected for a State purpose.
 6          (4)     The collections of State revenues and receipts by
 7      the audited entity are in accordance with applicable laws and
 8      regulations.
 9          (5)     Money or negotiable securities or similar assets
10      handled by the audited entity on behalf of the State or
11      received from the State and held in trust by the audited
12      entity have been properly and legally administered.
13      "Consulting services."    As follows:
14          (1)     Advisory and related client service activities, the
15      nature and scope of which are agreed upon with the client and
16      are designed to add value and improve operations.
17          (2)     The term includes counsel, advice, facilitation and
18      training.
19      "Effectiveness audit."    An audit to determine, according to
20   established or designated program objectives, responsibilities
21   or duties, statutes and regulations, program performance
22   criteria or program evaluation standards, if:
23          (1)     The objectives and intended benefits are being
24      achieved efficiently and effectively.
25          (2)     The program duplicates, overlaps or conflicts with
26      another State program.
27      "Financial audit."    An audit to determine if:
28          (1)     The records, books and accounts of the audited
29      entity accurately reflect its financial and fiscal
30      operations.

20250HB2052PN2630                    - 4 -
 1          (2)   The audited entity is maintaining effective
 2      accounting control over revenues, obligations, expenditures,
 3      assets and liabilities.
 4          (3)   The accounting and recordkeeping of collections of
 5      State revenues and receipts by the audited entity are fair,
 6      accurate and in accordance with law.
 7          (4)   The accounting and recordkeeping of money or
 8      negotiable securities or similar assets handled by the
 9      audited entity and held in trust by the audited entity are
10      proper, accurate and in accordance with law.
11          (5)   Financial, program and statistical reports of the
12      audited entity are fairly presented.
13      "Internal auditing."    An independent and objective analysis
14   of business practices and activities through assurance services
15   or consulting services, or both.
16      "Internal auditor."    An individual appointed to conduct a
17   program of internal auditing under this article.
18      "Investigation."   An inquiry into:
19          (1)   specified acts or allegations of impropriety,
20      malfeasance or nonfeasance in the obligation, expenditure,
21      receipt or use of State money; or
22          (2)   specified financial transactions or practices that
23      may involve impropriety, malfeasance or nonfeasance in the
24      obligation, expenditure, receipt or use of State money.
25      "Operational audit."    An audit to determine:
26          (1)   If the audited entity is managing or utilizing
27      resources, including State funds, personnel, property,
28      equipment and space, in an economical and efficient manner.
29          (2)   Causes of inefficiencies or uneconomical practices,
30      including inadequacies in management information systems,

20250HB2052PN2630                   - 5 -
 1      internal and administrative procedures, organizational
 2      structure, use of resources, allocation of personnel,
 3      purchasing, policies and equipment.
 4            (3)   If financial, program and statistical reports of the
 5      audited entity contain useful data and are fairly presented.
 6   Section 2804-J.        Internal auditing.
 7      (a)   Requirement.--A Commonwealth agency shall conduct a
 8   program of internal auditing that includes:
 9            (1)   An annual audit plan that is prepared using risk
10      assessment techniques and that identifies the individual
11      audits to be conducted during the year.
12            (2)   Periodic audits of the agency's major systems and
13      controls, including:
14                  (i)    Accounting systems and controls.
15                  (ii)    Administrative systems and controls.
16                  (iii)    Electronic data processing systems and
17            controls.
18      (b)   Consideration.--In conducting the program of internal
19   auditing under subsection (a), the Commonwealth agency shall
20   consider methods for ensuring compliance with contract processes
21   and controls and for monitoring contracts.
22      (c)   Internal auditor.--
23            (1)   The administrator of a Commonwealth agency shall
24      appoint an internal auditor to conduct the program of
25      internal auditing under this article.
26            (2)   An internal auditor shall:
27                  (i)    Be a certified public accountant, certified
28            internal auditor, certified management accountant,
29            certified global management accountant or certified fraud
30            examiner.

