Which ONE of the following is the correct combination of the three groups (or lines) that are involved in effective internal control and risk management.

A. Functions that own and manage risk; functions that exercise oversight over risk; and the compliance function.

B. Functions that own and manage risk; functions that exercise external operational risk management validation; and functions that provide independent assurance

C. Functions that own capital allocation or incentives; functions that exercise oversight over risk; and functions that provide independent assurance.

D. Functions that own and manage risk; functions that exercise oversight over risk; and functions that provide independent assurance.