What are the three lines of defense in IT risk management?

• A. An operational management team handles day-to-day risk without independent oversight
• B. The risk/compliance function performs all audits and assessments
• C. Internal and external audits handle operational control exclusively
• D. Operational management (first line), risk/compliance function (second line), internal/external audit (third line)

Answer: (D)

The three lines of defense in IT risk management describe how responsibility and oversight are layered: the first line is operational management, owning and running processes and applying day-to-day controls; the second line is the risk and compliance function, which establishes policies, monitors risk, and provides guidance; the third line consists of internal and external audits, offering independent assurance on the effectiveness of governance, risk management, and controls. This structure ensures risk is managed at the point of activity, oversight comes from a separate function, and independent evaluation comes from audits. The described arrangement—operational management as the first line, risk/compliance as the second line, and internal/external audits as the third line—embodies this approach. Other options either place responsibility for all audits in one group or rely on a single entity to handle controls and oversight, which reduces independence and thoroughness.