Principle 2: The board of directors must ensure that the bank's operational risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. The internal audit function must not be directly responsible for operational risk management.