The "Three Lines of Defense" model is one of the important tools for understanding and implementing risk management in companies. The first line in…

The first line of defense consists of operational management and staff who own and manage risks as an integral part of their day-to-day responsibilities. Their primary role is the execution of risk management, which includes identifying, assessing, controlling, and mitigating risks within their business areas. While this involves executing internal control procedures, "Risk management" is the broader, more comprehensive term for the first line's overall function. The second line provides the framework and oversight for risk, but the first line is responsible for the direct management of it.

A. Internal control procedures. This is too specific. Implementing controls is a key activity within the first line's broader risk management responsibilities, not the entirety of its role.

C. Quality. This is incorrect. The quality assurance function is a typical example of a second-line-of-defense role, providing specialized oversight and monitoring to ensure standards are met.

1. The Institute of Internal Auditors (IIA). (2013). The Three Lines of Defense in Effective Risk Management and Control. Page 2. "As the first line of defense, operational management owns and manages risks. They are also responsible for implementing corrective actions to address process and control deficiencies."

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO) & The Institute of Internal Auditors (IIA). (2015). Leveraging COSO Across the Three Lines of Defense. Page 4. "The first line of defense is front-line and mid-line managers who have day-to-day ownership and management of risk. The first line develops and implements internal controls..."

3. Chambers, A. D., & Odar, M. (2015). A new vision for internal audit. Managerial Auditing Journal, 30(1), 34-55. https://doi.org/10.1108/MAJ-07-2014-1068. (Section: "The first line of defence"). This academic article affirms that the first line's role is operational management, which involves owning and managing risks and controls.