Conventional bank licensees must ensure that its ORMF is subject to independent review by a third party consultant, other than the external auditor upon first implementation of the requirements in this Module, and subsequently, every three years or when there are major changes in the operational risk profile of the bank.