Three lines model

What it means

The three lines model, originally the three lines of defence, is a framework for dividing responsibilities in risk management and internal control. It is promoted by the Institute of Internal Auditors and used in banks, insurers and larger companies. Its aim is to make clear who owns risks, who oversees them and who independently verifies that the system works.

The first line consists of operational units and their managers, who create and manage risks in daily work: they set up processes, approve transactions and apply segregation of duties. The second line comprises functions such as risk management, compliance, controlling or information security, which set rules, provide methodology and monitor whether the first line acts correctly.

The third line is internal audit, which independently assesses whether the first two lines work effectively. It reports directly to senior management and oversight bodies, such as the audit committee or the supervisory board. External auditors and regulators sit outside the organisation and are sometimes described as an additional line.

How it works in practice

A smaller company need not build separate departments for each line. The principle still applies: whoever carries out transactions should not check them alone, and someone independent should occasionally verify that the rules really work. The second line may be the finance director or an external adviser, the third an external review or internal audit bought in.

When introducing the model we recommend mapping the company's main risks and, for each, setting who owns it in the first line, who sets rules and monitors indicators in the second, and how often the third line reviews it. The result is a clear responsibility matrix that prevents risks being left with nobody in charge.

The updated 2020 model puts less emphasis on defence and more on collaboration. The lines should not work as separate silos but communicate and share information. Management and oversight bodies are responsible for ensuring the framework as a whole fits the company's size and risks.

What to watch out for

A common mistake is overlapping and confused roles. If the second line starts taking first-line decisions itself, it loses independence and accountability blurs. Likewise, internal audit that designs and implements processes cannot later assess them independently. Each line needs a clearly defined role.

The model does not work if management treats it as a formality. Second and third line reports must lead to decisions and corrective actions whose completion is tracked. If findings repeat year after year without change, the system does not protect the company but merely creates a paper trail.