Gov. Code, § 13406

(a) The entity head is responsible for the implementation of a risk management system and internal control, identifying challenges and weaknesses, and ensuring the identified challenges and weaknesses are mitigated or resolved.

(b) The entity head and entity management shall be responsible for the oversight of the risk management system to help ensure that program, administrative, and financial operations are functioning properly within their state entity.

(c) Entity management, at all levels, and under the direction of the entity head, shall manage the state entity’s risk as an integral part of its overall management practices. Entity management shall do all of the following:

(1) Ensure the state entity’s risk management system and internal control are designed, implemented, maintained, functioning as intended, continuously evaluated, improved as necessary, documented, and that system requirements are communicated throughout the state entity.

(2) Ensure that the state entity is effective and efficient in its operations, information reporting, and compliance efforts.

(3) Ensure that the risk management system and internal control help safeguard, administer, and monitor public resources.

(4) Comply with the guidance provided by the Department of Finance pursuant to Section 13403 and cooperate when subject to examination pursuant to subdivision (f).

(d) Auditors may, at the direction of entity management, facilitate entity management’s risk assessment process and perform internal control evaluations to assist entity management in its monitoring role.

(e) The Department of Finance shall make a final determination whether a state entity is subject to this chapter.

(f) The Department of Finance shall conduct, at its discretion, an examination of a state entity’s risk management system and internal control to ensure compliance with this chapter.