The governing body is responsible for establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process. All three lines of defense report to and receive direction from this body.
Conditions: Sits above all three lines in the model.; Responsible for strategic direction and oversight rather than day-to-day execution.
The governing body is responsible for establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process. All three lines of defense report to and receive direction from this body.
Conditions: Sits above all three lines in the model.; Responsible for strategic direction and oversight rather than day-to-day execution.
The second line of defense includes risk management and compliance roles, such as a risk manager, compliance officer, or information security officer. They are responsible for implementing and monitoring the company's risk management program.
Conditions: Includes roles such as risk manager, compliance officer, and information security officer.; Focuses on implementation and monitoring rather than direct ownership of daily operational risks.
The second line of defense includes risk management and compliance roles, such as a risk manager, compliance officer, or information security officer. They are responsible for implementing and monitoring the company's risk management program.
Conditions: Includes roles such as risk manager, compliance officer, and information security officer.; Focuses on implementation and monitoring rather than direct ownership of daily operational risks.
The third line of defense includes internal and external auditors who objectively ensure the first and second lines of defense are effective, and also review and evaluate the risk management program.
Conditions: Requires objectivity relative to the first and second lines.; Covers both assurance over line effectiveness and evaluation of the risk management program.
The third line of defense includes internal and external auditors who objectively ensure the first and second lines of defense are effective, and also review and evaluate the risk management program.
Conditions: Requires objectivity relative to the first and second lines.; Covers both assurance over line effectiveness and evaluation of the risk management program.