The Three Lines Model is the IIA’s framework for how governance, risk management and assurance fit together in an organization. It was published in July 2020 as a replacement for the Three Lines of Defense, and it makes one change that most organizations still have not absorbed: the lines are roles, not departments. First line roles deliver products and services and own the risks that come with them. Second line roles provide expertise, support, monitoring and challenge on risk, and remain part of management. Third line roles, meaning the internal audit function, provide independent assurance and advice to the governing body and to management. The governing body sits above all three and is accountable to stakeholders for oversight. A single person can hold first and second line roles on the same day; a compliance department can perform second line roles for some risks and first line roles for its own operations; and no department is “a line”.
This guide reads the position paper the way an internal auditor has to: the six principles and what each one requires, the four sets of key roles, the relationships the paper describes, what changed from the 2013 model and why the change matters, where the common functions sit, how small organizations blend roles without losing independence, how internal audit relies on second line work under the Global Internal Audit Standards, and how to draw an assurance map that uses the model instead of the diagram. It replaces the site’s short 2023 essay on the third line and complements the internal controls primer, which introduces the model from the control owner’s side.
In this guide
- What the Three Lines Model is
- The six principles
- The key roles, line by line
- Lines are roles, not departments
- What changed from Three Lines of Defense, and why
- Where compliance, risk, HR, IT security and finance sit
- Second line independence is not third line independence
- Blended roles in small organizations
- The model in regulated financial institutions
- How internal audit relies on second line work under GIAS
- The assurance map: using the model instead of the diagram
- The critics, and their point
- Eight failures the model is meant to prevent
- Template: a one-page roles statement
- Worked example: Lakeshore Bancorp redraws its assurance map
- Questions about the Three Lines Model
- Related guides
What the Three Lines Model is
The IIA’s position paper, “The IIA’s Three Lines Model: An Update of the Three Lines of Defense”, was issued in July 2020 after a 2019 exposure draft and was reissued with updated terminology in September 2024 to align its glossary with the Global Internal Audit Standards. It is a short document: an introduction, six principles, a description of key roles, a section on the relationships among them and a section on applying the model. It is explicitly principles-based and says it applies to all organizations and is optimized by adapting it to the organization’s objectives and circumstances.
The paper’s starting point is a chain of accountability. Stakeholders entrust oversight to a governing body. The governing body delegates resources and authority to management to achieve objectives, including managing risk. Both the governing body and management rely on the internal audit function for independent, objective assurance and advice. The governing body is ultimately accountable for governance, which is achieved through the actions and behaviors of the governing body, management and internal audit together. Everything in the model follows from that chain: the “lines” are the three kinds of contribution to governance that the chain requires.
| Element | Who | Contribution to governance | Accountable to |
|---|---|---|---|
| Governing body | The board, or the body authorized to give internal audit its mandate | Accountability to stakeholders for oversight through integrity, leadership and transparency | Stakeholders |
| First line roles | Management delivering products and services, including support functions | Actions, including managing risk, to achieve objectives through risk-based decision-making and the application of resources | The governing body, through management |
| Second line roles | Management providing complementary expertise, support, monitoring and challenge on risk | Part of management’s actions; assist with managing risk; report on the adequacy and effectiveness of risk management | Management, and in some structures also the governing body |
| Third line roles | The internal audit function (and sometimes other independent roles such as inspection or investigation) | Assurance and advice, independent of management, on the adequacy and effectiveness of governance and risk management | The governing body |
| External assurance providers | External auditors, regulators, certification bodies | Additional assurance to meet legislative or regulatory expectations or at the request of the governing body and management | Outside the organization |
The six principles
The model is stated as six principles. They are not numbered steps; they describe the structures, roles and relationships that have to exist for governance to work. The table gives each principle, what it requires and the practical test an auditor can apply.
