Each institution shall establish effective policies and procedures designed to ensure compliance with this part, including, but not limited to, adequate internal controls.