The audit function should report to the audit committee of the board of directors (or similar oversight body) and independently evaluate the risk management and controls of the bank through periodic assessments, including the adequacy of the bank's controls to mitigate the identified risks, the effectiveness of the bank's staff's execution of the controls, the effectiveness of the compliance oversight and quality controls and the effectiveness of the training.