This involves: - A three-lines-of-defence model for effective risk management and compliance monitoring. - Appropriate segregation of duties, organizational structures, reporting lines, authorities and security responsibilities. - A dedicated security risk governance function that applies risk metrics to monitor the current state of our operations and risk profile.