N.C. Gen. Stat. § 143-748
Internal audit work papers are confidential except as otherwise provided in this section or upon subpoena issued by a duly authorized court. A published internal audit report is a public record as defined in G.S. 132-1 to the extent it does not include information which is confidential under State or federal law or would compromise the security of a State agency. An internal auditor shall maintain for 10 years a complete file of all audit reports and reports of other examinations, investigations, surveys, and reviews conducted under the internal auditor's authority. Audit work papers and other evidence and related supportive material directly pertaining to the work of the internal auditor's office shall be retained in accordance with Chapter 132 of the General Statutes. Unless otherwise prohibited by law and to promote intergovernmental cooperation and avoid unnecessary duplication of audit effort, audit work papers related to released audit reports shall be made available for inspection by duly authorized representatives of the State and federal government in connection with some matter officially before them.
N.C. Gen. Stat. § 143-748