Which statement describes the Third Line's role in risk management?

• A. Owns and manages risk.
• B. Supports, monitors, provides frameworks.
• C. Independent assurance to the board.
• D. Manages day-to-day security operations.

Answer: (C)

In risk management, three lines of defense separate responsibilities. The third line provides independent assurance to the board that governance, risk management, and internal controls are working as intended. This means internal auditors assess the design and operating effectiveness of controls, report findings to the board or audit committee, and remain objective because they operate independently of management. They don’t own or manage risk themselves, aren’t responsible for day-to-day security operations, and aren’t the ones setting frameworks—those roles belong to the first and second lines. So the statement that best fits is that the third line offers independent assurance to the board.