Responsibility for risk management is assigned using the “three lines of defence” model, with the First Line reflecting the business units having primary responsibility for risk management, supported by Second Line risk management functions and a Third Line Internal Audit function providing assurance and validation of the design and effectiveness of the ERM Framework.