Under the operational risk framework, there are typically three lines of defense:

1. First Line of Defense (Business Units): Responsible for identifying risks and controls, keeping track of risk events and losses, and following up on the implementation of control rules and action plans. (Options A, B, and C fall under the first line of defense).
2. Second Line of Defense (Independent Corporate Operational Risk Management Function): Responsible for the design of the operational risk framework, developing policies, and reviewing and taking part in the monitoring and reporting of the operational risk profile.
3. Third Line of Defense (Independent Audit): Responsible for independently reviewing and evaluating the effectiveness of the operational risk framework and ensuring the first and second lines are functioning properly.

Therefore, Option D accurately describes a task performed by the second line of defense.