Within the three lines of defense model, the responsibility for managing risk and controls resides with:

Operational management constitutes the first line of defense, meaning they own and manage risks, and implement and maintain controls as an integral part of their business processes and daily operations. They are directly responsible for achieving organizational objectives while managing the risks associated with those objectives.

The risk practitioner typically supports management by advising on risk frameworks and assessments (often part of the second line), but doesn't hold primary responsibility for daily risk management.

The internal auditor is the third line of defense, providing independent assurance on the effectiveness of risk management and controls, not directly managing them.

Executive management sets the tone and strategic direction for risk management, but operational management executes the day-to-day risk and control activities.