Key points- Transparency and disclosure checklist- Incident governance operating model- Recurring internal audit plan