The second line of defense is a group of functions that provide oversight, guidance, and monitoring of the risk management activities of the first line of defense. The second line of defense includes risk management, compliance, and internal control departments. Their key responsibility is to monitor the effectiveness of the control activities implemented by the first line of defense, and to report any issues or gaps to senior management and the board. The second line of defense also supports the first line of defense by providing frameworks, policies, tools, and techniques to identify, measure, and manage risks. The other options are not the key responsibility of the second line of defense, as explained below:
* A. Implementing control activities is the responsibility of the first line of defense, which consists of the business units and process owners that own and manage the risks associated with their daily operations.
* C. Conducting control self-assessments is a technique used by the first line of defense to evaluate the design and operation of their own controls, and to identify and report any deficiencies or improvement opportunities.
* D. Owning risk scenarios is the responsibility of the first line of defense, which is accountable for the risks inherent in their business activities, and for developing and executing risk response strategies.
* References = Modernizing The Three Lines of Defense Model | Deloitte US, The second line of defence:
fit for purpose, not an uncomfortable fit | Knowledge | Linklaters, COSO's Take on the Three Lines of Defense | ERM - Enterprise Risk Management, Three Lines of Defense | Risk Management - Schneider Downs CPAs, What is the Three Lines of Defense Approach to Risk Management?

Section: Volume D

Section: Volume D

Control owners must be accountable for ensuring the effectiveness of the controls they manage. This accountability ensures the alignment of controls with risk objectives, as outlined in Control Governance and Ownership.

The most important characteristic of a key risk indicator (KRI) to enable decision-making is illustrating changes in risk trends, as it provides a clear and timely indication of the direction and magnitude of the risk level and exposure, and enables the stakeholders to take proactive and appropriate actions to address the risk.
The other options are not the most important characteristics, as they are more related to the monitoring, measurement, or identification of the risk, respectively, rather than the illustration of the risk trends. References = CRISC Review Manual, 7th Edition, page 110.