Tell me about a complex IT audit or cybersecurity engagement where you had to explain technical risks to non-technical stakeholders. How did you ensure understanding and action?