Category 4 investment firms must not outsource their internal audit function to the same firm that acts as their external auditors.