The internal audit function has a long-term strategy for auditing individual processes, based on annual risk assessment, communication with the management, the risk management function, and the Risk Committee.