In the three lines of defense model, a PRIMARY objective of the second line is to:

Reviewing and evaluating the risk management program is typically the primary objective of the *third line of defense* (internal audit), which provides independent assurance.

The second line of defense is responsible for oversight functions such as risk management, compliance, information security, and quality control. Its role is to develop and implement risk management policies, monitor adherence to these policies, and provide guidance to the first line (operational management) to ensure that risks are properly identified, assessed, and controls are effectively implemented and maintained.

Implementing risk management policies regarding roles and responsibilities is largely a *first-line* activity, as it involves the day-to-day operational execution of controls.

Acting as the owner for any operational risk identified as part of the risk program is a *first-line* responsibility, as operational management owns and manages the risks inherent in their business activities.