(a)

that audit programs for reviewing the AMA framework cover all significant activities that could expose the institution to material operational risk, including outsourced activities;

(b)

that the internal validation techniques are proportionate to changing market and operating conditions, and that their outcomes are subject to audit review.