Three Lines Without Blame

For one active risk, write which team owns the risk, which function supports or monitors it, and who can independently assure it. Priya redrew the incident map: Product owned the process risk, Privacy provided second-line policy and monitoring, and Internal Audit independently tested whether the system worked. The fix became clearer because the lines described contribution, not status. works because it separates intent from proof. In governance, a decision is not healthy merely because senior people agreed with it; it is healthy when the organization can show who had authority, what risk was considered, what control will keep the promise…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in