Three lines model

Doing the work, overseeing it, and independently assuring it are three different jobs that should not be held by the same people.

The model is frequently caricatured as bureaucracy, and the underlying point is sound: whoever built the control should not be the one certifying it works. Where a security team writes the policy, operates the controls and reports on its own compliance, nobody is checking anything.