These organizational levels are divided into three lines of defence for risk management and control purposes: operational departments (risk owner), the Risk Management department and Compliance department, and the Internal Audit department.