32-9-207. Corporate governance of servicers. Covered institutions shall establish and maintain corporate governance standards as set by the department by rule. The standards must include internal and external audits and risk management.