The Managing Successful Programmes (MSP) framework explicitly adopts the 'three lines of defence' model as a method for structuring assurance roles and responsibilities. This model aligns with the levels of delegated authority within the programme. The first line consists of the project and delivery teams, the second line is the programme-level management and oversight functions (e.g., Programme Manager, Programme Office), and the third line is independent assurance, such as corporate internal audit. This structure ensures that there are appropriate checks and balances at each level of the programme organization, providing confidence to stakeholders that the programme is being managed effectively.

A. Change control: This is a specific process for managing modifications. The three lines of defence model provides assurance over the change control process, but it is not the process itself.

C. Risk prioritization: This is a component of the risk management process. The three lines of defence model assures that risk management, including prioritization, is being conducted properly.

D. Enterprise agility: This is a broad organizational capability. While effective programme governance and assurance contribute to agility, the three lines of defence model is a specific structure for assurance, not agility.

AXELOS. (2020). Managing Successful Programmes (MSP) 5th Edition. TSO (The Stationery Office).

Section 13.4, 'Assurance roles and responsibilities', Page 168: "The three lines of defence model is a useful way to structure assurance roles and responsibilities within the programme organization, in line with the levels of delegated authority."

Figure 13.3, 'The three lines of defence model for assurance', Page 169: This figure visually represents how the first, second, and third lines provide assurance across the programme's structure.