Three lines of defence
3LoDAlso called three lines model, three lines of defense
The three lines of defence is a governance model that splits responsibility for risk between three groups. Business units own and manage risks day to day. Risk management and compliance set frameworks and challenge the business. Internal audit gives independent assurance to the board that the first two lines work.
How it works
In a bank, a lending team is the first line. It runs controls, monitors key risk indicators and records incidents. The second line, risk and compliance, writes policy, sets risk appetite limits and tests whether the business stays within them. The third line, internal audit, reports to the audit committee and reviews both lines independently against a risk-based audit plan.
Supervisors use the model to judge whether a firm's governance is sound. Failures often come from blurred roles, such as compliance staff running first-line controls or audit lacking independence. The Institute of Internal Auditors updated its version in 2020 as the Three Lines Model, stressing collaboration and the governing body's oversight rather than separate defensive walls.
The rules
Sets out the roles of business lines, independent risk management and compliance, and internal audit within a bank's governance framework.
Banks and banking supervisorsRequire an internal control framework with independent risk management, compliance and internal audit functions with adequate authority and access to the management body.
EU credit institutions and investment firmsRecast the model around the governing body, management and independent internal audit; the IIA has since superseded it with a Statement of Position on the Three Lines Model.
Organisations applying IIA standardsCommon questions
Is the three lines of defence model a legal requirement?
No law names the model, but banking rules require separate, independent risk management, compliance and internal audit functions. Supervisors commonly assess governance against the three lines structure, so most banks and insurers use it.
Who sits in the second line of defence?
The second line usually includes risk management, compliance and sometimes specialist functions such as information security or model risk. It sets frameworks and policies, monitors the first line and reports risk exposures to senior management and the board.
What is the difference between the three lines of defence and the IIA Three Lines Model?
The 2020 IIA update keeps the same roles but drops the word defence. It places the governing body at the top and stresses that the lines work together to create and protect value, not only to block risks.
