The internal audit function should be independent of the senior management, reporting either to the Board or its Audit committee (where applicable).