It's the latter. There's nothing in SCISA that legally requires this type of review or analysis.
I can do a review, as I'm doing, on my own initiative. I can investigate complaints, if they are made. However, in this type of area, the people who may complain don't know what's happening, so it's unlikely that there will be complaints raised to my office.
Of course, there are other oversight bodies that can act. However, in terms of, as you put it, internal controls, governance mechanisms, they exist, but they are wholly administrative. There's no legal requirement to have them.