Question

A manufacturing company is formalizing its three lines of defense model. During implementation, the head of production operations argues that because the risk management function performs quarterly risk assessments of the production floor, that function should be accountable for ensuring production-line safety controls operate effectively day-to-day. How should the risk practitioner respond to correctly assign responsibility under the three lines of defense model?

Accepted Answer

Operational management owns and operates the safety controls as the first line, while the risk management function provides oversight and facilitation as the second line.

Answer

The risk management function should accept accountability for the day-to-day operation of safety controls because it possesses the specialized risk assessment expertise.

Answer

Internal audit should assume responsibility for operating the safety controls since it independently reviews control effectiveness.

Answer

The board's risk committee should directly operate and monitor the safety controls to ensure enterprise-wide consistency.