Internal Audit and Credit Risk Review, both of which are independent of management, serve as the third line of defense and ensure that appropriate risk management controls, processes and systems are in place and functioning effectively.