TheThree Lines Model(formerly “three lines of defense”) is a governance concept used in CRISC and other ISACA frameworks. Itsprimary objectiveis to clarifywho does whatin risk management:

First line– operational management: owns and manages risk, operates controls.

Second line– risk management/compliance: provides expertise, support, and monitoring for risk and controls.

Third line– internal audit: provides independent assurance on the effectiveness of governance, risk management, and control.

CRISC-related notes on the three lines state that:

The most significant benefit of using the three lines model is that it clarifies essential roles of key stakeholders.

Risk owner is a risk management role that is part of the first line of defense.

Establishing a risk management framework is a direct responsibility of the second line.

Operational management is the function that manages risk according to the three lines model.

So thecoreof the model isrole and responsibility clarity, which directly supports effective governance and accountability for risk.

Why the other options are incorrect:

A. Oversight and monitoringare important outcomes, but they areconsequencesof properly defined roles rather than the model’s primary objective.

B. “Only employees are responsible”is false; accountability spans board, senior management, management, staff, and independent assurance.

**D. Senior management does have key responsibilities, but the model explicitly distributes risk roles across multiple lines, not just senior management.

Therefore, the PRIMARY objective is correctly captured byC: providing clear delineation of roles and responsibilities for managing IT risk.