A municipal utility cites the three lines of defense in its charter…

Question

A municipal utility cites the three lines of defense in its charter and asks where day-to-day risk ownership sits versus independent assurance. Which placement is correct at overview depth?

Accepted Answer

Operational management owns and manages risk day to day (first line); risk and compliance provide oversight (second); internal audit provides independent assurance (third). — Picture three fences around the same plant: the operators run the valves, the risk/compliance team watches the gauges, and audit walks the yard independently. Day-to-day ownership stays with the first line.

Answer

Internal audit owns day-to-day controls; operational managers only write findings.

Answer

The service desk is the first line, vulnerability response is the second, and SAM is the third.

Answer

Third-party risk management replaces all three lines for civic utilities.

A municipal utility cites the three lines of defense in its charter and asks where day-to-day risk ownership sits versus independent assurance. Which placement is correct at overview depth?

Short Explanation

Full Explanation