Which are the three lines of defense in a governance, risk, and compliance framework?

Which are the three lines of defense in a governance, risk, and compliance framework?

• A. Operational management controls; risk management/audits; independent compliance function.
• B. Operational controls; internal controls; external audits.
• C. Corporate governance, IT security, and customer service.
• D. Compliance training, incident response, and policy development.

Answer: (A)

In governance, risk, and compliance, the structure emphasizes three distinct lines of defense: the people who own and operate the processes and controls on a day-to-day basis, the functions that oversee risk and compliance and provide guidance and monitoring, and an independent assurance function that objectively evaluates how well the first two lines are working. The option that fits this structure lists operational management controls as the first line, the combination of risk management activities with audits as the second line, and an independent function focused on compliance as the third line. This aligns with the idea of frontline ownership, independent oversight, and objective assurance that are central to the three-line defense model. Other choices mix roles that aren’t typically organized as separate lines of defense (for example, customer service or IT security standing alone, or training and policy development without a separate independent assurance function), which makes them less consistent with the defensive layering intended by this framework.

In governance, risk, and compliance, the structure emphasizes three distinct lines of defense: the people who own and operate the processes and controls on a day-to-day basis, the functions that oversee risk and compliance and provide guidance and monitoring, and an independent assurance function that objectively evaluates how well the first two lines are working. The option that fits this structure lists operational management controls as the first line, the combination of risk management activities with audits as the second line, and an independent function focused on compliance as the third line. This aligns with the idea of frontline ownership, independent oversight, and objective assurance that are central to the three-line defense model. Other choices mix roles that aren’t typically organized as separate lines of defense (for example, customer service or IT security standing alone, or training and policy development without a separate independent assurance function), which makes them less consistent with the defensive layering intended by this framework.