A risk theme involving inadequate controls and operations for information security and IT systems management, including measures against phishing emails, unauthorized communications, global common rules, employee training and system renewal. The focus is on deficiencies in management structures and preventive controls, rather than information leaks or system outages themselves.