| Principle | What it requires | The test |
|---|---|---|
| 1. Governance | Structures and processes that enable accountability by the governing body to stakeholders, actions (including managing risk) by management to achieve objectives, and assurance and advice by an independent internal audit function | Can the organization name who is accountable for oversight, who acts, and who provides independent assurance, and show that all three exist? |
| 2. Governing body roles | The governing body ensures appropriate structures and processes for effective governance; aligns objectives and activities with the prioritized interests of stakeholders; delegates responsibility and resources to management while ensuring legal, regulatory and ethical expectations are met; establishes and oversees an independent, objective and competent internal audit function | Does the board approve the internal audit charter, plan and resources, appoint the chief audit executive and receive reports directly? (GIAS Domain III turns this into requirements) |
| 3. Management and first and second line roles | Management’s responsibility to achieve objectives comprises both first and second line roles. First line roles are most directly aligned with delivery of products and services, including support functions. Second line roles assist with managing risk; they may be blended with or separated from first line roles, and may be assigned to specialists. Responsibility for managing risk stays with first line roles and within management | Can every risk owner be named, and is that person in a first line role rather than a risk or compliance specialist? |
| 4. Third line roles | Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management, through competent application of systematic and disciplined processes, expertise and insight; reports to management and the governing body; may consider assurance from other internal and external providers | Does the function’s plan cover governance and risk management, not only controls, and does it report to both management and the board? |
| 5. Third line independence | Independence from management responsibilities is critical to objectivity, authority and credibility; it is established through accountability to the governing body, unfettered access to people, resources and data, and freedom from bias or interference in planning and delivery | Does the CAE report functionally to the board, and has the function declined any management responsibility that would impair it? |
| 6. Creating and protecting value | All roles contribute to creating and protecting value when aligned with each other and with stakeholder interests, through communication, cooperation and collaboration; this ensures reliable, coherent and transparent information for risk-based decision-making | Is there a mechanism (an assurance map, a coordination meeting, a shared risk register) that aligns the work of the three lines rather than duplicating it? |
Two features of the principles are worth underlining. Principle 3 settles an old argument by stating that support functions such as HR, administration and building services hold first line roles, not second line roles: the first line includes “front of house” and “back office”. And Principle 6 is the one the 2013 model lacked entirely: it says the point of the structure is value, which includes creating it, not only defending it.
The key roles, line by line
The paper follows the principles with a list of key roles. These are the lists to use when writing a policy or an assurance map, because they are the IIA’s own words for what each role does.
| Role | Responsibilities in the position paper | Where the Global Internal Audit Standards pick it up |
|---|---|---|
| Governing body | Accepts accountability to stakeholders for oversight; engages with stakeholders; nurtures a culture of ethical behavior and accountability; establishes governance structures including committees; delegates responsibility and resources to management; determines risk appetite and oversees risk management including controls; oversees compliance with legal, regulatory and ethical expectations; establishes and oversees an independent, objective and competent internal audit function | Domain III essential conditions; Standards 6.1 to 8.4; Standard 9.4 (approving the plan); Standard 11.5 (accepted risks) |
| Management, first line roles | Leads and directs actions, including managing risk, and the application of resources; maintains continuous dialogue with the governing body and reports on planned, actual and expected outcomes and on risk; establishes and maintains structures and processes for managing operations and risk, including controls; ensures compliance with legal, regulatory and ethical expectations | The control owners and process owners every engagement deals with (control ownership) |
| Management, second line roles | Provides complementary expertise, support, monitoring and challenge on managing risk, including developing and improving risk management practices at process, system and entity level and the achievement of risk management objectives (compliance, controls, information and technology security, sustainability, quality assurance); provides analysis and reports on the adequacy and effectiveness of risk management including controls | Standard 9.5 (coordination and reliance); the second line’s reports are evidence internal audit may rely on, after assessing them |
| Internal audit function | Maintains primary accountability to the governing body and independence from management responsibilities; communicates independent and objective assurance and advice to management and the governing body on the adequacy and effectiveness of governance and risk management including controls; reports impairments to independence and objectivity to the governing body and implements safeguards | Domain I purpose; Standard 7.1; Standards 2.1 to 2.3; Standard 11.3 |
| External assurance providers | Provide additional assurance to satisfy legislative and regulatory expectations protecting stakeholders, and to satisfy requests by management and the governing body to complement internal sources of assurance | Standard 9.5 (coordination with external providers); Standard 11.3 (the board’s overall view) |
Lines are roles, not departments
The position paper’s first footnote carries the model’s most important idea. The language of first, second and third line was retained from the original for familiarity, but the lines “are not intended to denote structural elements but a useful differentiation in roles”. The numbering does not imply sequence; all roles operate concurrently. And the governing body’s roles logically constitute a line too, but the convention was not adopted to avoid confusion.
