approach To evaluate the program's effectiveness, business units conduct risk control self-assessments, external regulatory examiners carry out comprehensive evaluations, and we implement three lines of defense built on internal audits, oversight and effective challenge, and our continuous monitoring program.