Which roles belong to the second line of defense?

Conditions

• Includes roles such as risk manager, compliance officer, and information security officer.
• Focuses on implementation and monitoring rather than direct ownership of daily operational risks.

Reasoning, step by step

1. Identify the second line as risk management and compliance.
2. List example roles: risk manager, compliance officer, information security officer.
3. Understand their responsibility is to implement and monitor the company's risk management program.
4. Note that they keep tabs on regulatory issues or unethical behavior.

Example

The presenter says: "The second line includes risk management and compliance roles, like a risk manager, compliance officer, or information security officer. They're responsible for implementing and monitoring the company's risk management program, keeping tabs on any regulatory issues or unethical behavior."

Common misconceptions

• Thinking the second line owns the daily operational risks.
• Assuming the second line is the same as the audit function.

Watch the explanation

Explore next

• What is the purpose of the third line of defense?
• What responsibilities does the governing body have in the Three Lines Model?