Under the third Line of Defence, to assist the Group to ascertain the adequacy and effectiveness of the Group’s internal controls, business units are required to provide the Group with written assurances as to the adequacy and effectiveness of their system of internal controls and risk management.