Within non-financial risk management (NFR), this is an analysis of policies, processes, products, or other elements of an organization. The team or external group conducting the review should not have an interest in, or relationship with, what is being reviewed. Internal or external auditors often perform this function.