In our continuing quest to improve how companies manage risk, it’s inevitable we’d eventually discuss the “Three Lines of Defense,” a risk management model for clarifying roles and responsibilities.