The Three Lines of Defense model clarifies risk management roles and responsibilities. The first line consists of operational management and staff who own and manage risk on a day-to-day basis. They are responsible for implementing and maintaining effective internal controls. The second line (e.g., Risk Management, Compliance) provides oversight and expertise, setting policies and monitoring compliance. The third line (Internal Audit) provides independent and objective assurance to senior management and the board on the effectiveness of the first two lines. Therefore, the statement that the first line has primary ownership of managing risk is true.

(Based on inferred standard options)

A. The first line provides independent assurance: This is incorrect. Independent assurance is the primary role of the third line (Internal Audit).

B. The second line executes day-to-day risk mitigation: This is incorrect. The first line executes day-to-day risk management; the second line provides oversight and guidance.

D. The third line sets the organization's risk appetite: This is incorrect. The board and senior management set the risk appetite, often with guidance from the second line.

1. The Institute of Internal Auditors (IIA). (2020). The IIA’s Three Lines Model. p. 4, Principle 1 states that accountability to governing bodies for managing risk is part of the first line's role. Principle 3 clarifies the third line's independent assurance role.

2. Shared Assessments. (2021). Third Party Risk Management (TPRM) Governance. White Paper. This document discusses the importance of clear roles and responsibilities for TPRM, which aligns with the principles of the Three Lines of Defense model where business owners (first line) are accountable for vendor risks.