The Three Lines Model (formerly "three lines of defense") is a governance concept used in CRISC and other ISACA frameworks. Its primary objective is to clarify who does what in risk management:
* First line - operational management: owns and manages risk, operates controls.
* Second line - risk management/compliance: provides expertise, support, and monitoring for risk and controls.
* Third line - internal audit: provides independent assurance on the effectiveness of governance, risk management, and control.
CRISC-related notes on the three lines state that:
* The most significant benefit of using the three lines model is that it clarifies essential roles of key stakeholders.
* Risk owner is a risk management role that is part of the first line of defense.
* Establishing a risk management framework is a direct responsibility of the second line.
* Operational management is the function that manages risk according to the three lines model.
So the core of the model is role and responsibility clarity, which directly supports effective governance and accountability for risk.
Why the other options are incorrect:
* A. Oversight and monitoring are important outcomes, but they are consequences of properly defined roles rather than the model's primary objective.
* B. "Only employees are responsible" is false; accountability spans board, senior management, management, staff, and independent assurance.
* **D. Senior management does have key responsibilities, but the model explicitly distributes risk roles across multiple lines, not just senior management.
Therefore, the PRIMARY objective is correctly captured by C: providing clear delineation of roles and responsibilities for managing IT risk.