At Institution C, two members of the research team were physically present for the interview.We interviewed representatives from both the internal audit and information security functions at Institutions A, B, and C but only interviewed someone in information
security at Institution D because it outsourced its internal audit function.