FPA study found that advisers were most likely to have documented policies and procedures in place around governance and risk assessment (57%), access rights and controls (59%) and data loss prevention (58%) than policies and procedures governing training (51%), vendor management, and incident response (43% each)."