In our continuing quest to improve how companies manage risk, it’s inevitable we’d eventually discuss the “Three Lines of Defense,” a risk management model for clarifying roles and responsibilities.

The Three Lines of Defense model for compliance and risk management, where internal audit is positioned as an independent function in the third line of defense, is considered a good practice to ...