Which of the following is the PRIMARY risk management responsibility of the third line of defense?

The third line of defense, generally internal audit, is responsible for providing objective and independent assurance to the board and senior management on the effectiveness of governance, risk management, and internal control processes. This involves evaluating whether risk management activities are operating as intended and achieving their objectives.

Providing guidance on the design of effective controls is typically a responsibility of the second line of defense (e.g., risk management function).

Providing advisory services on ERM is primarily a role of the second line of defense or external consultants, not the independent assurance function of the third line.

Benchmarking other organizations' risk management programs, while potentially informative, is not the primary, core responsibility of the third line of defense.