• Business units are audited for compliance, and any non-compliance noted is discussed and managed by the data privacy and information security executive steering committee to ensure adequate mitigation.