We fulfil our information security risk and audit obligations with a combination of internal resources and external specialist security consultancies, that perform a number of internal information security audits and risk assessments across the organisation each year according to a three-year information security audit plan.