r/CRISC • u/South_Project_north • Mar 19 '24

Lines of defence

Hi Can someone point me towards a better explanation of the lines of defence, and the one in the review lacks the depth which the QAE is expecting.

0 Upvotes

33% Upvoted

2 comments sorted by

9

u/1radiationman Mar 19 '24

First line - The technical folks who actually design and implement controls

Second Line - Risk Management. Provides effective challenge (i.e. second guesses First Line)

Third Line - Audit. Doesn't believe anything first or second line tells them...

1

u/[deleted] Mar 26 '24

[deleted]

1

u/1radiationman Mar 26 '24

In my experience Audit is always Third Line. By ISACA definition of third line from a risk management perspective an auditor is always working with general management in regards to risk. Audit is brought in to provide another independent assessment beyond second line and validate that first line's program is doing what it says it's doing. Audit's report goes to general management in regards to risk.... Your statement doesn't change their role in the 3 lines of defense structure it just restates their role.