Information security risk assessments are carried out regularly by the Information Security Teams across the Group and the results are monitored, managed and reported via the appropriate governance fora, based upon the materiality of the risk.