The regulator also specified that RBIA policy shall clearly document the purpose, authority, and responsibility of the internal audit activity, with a clear demarcation of the role and expectations from risk management function and risk -based internal audit function.