A risk-governance model in which business units owning risk are the first line, independent risk management and compliance are the second, and internal audit providing independent assurance is the third.