Which of the following activities is MOST likely to be assigned to the second line...

In the three lines model, thesecond lineprovides oversight and monitoring of risk and compliance. CRISC states that functions such as risk management, compliance monitoring, and policy oversight belong to the second line. Monitoring IT security policy compliance fits this role because it evaluates whether operational controls align with requirements. The first line (operations) configures systems like WAFs and calculates operational KRIs. The third line (internal audit) validates whether controls are functioning independently. Thus, the responsibility most aligned with the second line is monitoring compliance.