Group Audit forms the ‘Third Line of Defense’, independently and regularly reviewing risk governance implementation and compliance with risk principles, performing quality reviews of risk processes, and testing adherence to business standards, including the internal control framework.