Which of the following is a second line of defense in effective risk management and control?