Thefirst line of defenseincludesbusiness and operational managerswho own and manage risks directly. They implement controls as part of their day-to-day duties, making them the first to respond to risk.