Companies in industries that are heavily regulated may be subject to audits by the regulator’s auditors. While not specifically covered in the Three Lines of Defense model, such auditors would most likely be considered:
a. Part of the first line of defense.
b. Part of the second line of defense.
c. Part of the third line of defense.
d. Not a line of defense.