Answer:
It should call for periodic reviews of compliance in all areas of the institution. The persons performing the reviews should be independent and may be internal employees or independent contractors, such as a consulting or auditing firm. The reviews should be guided by a scope approved by the Board of Directors.