Which of the following activities is a responsibility of the second line of defense?

The second line of defense, often comprising risk management and compliance functions, provides oversight and challenges the first line's risk decisions and control effectiveness. Their role is to ensure that risk management processes are properly designed and executed across the organization.

Developing controls to manage risk scenarios is primarily a responsibility of the first line of defense, which owns and manages the risks.

Implementing risk response plans is an operational activity performed by the first line of defense as they execute their daily tasks.

Establishing organizational risk appetite is a strategic responsibility typically held by the board and senior management, often supported by the second line but not directly their primary activity.