The three lines of defence is a risk governance framework that splits responsibility for operational risk management across three functions. Individuals in the first line own and manage risk directly.