Three Lines Model
The IIA's Three Lines Model clarifies roles and responsibilities for risk management and internal control across the organization.
The Three Lines Model
Overview
The Three Lines Model (formerly Three Lines of Defense) helps organizations identify structures and processes that best assist achievement of objectives and facilitate strong governance and risk management.
The Three Lines
First Line: Management
Role: Manage risk and maintain effective internal controls
Responsibilities:
- Owns and manages risk day-to-day
- Implements policies and procedures
- Ensures compliance with regulations
- Identifies and assesses risks in operations
- Reports on risk and control status
Second Line: Risk and Compliance Functions
Role: Provide expertise, support, monitoring, and challenge
Responsibilities:
- Develop risk management framework
- Provide guidance and training
- Monitor risk and control effectiveness
- Challenge first line assessments
- Report to governing body on risk
Examples: Risk Management, Compliance, Information Security
Third Line: Internal Audit
Role: Provide independent assurance
Responsibilities:
- Independent of management
- Assess effectiveness of governance and risk management
- Report directly to governing body
- Follow professional standards (IIA)
Key Principles
- Governance body accountability
- Management first-line roles
- Second-line assistance and monitoring
- Third-line independent assurance
- External assurance providers
- Coordination and communication
Enabling Effective Governance
- Clear mandates and authority
- Adequate resources
- Unfettered access
- Professional competence
- Organizational independence (for third line)
Common Pitfalls
- Blurred line responsibilities
- Second line doing first line work
- Insufficient third line independence
- Lack of coordination between lines