In the context of model risk, model developers and model owners form the first line of defense. Hence, they generate the risk to which the organization is exposed.

B is incorrect. The first line owns the risk and should take all necessary steps to mitigate it, while the second line independently assesses the first line's risk and risk management practices.
C is incorrect. The first line owns the risk
D is incorrect. It should be the other way round, i.e., the second line of defense oversees the activities of the first line of defense.

Things to Remember

• Model Risk Management (MRM) framework is essential for identifying, assessing, and managing model risk within an organization.
• The Three Lines of Defense model is a widely accepted framework for effective risk management and control.
• In the Three Lines of Defense model, the first line of defense consists of business units that own and manage risks, the second line consists of risk management and compliance functions, and the third line consists of internal audit.
• Model developers and model owners in the MRM framework form the first line of defense as they are responsible for creating and managing the models that introduce risk to the organization.
• The second line of defense works independently to assess the risks identified by the first line and the effectiveness of risk management practices.