The Audit Committee receives regular reports from the company’s information security department, business technology solutions group, and enterprise risk management director, as well as from internal and external auditors specific to its information security program.