“The [risk management] function established within FIS did not effectively responsd to regulatory concerns regarding identified risks,” the regulators wrote. “Additionally, [risk management] did not implement corrective actions for numerous information security weaknesses identified in various [Federal Financial Institution Examination Council] reviews, and in [internal audit] reports. [Risk management] was also unable to clearly convey the severity and potential impact of developments when submitting routine quarterly reports to the Audit Committee. Further, the Audit Committee did not provide adequate oversight of the [internal audit] function to ensure there is appropriate independence when validating and testing the security control infrastructure that [risk management] supervised].”