How should risk-related issues be addressed to ensure the effectiveness of the three lines of defense model?

The second line of defense - typically risk management and compliance functions - is specifically responsible for reviewing and monitoring risk-related issues identified by the first line and escalating them as needed to senior management or the board. This preserves the structural separation between risk-taking and risk oversight that is central to the model. Proper escalation by the second line ensures material risks reach decision-makers in a timely and structured manner.

Having senior management handle risk issues directly bypasses the tiered accountability structure and collapses the separation the three lines model is designed to maintain.

Delegating second-line oversight duties back to the first line eliminates the separation between risk-taking operations and risk oversight, which is the core purpose of the model.

The third line - internal audit - provides independent assurance over the overall framework, not ongoing operational risk oversight or real-time escalation.