CORES Internal Audit & Three Lines of Defense

Question 1

In the Three Lines of Defense model, which line is primarily responsible for owning and managing operational risks on a day-to-day basis?

Accepted Answer

Business units and operational management

Answer

Internal Audit

Answer

Risk Management and Compliance functions

Answer

Board of Directors

Question 2

Which of the following BEST describes the role of the second line of defense in the Three Lines of Defense model?

Accepted Answer

Overseeing and challenging the first line's risk management activities

Answer

Executing business processes and transactions

Answer

Providing independent assurance to the board

Answer

Setting strategic direction for the organization

Question 3

What is the defining characteristic that distinguishes the third line of defense from the second line?

Accepted Answer

Organizational independence from management and risk-taking activities

Answer

Greater technical expertise in risk management

Answer

Direct authority to remediate control deficiencies

Answer

Responsibility for setting the risk appetite

Question 4

Under the IIA's Three Lines Model (2020 update), which body is positioned OUTSIDE the three lines and provides governing oversight?

Accepted Answer

Governing body (Board)

Answer

Chief Risk Officer

Answer

Compliance function

Answer

External auditors

Question 5

A bank's operational risk manager in the second line discovers a significant control weakness identified by a first-line business unit. What is the MOST appropriate immediate action?

Accepted Answer

Log the finding, require a remediation plan from the first line, and track progress

Answer

Remediate the control weakness directly without notifying business management

Answer

Escalate immediately to external auditors

Answer

Transfer the risk to a third-party insurer

Question 6

Which concept describes the risk that internal controls fail to prevent or detect material errors or fraud, often assessed during operational risk reviews?

Accepted Answer

Control risk

Answer

Residual risk

Answer

Inherent risk

Answer

Systemic risk

Question 7

In a well-functioning Three Lines of Defense model, coordination between lines is BEST achieved through:

Accepted Answer

Structured communication protocols and shared risk reporting platforms

Answer

Allowing each line to operate in isolation to preserve independence

Answer

Having internal audit perform second-line oversight functions

Answer

Delegating all risk decisions to the first line without challenge