Internal control system requirements for MGAs must match business size, scale, nature, and complexity. An MGA must develop and maintain a suitable internal control system, including an audit system, commensurate with the size, nature, scale and complexity of its business operations. The requirement is framed as an operational governance obligation and applies the internal control framework to the character and magnitude of the MGA's business.