Within a governance structure for risk management, which of the following activities should be performed by the second line of defense?

Conducting internal and external audits is the primary role of the third line of defense, which provides independent assurance.

Implementing controls to manage risk is the responsibility of the first line of defense (operational management) as part of their day-to-day activities.

The second line of defense typically consists of functions like risk management, compliance, and quality assurance. Their role is to oversee the effectiveness of the first line's risk management activities, develop risk management frameworks, and perform ongoing monitoring of risks and the design and operating effectiveness of controls to ensure they are functioning as intended and align with the organization's risk appetite.

Identifying and assessing risk is a shared responsibility across all three lines, but the operational identification and initial assessment reside with the first line, with the second line providing frameworks and oversight.