Three Lines of Defense

In any organization, many groups have a part to play in managing risk. Business managers run processes and own the risks in them. Risk, compliance and security teams set standards and check how risks are managed. Internal audit provides independent assurance to the board. Without a clear division of roles, these groups can duplicate each other's work, leave gaps or blur accountability. The three lines of defense model gives each group a defined role, so the board can see who owns risk, who oversees it and who independently checks that the system works. It is simple enough to explain in a single diagram, which partly explains its popularity.

The model became widely used in financial services after the 2008 financial crisis and was formalized by the Institute of Internal Auditors in a 2013 position paper. In 2020, the IIA updated it as the Three Lines Model, dropping the word defense to emphasize that risk management should also support value creation, and placing more emphasis on collaboration and the role of the governing body. Both names are still common. Many organizations still use the original name while applying the updated principles. For risk, compliance, audit and business leaders, the model is a simple way to clarify accountability for risk and control.

Definition of Three Lines of Defense

The three lines of defense is a governance model in which the first line, operational management, owns and manages risks; the second line, functions such as risk management and compliance, provides expertise, monitoring and challenge; and the third line, internal audit, provides independent assurance to the governing body.

It is often used to organize enterprise risk management, defines where compliance management sits and sets the independent role of internal audit.

The Three Lines

The first line is the business and operational management that delivers products and services. It owns risks, designs and runs controls and is accountable for managing risk day to day. Because it is closest to the work, it is usually best placed to spot risks early.

The second line includes risk management, compliance, information security, and sometimes finance and legal. It sets policies and frameworks, provides expertise, monitors risk and challenges the first line.

The third line is internal audit. It provides independent and objective assurance to the board and senior management on how well the first and second lines are managing risk.

The governing body, usually the board and its committees, oversees the whole system, sets expectations and receives reports from all three lines. External auditors and regulators provide further assurance from outside the organization.

The 2020 Three Lines Model

The IIA's 2020 update renamed the model and recast the lines as roles rather than rigid structures.

It describes management as holding both first and second line roles, recognizing that risk and compliance functions are part of management rather than separate from it.

It sets out six principles, including governance, the roles of the governing body, management and internal audit, the independence of internal audit, and creating and protecting value.

It emphasizes alignment and communication among the roles, rather than treating each line as a separate barrier. The update reflects criticism that the original model encouraged silos.

Importance of Three Lines of Defense in Risk and Compliance

The model clarifies accountability. Business managers cannot hand ownership of risk to the risk team, and oversight functions know their role is to support and challenge, not to run controls.

It supports effective oversight. The board receives views from management, from independent oversight functions and from internal audit, giving a more complete picture.

It also helps meet regulatory expectations. Regulators, particularly in banking and insurance, often expect firms to organize risk management along these lines.

Three Lines of Defense and Financial Management

Clear roles reduce duplicate work, such as several teams testing the same controls, which lowers the cost of assurance.

Coordinating assurance across the lines, sometimes called combined assurance, helps the board see where coverage is thin or overlapping.

Second line functions need adequate budgets and staff to provide meaningful challenge, which should be planned as part of the cost of risk management.

Placing control ownership in the first line keeps the cost of controls visible to the business managers who benefit from them.

Common Challenges

The lines can become silos, with each group working separately and little communication between them. Regular joint planning and shared reporting help counter this.

The first line may see risk as the second line's job and fail to take ownership.

In smaller organizations, there may not be enough people to keep the roles separate. These organizations can combine roles carefully, using outside providers for independent assurance where needed.