What this changes in practice is the question an auditor asks when mapping an organization. Under the old diagram the question was “which line is the compliance department in?” Under the model the question is “which roles does the compliance department perform, for which risks?” The answers differ:
- A compliance department that monitors the sales force’s adherence to conduct rules performs a second line role for conduct risk.
- The same department, when it files the organization’s regulatory returns, performs a first line role: it is delivering a service and owns the risk that the returns are wrong.
- A plant manager who runs production performs a first line role; when the same manager chairs the site safety committee that reviews near-miss reports across all shifts, the committee is performing a second line role.
- An internal audit function that is asked to run the enterprise risk management process has taken on a management responsibility and, for that activity, is no longer in a third line role; the paper says assurance over such activities must then come from a qualified third party.
The practical consequence is that a roles map is drawn risk by risk, not department by department. For each significant risk: who owns it (first line role), who monitors and challenges it (second line role), who provides independent assurance (third line role) and who provides external assurance. That map is the assurance map described later, and it is the document that makes the model operational.
What changed from Three Lines of Defense, and why
The Three Lines of Defense entered wide use through financial services in the 2000s, was described in a 2010 guidance paper by the Federation of European Risk Management Associations and the European Confederation of Institutes of Internal Auditing, and became an IIA position paper in January 2013. By 2019 the IIA judged that the defense framing had produced predictable problems: it cast risk management as purely protective, it encouraged organizations to treat the lines as departments and to argue about which box a function belonged in, it had nothing to say about the governing body, and it implied that the lines operated in sequence, with the third line as a last resort. The 2020 model addressed each.
| Feature | Three Lines of Defense (2013 position paper) | Three Lines Model (2020, reissued 2024) | Why it matters to an auditor |
|---|---|---|---|
| Framing | Defense: the lines exist to protect against risk | Value: creating and protecting value (Principle 6), with risk-based decision-making as the mechanism | Advisory work and foresight are legitimate third line outputs, not distractions from control testing (assurance vs advisory) |
| Structure | Lines drawn as organizational layers; functions assigned to a line | Lines are roles; functions and individuals can hold more than one; the map is drawn by risk | Stop auditing “the second line” as a department; audit the second line roles for each risk |
| Governing body | Shown above the lines with little said about its role | Named roles (Principle 2) including establishing and overseeing internal audit and determining risk appetite | Board effectiveness is auditable against stated roles; GIAS Domain III turned the same ideas into essential conditions |
| Sequence | Implied: first line acts, second line checks, third line catches what got through | Explicitly concurrent; numbering does not imply order | Internal audit is not the last chance to catch an error; it assures the system, not the transaction |
| Second line position | Often read as semi-independent oversight functions | Part of management, “never fully independent from management, regardless of reporting lines” | Second line reports are management’s assurance; internal audit relies on them only after assessing them (user access reviews are the classic case) |
| Support functions | Ambiguous; often placed in the second line | First line roles (footnote 2) | HR, IT operations and finance operations are auditable as risk owners, not as monitors |
| External assurance | Shown outside the lines | Named role with two purposes: legislative or regulatory expectations, and requests from the governing body and management | External assurance belongs on the assurance map and in the coordination required by Standard 9.5 |
| Terminology | Board, senior management, internal audit | Governing body, management, internal audit function; 2024 reissue aligns glossary terms to GIAS (“board”, “advisory services”) | Use the GIAS terms in charters and policies written after 2025 |
One historical correction is worth making because it appears in older material, including an earlier post on this site: the “three lines of defence” concept did not originate with the Basel Committee, and the UK’s Turnbull guidance on internal control (1999, revised 2005) was issued for the Combined Code by a working party of the Institute of Chartered Accountants in England and Wales and later maintained by the Financial Reporting Council. The Basel Committee’s role was to embed the three-lines vocabulary in its guidance on bank corporate governance and operational risk (the third-party risk and operational-risk principles both use it), which is why supervisors still speak the language.
