The third line of defense is internal audit, which provides oversight of the first and second lines of defense, and independent assurance to the Board on the effectiveness of governance, risk management, and internal controls .