Within the three lines of defense model, the PRIMARY responsibility for ensuring risk mitigation controls are properly configured belongs with:

Line management, representing the "first line of defense," is primarily responsible for identifying, assessing, managing, and mitigating risks inherent in their day-to-day operations and processes. This includes the direct ownership and proper configuration of risk mitigation controls because they are closest to the operational activities and resources that generate and manage risk.

The IT risk function (often part of the second line of defense) provides oversight, guidance, and challenges to the first line, but does not have primary responsibility for the *direct configuration* of operational controls.

Enterprise compliance (also part of the second line of defense) focuses on ensuring adherence to laws, regulations, and internal policies, providing oversight rather than direct control configuration.

Internal audit (the third line of defense) provides independent assurance on the effectiveness of governance, risk management, and internal controls, but does not perform the direct configuration or management of controls.