Where compliance, risk, HR, IT security and finance sit
Because lines are roles, the honest answer to “where does function X sit?” is “it depends on which of its activities you mean”. The table gives the usual split for the functions that cause the most argument.
| Function | Activities that are first line roles | Activities that are second line roles | Activities that are never second line |
|---|---|---|---|
| Compliance | Filing regulatory returns; running the complaints process it owns; licensing administration | Setting compliance policy; monitoring and testing business adherence; advising on new products; reporting compliance risk to the board | Approving individual transactions on management’s behalf (that is a first line control the department now owns) |
| Risk management | Operating the risk system; producing the capital calculation it is responsible for | Designing the risk framework; facilitating the RCSA; aggregating and challenging risk reports; monitoring appetite | Owning a business risk (the business owns it; the risk function challenges) |
| Human resources | Recruiting, payroll input, performance processes, employee relations: delivering services and owning their risks | Monitoring the organization’s compliance with employment law; policy on conduct and culture | Nothing in a small organization; HR is mostly first line |
| IT and information security | IT operations, change management, running the security tools (first line: delivering a service) | The information security office setting policy, monitoring control effectiveness, reporting security risk (second line for information risk) | Granting its own privileged access without independent review (privileged access) |
| Finance | Close, reporting, treasury, accounts payable: first line throughout | Financial control or SOX teams that test controls operated by others (second line for financial reporting risk) | Testing its own controls and calling it independent assurance |
| Legal | Contract drafting, litigation management | Advising on legal risk; monitoring legal and regulatory developments | Providing assurance on the controls it designed |
| Quality assurance (manufacturing, healthcare) | Inspection as part of production | Quality systems oversight, audits of plants against the quality manual | Being treated as the third line; QA audits are management’s own assurance |
| Internal audit | None, by design; if the function runs ERM or compliance, that activity is first or second line and must be assured by someone else | None | Any management responsibility |
Second line independence is not third line independence
The paper draws a line that regulated firms sometimes blur. Second line roles may be given a degree of independence from first line roles, and even from the most senior levels of management, by establishing accountability and reporting lines to the governing body; the paper notes that in regulated financial institutions this is often a statutory requirement. But second line roles “are part of management’s responsibilities and are never fully independent from management, regardless of reporting lines and accountabilities”. A chief risk officer who reports to the board risk committee is still management. The defining characteristic of a third line role is independence from management, and that is what sets the internal audit function apart.
The distinction has three consequences for assurance. Management, including second line roles, provides assurance (the paper calls these attestations) on outcomes, risk and risk management, drawing on direct experience. Internal audit’s assurance “carries the highest degree of objectivity and confidence beyond that which those with first and second line roles can provide to the governing body, irrespective of reporting lines”. And internal audit protects that standing by not making decisions that are management’s, and by declining to provide assurance on activities for which it has current or recent responsibility. The Standards make the same point in Standard 2.3, which requires safeguards when an auditor’s objectivity is impaired, and in Standard 7.1 on organizational independence; the independence and objectivity guide works through the cases.
