the First Line (business) owns and manages the risk, the Second Line (Risk) sets the frameworks and policies for managing risk and the Three Line (Audit) provide independent assurance of the risk management activities of the First and Second line.