The compliance function (second line of defence) and ia functions (third line of defence) are also available to secure compliance but the overarching principle is a decentralised responsibility for the operating organisation, see 11,13.