20250HB2052PN2630                       - 6 -
 1                  (ii)    Have at least three years of auditing
 2            experience.
 3                  (iii)    Be currently licensed or certified and be in
 4            good standing with the respective licensing board during
 5            the period in which the individual is engaged in auditing
 6            as an internal auditor.
 7      (d)   Additional staff.--A Commonwealth agency shall employ
 8   additional professional and support staff that the administrator
 9   of the Commonwealth agency determines necessary to implement an
10   effective program of internal auditing.
11      (e)   Resources.--The administrator of a Commonwealth agency
12   shall periodically review the resources dedicated to the program
13   of internal auditing and determine if adequate resources exist
14   to ensure that risks identified in the annual risk assessment
15   are adequately covered within a reasonable time frame.
16   Section 2805-J.        Duties of internal auditor.
17      (a)   Specific duties.--An internal auditor of a Commonwealth
18   agency shall:
19            (1)   Report directly to the administrator of the
20      Commonwealth agency.
21            (2)   Develop an annual audit plan for the Commonwealth
22      agency.
23            (3)   Conduct audits as specified in the audit plan and
24      document deviations.
25            (4)   Prepare audit reports.
26            (5)   As follows:
27                  (i)    Conduct quality assurance reviews in accordance
28            with:
29                         (A)   The standards for the professional practice
30                  of internal auditing in effect upon the effective

20250HB2052PN2630                         - 7 -
 1                   date of this section.
 2                          (B)   The Code of Ethics contained in the
 3                   Professional Practices Framework as promulgated by
 4                   the Institute of Internal Auditors in effect upon the
 5                   effective date of this section.
 6                          (C)   Generally accepted government auditing
 7                   standards.
 8                   (ii)    Periodically take part in a comprehensive
 9             external peer review.
10             (6)   Conduct operational audits and other audits as
11      directed by the administrator of the Commonwealth agency.
12      (b)    Administration.--A program of internal auditing
13   conducted by a Commonwealth agency shall provide for the
14   internal auditor of the Commonwealth agency to:
15             (1)   Have access to the administrator of the Commonwealth
16      agency.
17             (2)   Be free of all operational and management
18      responsibilities that would impair the internal auditor's
19      ability to review independently all aspects of the operations
20      of the Commonwealth agency.
21   Section 2806-J.         Audit plans and audit reports.
22      (a)    Audit plan.--The annual audit plan developed by an
23   internal auditor of a Commonwealth agency must be approved by
24   the administrator of the Commonwealth agency.
25      (b)    Audit report.--An audit report for a Commonwealth agency
26   shall be reviewed by the administrator of the Commonwealth
27   agency.
28   Section 2807-J.         Annual reports.
29      (a)    Requirement.--No later than each November 1, an internal
30   auditor of a Commonwealth agency shall prepare an annual report

20250HB2052PN2630                          - 8 -
 1   on the program of internal auditing of the Commonwealth agency.
 2      (b)   Form.--The Auditor General shall prescribe the proposed
 3   form of the annual reports.
 4      (c)   Submittal.--Each report under this section shall be
 5   submitted to:
 6            (1)   The Governor.
 7            (2)   The Auditor General.
 8            (3)   The administrator of the Commonwealth agency.
 9            (4)   The members of the General Assembly.
10   Section 2808-J.    Periodic audits, action plans and responses.
11      (a)   Requirement.--A Commonwealth agency shall submit a copy
12   of the following to the entities specified in section 2807-J(c)
13   (1), (2) and (4):
14            (1)   A periodic audit performed by the internal auditor
15      of the Commonwealth agency, no later than 30 days after the
16      date that the internal auditor submits the periodic audit to
17      the administrator of the Commonwealth agency.
18            (2)   An action plan or other response issued by the
19      administrator of the Commonwealth agency in response to a
20      report from the internal auditor of the Commonwealth agency,
21      no later than 30 days after the action plan or other response
22      is prepared.
23      (b)   Compelling information.--If the Commonwealth agency
24   fails to submit the information specified in this section, an
25   entity specified under section 2807-J(c)(1), (2) and (4) may
26   take appropriate action to compel the submittal of the
27   information.
28   Section 2809-J.    Consultations.
29      An internal auditor of a Commonwealth agency may consult the
30   administrator of the Commonwealth agency, the Office of the

