Question 1
IntermediateCorporate Governance and the Audit Function · Roles and responsibilities of the third line of defense
During an AML audit of a mid-sized regional bank, the lead auditor discovers that the Compliance Department (Second Line of Defense) is actively performing daily alert adjudication for the Transaction Monitoring system due to recent staff shortages in the Financial Intelligence Unit (First Line). Which of the following observations represents the MOST critical governance concern the auditor should raise?
Answer and explanation
Correct answer: B
The Three Lines of Defense model relies on the separation of duties. The First Line owns and manages risk (operations), while the Second Line oversees and monitors risk (compliance). If Compliance performs operational tasks (alert adjudication), they cannot objectively monitor or test those same tasks, creating a fundamental governance failure.
