Question

At a mid-sized bank, the operational risk management function has begun designing controls for the loan origination process, approving those controls, and then reporting on their effectiveness to the board. The internal audit department has raised a concern about this arrangement. Which principle of the three lines of defense model is MOST directly being violated?

Accepted Answer

The first line (business operations) should own and manage risk and controls, not the second line

Answer

The second line should report administratively to the first line to ensure alignment

Answer

Internal audit should design the controls it will later evaluate

Answer

The board should approve individual process-level controls before implementation