Audit prograame required for operational risk review, can someone help