It's interesting that the mandate letter seems to be so narrow in scope.
As quickly as we can, because our time is very short, how are risks assessed and prioritized dealing with AIS? Who is responsible and how are they assessed?
On May 8th, 2019. See this statement in context.