In the three lines of defense model, the primary responsibility for ensuring risk mitigation controls are properly configured belongs to line management.
* First Line of Defense:
* Operational Management: Line management is part of the first line of defense and is responsible for managing risks and implementing controls in their day-to-day operations.
* Direct Control: They have the most direct control over processes and are best positioned to ensure that risk mitigation controls are properly configured and functioning as intended.
* Responsibilities:
* Implementation and Monitoring: Line management is responsible for both implementing the controls and monitoring their effectiveness. They are on the front lines of risk management and are integral to maintaining control effectiveness.
* Accountability: They are accountable for ensuring that controls are aligned with the organization's risk management policies and procedures.
* References:
* The CRISC Review Manual clearly outlines the roles in the three lines of defense model, emphasizing that operational management (line management) holds the primary responsibility for risk control implementation and configuration.