• The “third line of defense” is Risk Review, which provides independent assessment and testing of the effectiveness, appropriateness, and adherence to risk management policies, practices, and controls.