Internal audit (the unit fulfilling the role in 12 CFR part 30, Appendix A, II.B) stays independent of front line units and independent risk management because the Chief Audit Executive (one level below the CEO) has unrestricted access to the audit committee; the audit committee reviews and approves the internal audit charter and audit plans and approves all decisions on the CAE's appointment, removal, annual compensation and salary adjustment; the audit committee or the CEO oversees the CAE's administrative activities; and no front line unit executive oversees internal audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.