The first line of defense in the three lines of defense model in operational risk management is primarily responsible for managing operational risk on a day-to-day basis. This includes identifying, assessing, controlling, and mitigating operational risks. One of the key responsibilities of the first line of defense is to keep track of the operational risk profiles of the business units and report them. This involves monitoring the operational risks inherent in the business, developing appropriate controls to manage these risks, and evaluating the effectiveness and design of these controls. By keeping track of the operational risk profiles, the first line of defense can provide timely and accurate information to the second line of defense, which is responsible for overseeing the operational risk management framework and policies.

Choice B is incorrect. The development and maintenance of operational risk management and measurement policies, standards, and guidelines, as well as the design and delivery of operational risk, are typically responsibilities associated with the second line of defense. The first line of defense primarily involves managing risks on a day-to-day basis.

Choice C is incorrect. Reviewing other lines of business is not a primary responsibility associated with any specific line of defense in the three-line model. Each line has its own set of responsibilities related to risk management.

Choice D is incorrect. This task falls under both the second and third lines, which provide oversight functions.

Things to Remember

• Three lines of defense model in operational risk management