Blended roles in small organizations
A 300-person company does not have a compliance department, a risk function and a security office. It has a controller, an IT manager and a general counsel who each spend part of their week on second line activities. The model handles this explicitly: first and second line roles may be blended, and functions, teams and individuals may hold both. What the model does not permit is blending second and third line roles, because that removes independence.
| Situation | Acceptable under the model | Condition | Not acceptable |
|---|---|---|---|
| Controller runs the close and also tests SOX controls | Yes: first line (close) and second line (testing) blended in one person | The controller does not test controls the controller operates; someone else tests those | Calling the controller’s testing “independent assurance” to the board |
| One-person internal audit function also owns the risk register | No for the risk register: that is a management responsibility | If the board insists, assurance over ERM must come from a third party, and the charter must disclose the impairment | Reporting on the effectiveness of a process the auditor administers |
| General counsel chairs the compliance committee and monitors conduct | Yes: second line role for conduct risk | The counsel’s own legal operations are first line and are audited as such | Treating counsel’s monitoring as the third line for conduct |
| Outsourced internal audit reports to the CFO | Only administratively | The engagement letter names the audit committee as the functional reporting line (co-sourcing vs outsourcing) | The CFO approving the plan and editing reports |
| No internal audit function at all | Possible in very small organizations | The governing body must accept that it has no third line assurance and say so; external assurance partly substitutes | Pretending the external auditor’s financial statement audit is third line assurance over operations (internal vs external audit) |
The small-company internal audit guide describes how to set up the third line role in an organization that has never had one, and the first-90-days CAE plan covers negotiating the reporting line before the role is accepted.
The model in regulated financial institutions
Banks and insurers are where the three-lines vocabulary came from, and supervisors use it constantly. The Basel Committee’s 2015 corporate governance principles and its 2021 principles for the sound management of operational risk describe the risk management framework as implemented by the first line, reviewed and challenged by the second, and independently reviewed by the third. In the United States, the OCC’s heightened standards for large banks require an independent risk management function (second line) and an internal audit function (third line) with specified reporting lines; in the United Kingdom the senior managers regime assigns prescribed responsibilities to named individuals across all three. The OCC risk categories primer and the financial services guide cover the supervisory expectations.
Three things are specific to regulated firms. First, second line reporting lines to the board are often mandatory, which the model says is fully consistent with its principles but does not make the second line independent of management. Second, supervisors examine the second line’s challenge directly: an examiner will ask for evidence that the risk function pushed back on a business decision, and will write a finding if it never has. Third, internal audit is expected to audit the second line itself, including the risk framework, the compliance program and the model risk function, on a cycle; the model risk audit guide and the MRA lifecycle guide show what that looks like when the result is a supervisory finding.
How internal audit relies on second line work under GIAS
Principle 4 says the internal audit function may consider assurance from other internal and external providers. The Global Internal Audit Standards make the mechanics explicit in Standard 9.5, which requires the chief audit executive to coordinate with internal and external assurance providers and, when relying on their work, to assess the basis for that reliance. The practical sequence:
- Map the providers. For each significant risk, list who provides assurance: second line monitoring, quality assurance, external audit, regulators, certification bodies, SOC reports from service providers (SOC 1, SOC 2).
- Assess each provider. Independence from the activity assured, competence, the rigor of the method, the evidence retained, and whether the provider’s conclusions have held up when internal audit re-performed samples.
- Decide the degree of reliance. Full reliance (internal audit does not test the area and says so), partial reliance (internal audit tests the provider’s process and a sample of its results), or none.
- Disclose it. The plan and the board report say which areas are covered by reliance and on what basis, so the board understands where third line assurance is direct and where it is derived.
- Re-test periodically. Reliance decays; a provider that was rigorous three years ago may not be now.
The common failure is silent reliance: an area is left out of the plan because “compliance covers it”, without an assessment or a disclosure. Under the model that is a gap in the third line, and under Standard 9.4 it is a scope limitation the board was not told about.