20250HB2052PN2630                    - 9 -
 1   Governor, the Auditor General or any other Commonwealth agency
 2   about matters affecting duties or responsibilities under this
 3   article.
 4   Section 2810-J.    Professional development.
 5      (a)     Assistance.--The Auditor General may make available and
 6   coordinate a program of training and technical assistance to:
 7            (1)   Ensure that internal auditors have access to current
 8      information about internal audit techniques, policies and
 9      procedures.
10            (2)   Provide general technical and audit assistance to
11      internal auditors upon request.
12      (b)     Reimbursement.--The Auditor General shall be entitled to
13   reimbursement for the costs associated with providing the
14   services under this section under the terms of interagency
15   cooperation contracts negotiated between the Auditor General and
16   each Commonwealth agency.
17   Section 2811-J.    Risk assessment.
18      (a)     Applicability.--In lieu of the procedures specified in
19   sections 2804-J, 2805-J, 2806-J, 2807-J, 2808-J, 2809-J and
20   2810-J, a Commonwealth agency may opt instead to comply with
21   this section if the Commonwealth agency:
22            (1)   has an annual operating budget that is less than
23      $10,000,000;
24            (2)   has fewer than 100 full-time equivalent employees;
25      or
26            (3)   receives and processes less than $10,000,000 in cash
27      in a fiscal year.
28      (b)     Requirement.--Each year, a Commonwealth agency shall
29   conduct a formal risk assessment consisting of an executive
30   management review of functions, activities and processes of the

20250HB2052PN2630                    - 10 -
 1   Commonwealth agency.
 2      (c)   Conditions.--A risk assessment under this section shall:
 3            (1)   Evaluate the probability of occurrence and the
 4      likely effect of financial, managerial and compliance risks
 5      and of risks related to the use of information technology.
 6            (2)   Rank risks according to the probability of
 7      occurrence and likely effect of the risks evaluated.
 8      (d)   Submittal.--The Commonwealth agency shall submit a
 9   report on the risk assessment to the Auditor General in the form
10   and at the time prescribed by the Auditor General.
11      (e)   Evaluation.--Based on risk assessment, the Auditor
12   General shall:
13            (1)   Evaluate each report submitted under this section.
14            (2)   Identify Commonwealth agencies under this section
15      with significant financial, managerial or compliance risk or
16      significant risk related to the use of information
17      technology.
18            (3)   Recommend to the administrator of a Commonwealth
19      agency identified under paragraph (2) that the Commonwealth
20      agency obtain an audit to address the significant risks
21      identified by the Auditor General.
22      (f)   Duties of administrator.--The administrator of a
23   Commonwealth agency identified under subsection (e)(2) may order
24   the Commonwealth agency to:
25            (1)   Obtain an audit under governmental auditing
26      standards.
27            (2)   Submit reports and action plans as prescribed by
28      section 2808-J.
29            (3)   Report to the Auditor General on the status of the
30      Commonwealth agency's implementation of audit recommendations

20250HB2052PN2630                    - 11 -
 1      in the form and addressing issues as prescribed by the
 2      Auditor General.
 3   Section 2812-J.    Publication.
 4      (a)   Requirement.--Consistent with the act of February 14,
 5   2008 (P.L.6, No.3), known as the Right-to-Know Law, a
 6   Commonwealth agency shall post on the publicly accessible
 7   Internet website of the Commonwealth agency:
 8            (1)   The Commonwealth agency's audit plan under section
 9      2806-J.
10            (2)   The Commonwealth agency's annual reports under
11      section 2807-J.
12      (b)   Updates.--A Commonwealth agency shall update the posting
13   required under this section to include:
14            (1)   A detailed summary of the weaknesses, deficiencies,
15      wrongdoings or other concerns, if any, raised by the audit
16      plan or annual report of the Commonwealth agency.
17            (2)   A summary of the action taken by the Commonwealth
18      agency to address the concerns, if any, that are raised by
19      the audit plan or annual report of the Commonwealth agency.
20      Section 2.     This act shall take effect in 60 days.




20250HB2052PN2630                      - 12 -