The bank's internal auditor must have formal regular communication with the CBB to (i) discuss the risk areas identified, (ii) understand the risk mitigation measures taken by the bank, and (iii) monitor the bank's response to weaknesses identified.