The assurance map: using the model instead of the diagram
An assurance map is a table with risks down the side and roles across the top. It is the operational form of the Three Lines Model, and it does three things the diagram cannot: it shows gaps (risks with no second line monitoring and no third line coverage), it shows duplication (a risk tested by three functions in the same quarter) and it shows reliance (where internal audit’s coverage is derived from someone else’s work). The GRC framework guide includes a template; the minimum columns are below.
| Risk (from the register) | First line owner | Second line monitoring and challenge | Third line coverage | External assurance | Gap or duplication |
|---|---|---|---|---|---|
| Route cash diversion | Depot managers | None (no compliance function) | FY27 route cash audit, annual | External auditor, substantive only | No second line monitoring; internal audit is the only check between annual audits |
| Payroll accuracy | HR and payroll manager | Finance review of pay registers (monthly) | FY27 payroll analytics run; control audit FY28 | Payroll provider SOC 1 Type 2 | Adequate; reliance on the SOC 1 for provider controls after CUEC review |
| Cyber intrusion | IT manager | Managed security service reporting (from FY28) | Cyber program audit (540 hours, FY27) | None | Second line is a vendor; its challenge role needs defining |
| Regulatory licensing | Operations director | None | None | State regulator inspections | Gap: no internal assurance at all; add to FY28 plan |
The rows above are MidState Beverage’s, the distributor used across this site’s worked examples; it has no compliance function, which is why its second line column is mostly empty and why the function’s plan carries more direct testing than a bank’s would. The audit plan guide shows the full FY27 plan the map feeds.
The critics, and their point
The model has critics, and three of their arguments deserve an answer rather than a dismissal. The first is that any model built on “lines” invites silos: functions draw the boxes, defend their territory and leave the gaps between them to nobody. The 2020 update’s insistence that lines are roles, and Principle 6’s emphasis on alignment through communication, cooperation and collaboration, are the IIA’s response, and the assurance map is the practical one; a function that still draws departments has not applied the model, whatever it calls the diagram. The second is that the model is static and organizational, while risk in a platform business, a product-led technology company or an agile delivery organization moves faster than any role assignment. The answer is partly concession: the model describes who is accountable for what, not how fast they move, and it has nothing to say about continuous controls monitoring or embedded assurance except that someone in a first line role owns them. The third, from within the profession, is that the model understates how much assurance the second line actually provides and overstates the uniqueness of the third; in a bank with four hundred people in risk and compliance and forty in internal audit, the board’s confidence rests mostly on the second line. The model’s reply is in its oversight section: second line assurance is real and valuable, and it is management’s; the third line’s distinct contribution is independence, not volume. All three critiques are reasons to apply the model as a roles map with an honest reliance policy rather than as an organization chart, which is what the rest of this guide describes.
Eight failures the model is meant to prevent
| Failure | What it looks like | Principle breached | The fix |
|---|---|---|---|
| Risk ownership drifts to the second line | The risk function “owns” cyber risk; the business says risk is handling it | 3: responsibility for managing risk remains in first line roles | Name a first line owner for every risk in the register (risk register) |
| Second line assurance presented as independent | The board hears “compliance has tested this” and treats it as audit assurance | 5 and the applying-the-model section | Label second line reports as management’s assurance on the assurance map and in board papers |
| Internal audit takes a management role | The CAE runs ERM, or chairs the risk committee with a vote | 5 | Hand the role back or obtain third-party assurance over it and disclose the impairment |
| Lines treated as departments | Policy says “the second line consists of risk, compliance and legal” | Footnote 1: roles, not structures | Rewrite the policy as a roles map by risk |
| Sequential thinking | “Internal audit is the last line of defense” in the charter | Footnote 1: concurrent, not sequential | Describe internal audit as assurance over the system, delivered on a cycle |
| Governing body passive | The board receives the plan for information, not approval; the CAE’s pay is set by the CFO | 2 | Adopt the Domain III essential conditions in the board’s terms of reference |
| Duplication across lines | Three functions test user access in the same quarter; the business receives three request lists | 6: alignment through communication, cooperation, collaboration | Build the assurance map and a quarterly coordination meeting; rely where reliance is justified |
| Support functions in the wrong role | HR is treated as second line and never audited as a risk owner | 3 and footnote 2 | Add HR processes to the audit universe as first line activities (payroll audit) |
Template: a one-page roles statement
Organizations that want to adopt the model formally usually do it with a one-page statement in the risk management policy or the governance manual. The template below uses the IIA’s own terms and can be adopted by a board resolution.
