Explanation:
The correct answer is D because this statement incorrectly describes the three lines of defense concept.
Option A: Correct - The first line of defense indeed consists of the business lines that generate, own, and manage risks as part of their operational activities.
Option B: Correct - The second line of defense includes risk management specialists who provide oversight, expertise, and day-to-day risk management support.
Option C: Correct - The third line of defense involves independent assurance functions like internal audit that provide periodic, objective oversight.
Option D: Incorrect - This statement is problematic because:
The three lines of defense model is a risk governance framework where:
The framework acknowledges that no system is perfect, but it doesn't claim that safeguards "always" fail as stated in option D.
Ultimate access to all questions.
No comments yet.
Which of the following statements incorrectly describes the concept of three lines of defense?
A
The first line is the business line, which generates, owns, and manages risks.
B
The second line is the risk managers, who specialize in the risk management and day-to-day oversight.
C
The third line is the periodic independent oversight and assurance, such as an external audit.
D
The safeguards of three lines of defense do not always work, because risk management systems always have loopholes and become obsolete quickly.