Basic risk management Nordea follows the principles of “three lines of defence”, namely the business units in the first line, the Group level control functions in the second line and the Internal Audit in the third line.