Its execution means that:
. On one hand, the board of directors should ensure that the staff of the bank’s internal audit department are appropriately trained and competent staff. Qualified staff is available to verify that operating policies and procedures have been effectively implemented and consequently to guarantee the effectiveness of the entity’s OR strategy.
In practice, internal audit at some banks (particularly small ones) may not have the necessary skills, and in these circumstances board of directors should consider whether this function should be outsourced.
. On the other hand, the board of directors should ensure that the independence of the audit function is maintained.
The audit function may provide valuable input to those responsible for OR management, but should not itself have direct OR management responsibilities. Nevertheless, in practice, particularly at smaller banks, the audit function may have initially held responsibility for developing an OR management program. Responsibility for day to day OR management must be transferred elsewhere in a timely manner, although problems may still arise if the audit function is required to validate the process they had originally established.