Category 4 investment firms must not provide regulated services to their auditors or outsource their internal audit function to the same firm that acts as their external auditors.