What is Three lines of defence?

The three lines of defence assign model risk to the model’s owners and users (first line: development and use), to an independent risk function (second line: validation and oversight) and to internal audit (third line: assurance that the framework works).