Let's move to Number (3).
In view of substantial impact of failure in security trade control, annual internal audit is required to verify its proper implementation and to run a PDCA cycle.
Annual internal audit is aimed at confirming the proper business procedure based on the Compliance Program or CP.
PDCA cycle means Plan-Do-check-Act cycle.