According to Basel guidelines for operational risk governance, a fundamental principle is that the operational risk management framework should be subject to effective and comprehensive independent review (usually by an internal audit). Option A is incorrect because outsourcing does not relieve senior management of their responsibility for internal controls. Option B is incorrect because the bank plans to adopt the new Basel III Standardized Approach (SA), which replaces internal models (AMA) for calculating regulatory capital for operational risk. Option D is incorrect because the business lines themselves, not the risk management function, should be the primary owners of their risk exposures (as the first line of defense).