The internal audit function must be independent of the senior management, reporting either to the Board or its Audit committee (where applicable). The internal audit function must not be combined with any other function.