In the Three Lines of Defense model, what are the primary responsibilities of the first line (operational management) versus the second line (risk management and compliance)?

• A. The first line sets policy; the second line executes controls.
• B. The first line owns and manages risk and controls; the second line provides risk management oversight, policy guidance, and monitoring.
• C. The first line executes audits; the second line manages budgets.
• D. The first line is responsible for external reporting; the second line handles day-to-day operations.

Answer: (B)

In this model, the focus is on who owns risk in day-to-day operations versus who provides oversight and guidance. The first line, the operational management, owns and manages risk and the controls within their daily activities. They design and run the processes, implement the controls, and take accountability for how effectively those controls operate in practice.

The second line is about oversight and policy guidance. It establishes risk frameworks, policies, and monitoring mechanisms, and it provides independent risk management support to the first line. This line challenges, analyzes, and monitors risk across the organization, ensuring that the first line’s controls are appropriate and effective and that risks are being tracked against the organization’s policies and risk appetite.

So, the best fit is: the first line owns and manages risk and controls; the second line provides risk management oversight, policy guidance, and monitoring. The other options mix up where policy setting, auditing, budgeting, reporting, and day-to-day operations belong, which is why they don’t align with how the Three Lines of Defense is designed.