CORES Internal Audit & Three Lines of Defense

Question 1

In the Three Lines of Defense model, which line is primarily responsible for owning and managing operational risks on a day-to-day basis?

Accepted Answer

Business units and operational management

Answer

The first line of defense consists of business units and operational management who own the risks inherent in their activities and are responsible for implementing controls.

Question 2

Which of the following BEST describes the role of the second line of defense in the Three Lines of Defense model?

Accepted Answer

Overseeing and challenging the first line's risk management activities

Answer

The second line (risk management, compliance, legal) provides oversight, frameworks, and challenge to the first line without taking ownership of the risks themselves.

Question 3

What is the defining characteristic that distinguishes the third line of defense from the second line?

Accepted Answer

Organizational independence from management and risk-taking activities

Answer

Internal audit (third line) derives its value from organizational independence, reporting to the audit committee and board rather than to management functions it reviews.

Question 4

Under the IIA's Three Lines Model (2020 update), which body is positioned OUTSIDE the three lines and provides governing oversight?

Accepted Answer

Governing body (Board)

Answer

The 2020 IIA model places the governing body (board) outside and above the three lines, accountable to stakeholders and responsible for overseeing the entire governance structure.

Question 5

A bank's operational risk manager in the second line discovers a significant control weakness identified by a first-line business unit. What is the MOST appropriate immediate action?

Accepted Answer

Log the finding, require a remediation plan from the first line, and track progress

Answer

The second line's role is to challenge and oversee, requiring the first line to own remediation while the second line monitors and escalates if progress stalls.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Internal Audit & Three Lines of Defense