Billy Hughes (william.hughes@gartner.com) is a Senior Director, Advisory, and Dian Zhang (dian.zhang@gartner.com) is a Research Specialist at Gartner in Arlington, VA.

Countless compliance executives have asked themselves who actually “owns” compliance risks once they are identified.

Traditionally, assurance executives have used the “Three Lines of Defense” model when considering who should be involved in managing the risk and in what capacity. This model describes interactions between business units that manage risks (first line), departments that provide oversight (second), and groups that supply independent assurance (third). The second line is where Compliance gets involved by setting risk management strategy, monitoring its execution, and making cross-functional connections.