A municipal utility cites the three lines of defense in its charter and asks where day-to-day risk ownership sits versus independent assurance. Which placement is correct at overview depth?
Select an answer to reveal the explanation.
Short Explanation
Picture three fences around the same plant: the operators run the valves, the risk/compliance team watches the gauges, and audit walks the yard independently. Day-to-day ownership stays with the first line.
Full Explanation
The three lines of defense model places day-to-day risk ownership with operational management as the first line: plant operators, application owners, and process managers who run controls in the business. Risk and compliance functions form the second line, providing frameworks, oversight, and challenge without replacing first-line ownership. Internal audit is the third line, delivering independent assurance that must remain separate from routine control operation. At overview depth for a municipal utility, that placement is the expected answer. Saying internal audit owns day-to-day controls while managers only write findings inverts the model and destroys independence. Casting the service desk as first line, vulnerability response as second, and SAM as third substitutes ITSM and adjacent products for the lines-of-defense concept. Claiming third-party risk management replaces all three lines for civic utilities overstates TPRM and abandons internal accountability. Exam caveat: CIS-RC overview items test classic three-lines placement, not product-badge remapping. Operational check for the utility: for one critical control on a treatment plant entity, name a first-line control owner for attestation, a second-line compliance or risk reviewer for oversight, and keep audit engagement testing off that standing ownership list.