(a) The Corporation's board of directors must adopt an internal controls policy that provides adequate directions for, and identifies expectations in, establishing effective safety and soundness control over, and accountability for, the Corporation's operations, programs, and resources.

(b) The internal controls system must address:

(1) The efficiency and effectiveness of the Corporation's activities;

(2) Safeguarding the assets of the Corporation;

(3) Evaluating the reliability, completeness, and timely reporting of financial and management information;

(4) Compliance with applicable laws, regulations, regulatory directives, and the policies of the Corporation's board of directors and senior management;

(5) The appropriate segregation of duties among the Corporation personnel so that personnel are not assigned conflicting responsibilities; and

(6) The completeness and quality of information provided to the Corporation's board of directors.

(c) The Corporation is responsible for establishing and implementing an effective system to identify internal controls weaknesses and taking action to correct detected weaknesses. The Corporation must document:

(1) The process used to identify weaknesses,

(2) Any found weaknesses, and

(3) How identified weaknesses were addressed.