Our risk management methodologies and structures are aligned to the Three Lines of Defence model, whereby the First Line of Defence (business lines) owns and manages the risk, the Second Line of Defence (Risk function) set the frameworks and policies for how risks should be managed and the Third Line of Defence (Group Internal Audit function) provides independent assurance over the risk management activities performed in the First and Second Lines of Defence.