Third Line: The third line of defense is the external and internal auditors who independently evaluate the compliance risks and controls. They are also responsible for reporting to the Board and Senior Management's oversight functions.