In our continuing quest to improve how companies manage risk, it’s inevitable we’d eventually discuss the “Three Lines of Defense,” a risk management model for clarifying roles and responsibilities.

Banks and their service providers have relied heavily on the prior guidance, originally a joint OCC-Fed issuance from 2011 that was later adopted by the FDIC in 2017, in developing and deploying ...