The internal audit function must periodically review the controls over the bank's finance function using the risk-based approach.