The review can be conducted by anyone other than the Compliance Officer or anyone subordinate to the Compliance Officer. However, the person conducting the review needs to have sufficient knowledge of the compliance obligations. BSA regulation does not specify a frequency for a review. The regulation requires the scope and frequency of the review to be conducted commensurate with risk. However, for most MSBs, at least every twelve months is the expectation. The review must have transactions and systems testing to document the findings.