... the institution must conduct, as part of its regular internal auditing process, an independent review of its risk-measurement system. This review must include both the activities of the business trading units and of the independent risk-control unit. At least once a year, the institution must conduct a review of its overall risk-management process. The review must consider ... the accuracy and completeness of position data, the accuracy and appropriateness of volatility and correlation assumptions, and the accuracy of valuation and risk sensitivity calculations ...
