According to the three lines of defense model, the responsibility for managing risk and controls resides with the operational management, which forms the first line of defense. The operational management is the function that owns and manages risk as part of their accountability for achieving objectives. They are responsible for identifying, assessing, mitigating, and reporting on risks and controls within their areas of operation. They are also responsible for implementing and maintaining effective internal controls and ensuring compliance with policies, standards, and regulations.
References:
*ISACA, Risk IT Framework, 2nd Edition, 2019, p. 741
*Internal audit: three lines of defence model explained2

According to the CRISC Review Manual1, data selection is the process of choosing the appropriate data sources and variables for data analysis. Data selection is the most critical step in data analytics, as it determines the quality and validity of the results and insights derived from the analysis. Incorrect data selection is the greatest risk associated with the use of data analytics, as it can lead to inaccurate, incomplete, irrelevant, or biased outcomes that can adversely affect the decision making and performance of the organization. Incorrect data selection can also cause legal, regulatory, ethical, or reputational issues for the organization, if the data used for analysis is not authorized, reliable, or compliant. References = CRISC Review Manual1, page 255.

Section: Volume D

B, and A are incorrect. These are not the valid answers for thisQUESTION NO: