Competent authorities shall assess that an institution's audit and internal validation governance is of a high quality by confirming at least the following:
((a))
that audit programs for reviewing the AMA framework cover all significant activities that could expose the institution to material operational risk, including outsourced activities;
((b))
that the internal validation techniques are proportionate to changing market and operating conditions, and that their outcomes are subject to audit review.