The first line of defense is the business line, which is responsible for identifying and managing risks associated with a product or process. The second line of defense is the risk management and oversight function, which is responsible for making sure the controls in place are sufficient and effective. Finally, the third line of defense is the audit function, which is responsible for monitoring and assessing the risks and controls, as well as providing assurance to the board of directors.