National regulators in an emerging market country are developing guidelines for appropriate risk management responsibilities for different business functions at the country's banks. A regulatory analyst is asked to prepare a report recommending best practices for the firm-wide risk management, audit, and operations functions. Which of the following should the analyst recommend as an appropriate responsibility of the audit function?