The so­ phistication of the control processes has been significantly improved in recent years, with a revised information security policy and a newly introduced process for audits and risk management.