Effective governance of the programme is seen as crucial, which is why it is overseen by both the Group Chief Risk Officer and Group Chief Operating Officer, and is robustly implemented through a three-linesof-defence model.