It is embedded into the group’s overall risk management framework and governance structure and operates a “identification, assessment and management of risk; the second line involves independent review and challenge of first line actions against established risk appetites; and the third line is independent assurance.