* Understanding The IIA's Three Lines Model:
* The Three Lines Model defines responsibilities for risk management and control across different organizational functions:
* First Line: Operational management (owns and manages risks).
* Second Line: Risk and compliance functions (monitors and facilitates risk management).
* Third Line: Internal audit (provides independent assurance).
* Why Third-Party and Supplier Assessments Are Shared Across All Three Lines:
* First Line (Operational Teams & IT Security): Ensures that vendors comply with security standards.
* Second Line (Risk & Compliance Teams): Conducts due diligence and ensures compliance with cybersecurity regulations.
* Third Line (Internal Audit): Independently evaluates supplier risk management processes.
* Why Other Options Are Less Relevant:
* B. Recruitment and retention of certified IT talent - Primarily a first-line management responsibility (HR and IT departments).
* C. Classification of data and design of access privileges - Typically a first-line IT security function, with oversight from the second line.
* D. Creation and maintenance of secure network configurations - Falls under first-line IT operations with oversight but not shared by all three lines.
* IIA's Three Lines Model (2020 Update): Emphasizes shared responsibilities in areas like third-party risk.
* IIA Practice Guide on Third-Party Risk Management: Internal audit must assess supplier security and compliance.
* COSO ERM Framework: Highlights vendor risk management as a cross-functional responsibility.
Relevant IIA References:# Final Answer: Assessments of third parties and suppliers (Option A).