With regard specifically to information security risk, the Risk Management Workgroup has not only determined the types of losses that may occur, including reputational damage, damage to revenues, interruption of services, and leakage of confidential information, but has also worked with the IT Department to set out fundamental information security practices and plan for the introduction of the ISO 27001 international information security standard.