Businesses and functions – the first line of defence: accountable for working to meet business objectives, including risk management, and for self-verifying the effectiveness of their own risk management.