Roles in governance, risk management and assurance. [Organization] adopts the IIA’s Three Lines Model as the basis for assigning roles in governance, risk management and assurance. The board is accountable to stakeholders for oversight; it determines risk appetite, approves the risk management framework, and establishes and oversees an independent internal audit function. Management is responsible for achieving the organization’s objectives, including managing risk. First line roles are held by those who deliver products and services and by the support functions that enable them; every risk in the corporate risk register has a named first line owner. Second line roles are held by [the risk management function, the compliance function, the information security office and the financial control team] for the risks assigned to them in the assurance map; they provide expertise, support, monitoring and challenge, and report to [the executive risk committee and the board risk committee]; they remain part of management. The internal audit function holds the third line role: it provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management, reports functionally to the audit committee and administratively to [the chief executive], and takes on no management responsibility. External assurance providers are shown on the assurance map. The assurance map is maintained by [the chief risk officer] with the chief audit executive, reviewed by the audit committee annually, and governs reliance between roles. Roles are assigned by risk, not by department, and a function or individual may hold first and second line roles; no one holds second and third line roles for the same risk.
Worked example: Lakeshore Bancorp redraws its assurance map
Lakeshore Bancorp is a $9 billion publicly traded regional bank holding company whose lead bank is a national bank supervised by the OCC. It has a 22-person internal audit function, a compliance department of about forty, a risk management function under a chief risk officer who reports to the board risk committee, and a SOX program with 212 key controls. Its governance manual, written in 2016, described the three lines of defense as departments: “the first line is the business units, the second line is Risk Management and Compliance, the third line is Internal Audit”. An external quality assessment in FY25 raised an observation: the assurance map listed functions, not roles, and three risks had no second line monitoring because the risk assigned to “Compliance” was actually a service Compliance delivered.
The chief audit executive and the chief risk officer rebuilt the map over one quarter. The register’s 58 top-level risks were each assigned a named first line owner at executive level; second line roles were assigned by risk rather than by function, which moved regulatory reporting and complaints handling from the second line column to the first line column with Compliance named as the owner, and exposed that nobody monitored the bank’s own licensing and registration obligations. Internal audit’s coverage column was filled from the three-year plan, which showed four risks with no third line coverage in the cycle, including vendor model risk, later addressed by the vendor model validation review. The external assurance column added the external auditor’s integrated audit, the OCC’s supervisory cycle and the SOC reports from the core provider. Reliance decisions were recorded for eleven risks where internal audit would rely on second line testing after re-performing a sample; the user access review was one, after internal audit found 14 terminated users still active in its own re-performance and reduced reliance to partial.
| Measure | Before (2016 manual) | After (FY26 assurance map) |
|---|---|---|
| Basis of the map | Departments assigned to lines | Roles assigned by risk, 58 risks |
| Risks with a named first line owner | 41 | 58 |
| Risks with no second line monitoring | Unknown (second line assumed to be “Risk and Compliance”) | 7 identified; 4 assigned, 3 accepted by the risk committee with rationale |
| Risks with no third line coverage in the three-year cycle | Unknown | 4 identified; 3 added to FY27, 1 covered by external assurance with reliance recorded |
| Reliance decisions documented | 0 | 11, each with the assessment Standard 9.5 requires |
| Duplication found | Not measured | User access and vendor due diligence tested by three functions; consolidated to one second line test plus internal audit re-performance |
| Board reporting | Three separate reports | One assurance map reviewed by the audit committee annually, with gaps and reliance shown |
The OCC’s next examination cited the map as evidence of effective coordination among the three lines. The cost was about 180 hours across the two functions, most of it in the owner-naming exercise, which produced the one finding the bank’s executives did not expect: that a risk everyone thought was managed had, in the model’s terms, no one acting in a first line role for it at all.
