So from your seat, sitting in those sessions, how did you see the team approaching the planning and scoping of such a risk that's as broad and as fast-moving as cybersecurity?

I mean, cyber's such a hard engagement, so I'll, I'll admit, you know, I think I caught about eighty percent of everything being said because the team was so technical.

The approaching of the risks overall wasn't just the risk of what happens if we have a cyber attack.

It was really thinking through the implications of cyberattacks and really structuring the engagement but also providing for flexibility, uh- One thing, I'll probably mention it a few times, but as I was speaking to the team on a follow-up call, one of them had attended Black Hat, the Black Hat Conference, and was able to come back midstream and actually add more insight into actually what was being done based on hearing the most current events, including how AI is being used to, you know, perpetrate cyber attacks.

So a-again, structure f- but also flexibility was how I kinda saw the planning being approached and the risks being discussed.

And, you know, Barclays has a long history of being able to understand cyber issues, as most banks would, especially a bank that is multinational and has to comply with, you know, not just one set of regulations, but multiple.

Certainly the UK, the US, and everywhere else that they operate.

So how can senior leaders engage meaningfully with internal audit and increase awareness, kind of like what Anthony mentioned earlier on, uh, and also doing all this while preserving the, uh, function's independence? What are your thoughts on that? And either one of you can go on this one.

So how can senior leaders engage meaningfully with internal audit and increase awareness, kind of like what Anthony mentioned earlier on, and also doing all this while preserving the functions and dependents? What are your thoughts on that? And either one of you can go on this one.

I tend to go toward the basic things that kind of stood out to me.

Asking questions is such an important part of it.

You don't want to say, okay, you guys go get the cyber audit done and let me know how it goes.

Again, it's asking questions, giving context for why it's important to senior leadership.

I mean, sometimes it's not as obvious as we want to protect the bank's infrastructure from a cyber attack.

There are other reasons as well.

So what role can an internal audit play in supporting an organization's cyber resilience? That will certainly be value at the table.

Is that sort of dichotomy exists typically in a company? Uh, meaning does a chief audit executive or the head of internal audit really need to help the board understand its role in oversight, or do you find that the board is much more knowledgeable on the oversight function?

It really, it, I've seen it depend on a few factors.

I think in some industries, because it's so tightly watched, like financial services or banking specifically, that there's a very strong legal responsibility to look at things like cyber and AI and some level of degree of compliance with those requirements.

It's easier to look at, but I, our members have been advising boards a lot about the topics and leaning in to let them understand the nature of the risk and whether or not they have that misguided sense of security.

So we're seeing so much more work in that area.

Help me if I've answered that question fully, but our members are increasingly becoming more in line with letting the board know that in many cases, they are being, their governance processes are not keeping up with the speed of implementation.

And I don't think a lot of boards realize that, and a lot of boards can take a lot of comfort in what their teams are doing without more active oversight.

[laughs]

Did people make sense or did you decide, "Ah, that's good, that's not so good"?

Yes.

It was like hard to choose like between the different inter- like the different interviews and stuff.

And you, Anthony?

Kind of like what a- like what they all said.

At first we didn't all like each other, but then we all like came together and then we, then we did th- (laughs).