Supporting functions such as accounting, internal audit, risk management, credit review, compliance, and legal, should independently monitor the control processes to ensure that they are effective and that risks are measured appropriately. The results of these independent reviews should be routinely reported to executive management and boards of directors.
Both executive management and directors should be sufficiently engaged in the process to determine whether these reviews are in fact independent of the operating areas under review and whether the officers conducting the reviews can, indeed, speak freely.