What best describes the first line of defense in outsourcing risk management?

• A. Lines of business who utilize the outsourced services and has ownership of the risks the business unit will accept
• B. The board of directors
• C. The IT security operations team only
• D. External auditors

Answer: (A)

The first line of defense in outsourcing risk management is the lines of business that use the outsourced services and own the risks the business unit will accept. This reflects the day-to-day ownership of risk: these managers are closest to the process, vendor relationship, and operational controls, so they define risk tolerance, implement and monitor controls, and take corrective actions as needed. They are responsible for ensuring the outsourcing arrangement aligns with business objectives and contractual requirements.

The board provides governance and sets risk appetite at a high level, but does not manage day-to-day controls. The IT security operations team contributes security expertise and implements controls, but they don’t own the overall risk for the business unit. External auditors offer independent assessment and assurance, but operate outside the first line.