The responsibilities with respect to internal control, internal audit, risk management and so on that are set out in the code of good practice are fairly well established by now, so it is a shock and surprise to discover that the body has not complied with the previous recommendations.