Questions about the Three Lines Model
Is the Three Lines Model mandatory?
No. It is an IIA position paper, not a standard. The Global Internal Audit Standards do not require organizations to adopt it, although the Standards’ requirements on independence, board oversight and coordination with other assurance providers are consistent with it. Regulators in financial services often expect a three-lines structure in substance.
Which line is the board?
None of them, by convention. The paper says the governing body’s roles logically constitute a line but the convention was not adopted to avoid confusion. The board sits above the three lines, accountable to stakeholders, and its roles are described in Principle 2.
Can a chief risk officer who reports to the board be considered independent?
Independent of the first line, to a degree, yes; independent of management, no. The paper is explicit that second line roles are part of management and are never fully independent from it regardless of reporting lines. Only the third line is independent of management.
Is “three lines of defense” still an acceptable term?
It is still widely used, especially by regulators, and people will understand it. For policies written after 2020 the IIA’s term is the Three Lines Model, and the value-based framing matters: a document that calls internal audit “the last line of defense” is describing the 2013 model, not the current one.
Where do external auditors sit?
Outside the three lines, as external assurance providers. Their assurance is additional to the organization’s own, serves legislative and regulatory expectations or specific requests from the governing body, and belongs on the assurance map so that the board sees the whole picture.
What should internal audit do if it is asked to run enterprise risk management?
Explain that the activity is a management responsibility and would remove the function’s independence over ERM; if the board still wants it, document the impairment in the charter, obtain assurance over ERM from a qualified third party, and plan to hand the role back. The paper addresses this case directly.
How is the model tested on the CIA exam?
Part 1 of the 2025 syllabus covers governance and the roles of the three lines, including the distinction between management’s first and second line roles and internal audit’s third line role, and the requirement that internal audit not assume management responsibilities. The CIA exam guide and the flashcards cover the terms.
Related guides
- Internal controls: what they are, who tests them, and how — the model from the control owner’s side.
- GIAS Domain III: Governing the Internal Audit Function — the board’s roles turned into essential conditions.
- Independence and objectivity in internal audit — the third line’s defining characteristic, case by case.
- Assurance vs advisory — the two third line services.
- Building a GRC framework — the assurance map template and the RACI.
- Control ownership — naming first line owners.
- How to run an RCSA — a second line process internal audit relies on.
- User access reviews — the classic reliance decision.
- Internal audit vs compliance — the second and third line roles compared.
- Setting up an internal audit function in a small company — creating the third line.
- Co-sourcing vs outsourcing — keeping independence when the third line is external.
- OCC risk categories — the supervisory vocabulary the model grew up in.
- Model risk audit — auditing a second line function.
- How to build an internal audit plan — the plan the assurance map feeds.
- The risk register — where first line owners are named.
- Internal audit vs external audit — external assurance providers explained.
- GIAS Domain I: the purpose of internal auditing — the Standards’ statement of what the function is for.
- The audit committee charter — a clause-by-clause template.
- How to audit operational risk management — the framework audit, test by test.
- Assurance Mapping: A Worked Example, Blank Page to Board — mapping who assures what across the lines to find gaps and overlaps
- Auditing the ERM Program: Criteria, Maturity, Independence — criteria, maturity and the independence trap when auditing the second line
- Internal Audit vs SOX vs Compliance vs ERM: Who Does What — the four functions separated by mandate, reporting line and output
Leave a Reply