请问这道题怎么理解，解释一下

问题如下：

Bank Q implements an enterprise risk management (ERM) framework and the CRO decides to extend the three lines of defense approach to its ERM framework. Which of the following actions is least correct?

选项：

A.

The first line of defense has the authority to expose the organization to risks within the limits of the bank’s risk appetite.

B.

The second line of defense reviews, monitors, and tests the effectiveness of the ERM framework as part of continuous monitoring.

C.

The third line of defense is responsible for the independent evaluation of the design and effectiveness of risk management activities.

D.

The third line of defense should oversee the proper implementation of risk management in activities and decision-making in all parts of the organization.

解释：

考点：Enterprise Risk Management Structure

解析：D选项，描述的是第二道防线的职责，而非第三道防线，故不正确，当选。