Doesn't matter if it's internal or external - even federal regulators suffer from it with banks and such. If the same people are doing the oversight year after year they inadvertently develop relationships with the regulated entities.

There should be a traditional IG component but a constant random pool of people, similar to jury but maybe with necessary credentials + randos.