what are the first two lines of defense a company should take when addressing security risks?
the first line of defence â functions that own and manage risk. the second line of defence â functions that oversee or specialise in risk management, compliance. the third line of defence â functions that provide independent assurance, above all internal audit.