Category 4 investment firms must establish mechanisms, including internal audits, to verify that controls, once established, are being followed.