Many firms use the “3 lines of defense” (3LOD) model to clarify responsibility for risk management but this approach has limitations, as three distinct “lines” do not always enable sufficient clarity, mindsets formed through deployment in one business can be difficult to break when...