This enhances the traditional Three Lines of Defense model by reinforcing the responsibility of the first line and formally recognizing the critical roles that senior management and the board have in risk governance.