We use a ‘three lines of defence’ risk governance model, whereby business divisions are responsible for risk taking and accountable for managing risks in line with our risk policies; risk functions led by the group chief risk officer provide objective challenge and guidance on risk matters; with Group Internal Audit providing independent assurance on the effectiveness of business risk management and the overall operation of the risk framework.