Effective Risk Management and Control

Check out the IIA position paper on the three lines of defense. 
https://na.theiia.org/standards-guidance/recommended-guidance/Pages/The-Three-Lines-of-Defense-in-Effective-Risk-Management-and-Control.aspx