- ClassificationCategoryGovernance and AssuranceDomainRisk ManagementFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentPosition PaperSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailGlobal (The IIA)PublisherThe Institute of Internal Auditors (IIA)
- VersioningVersionStatement of Position, 2026 (replaces the 2020 Position Paper, updated September 2024)Effective DateJuly 8, 2026Issue DateJuly 8, 2026
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
The Statement of Position is a copyrighted publication of The IIA, available to download from theiia.org. SmartSuite does not redistribute its text.
Framework text is licensed by its publisher and is included only where stated above.
- The IIA's Three Lines Model Statement of Position sets out how the board, management, and internal audit share assurance and advice.
- Published July 8, 2026, it replaces the 2020 Position Paper and is principles-based rather than a prescribed structure.
- Management is the first line, specialized support roles the second, and the internal audit function the third.
- The 2026 update sets out five principles and adds guidance for organizations without separate assurance functions.
- SmartSuite Internal Audit Management keeps each line's roles, the chief audit executive's remit, and the assurance map in linked records.
Overview
The IIA's Three Lines Model is The Institute of Internal Auditors' statement of how a board, management and the internal audit function share assurance and advice for governance, risk management, compliance and control. The current text is the Statement of Position Assurance and Advice in Support of Effective Governance: Three Lines Model, published on July 8, 2026. It replaces the 2020 Position Paper (updated September 2024), is addressed mainly to boards, senior management and chief audit executives, and is principles-based rather than a prescribed structure.
The IIA's Global Board of Directors issues Statements of Position. They are not part of the International Professional Practices Framework, because they are written for an executive audience. The 2026 update keeps the model's core structure but sets out five principles (the 2020 paper had six), gives independence, assurance and advice, and coordination and reliance their own sections, and adds guidance for organizations that are not required to maintain separate assurance functions.
Organizations apply it by treating management as the first line, specialized support roles as the second line and the internal audit function as the third line, then deciding how the board gets assurance from each. Part II covers practical cases, such as the chief audit executive supervising a second-line function, and the safeguards the board should require.
Why does it matter?
Boards cannot see every operational detail, so they depend on the lines for reliable, balanced information. The Statement treats assurance and advice as complementary, and says independence is what makes assurance credible but must not turn into isolation. For organizations where roles overlap, it lists the safeguards that keep internal audit objective.
Key benefits include:
- Clear accountability
The board and senior management establish accountability by defining roles and responsibilities (principle 3). Outsourcing an activity does not change its line or the board's accountability for it.
- Assurance kept apart from advice
Assurance confirms whether governance, risk management, compliance and control processes are adequate and effective. Advice points to emerging issues and improvements. Both are delivered across the lines, with safeguards that vary by line.
- A defined meaning of independence
The Statement lists five essentials: reporting lines and authority, autonomy over scope and planning, unrestricted access, control over resources, and protection from retaliation or undue influence.
- Less duplication and fewer gaps
Coordination and reliance, subject to board oversight, reduce overlap and assurance fatigue. An assurance map, shared risk taxonomies or aligned reporting can support them.
- Overlaps handled openly
Where internal audit performs second-line work, or the chief audit executive supervises another function, the Statement names the self-review threat and lists safeguards: documented responsibilities, independent review and board approval.
How does it work?
The model has three lines inside the organization. First-line management owns day-to-day risk and designs, implements and operates processes and controls. Second-line roles give specialized expertise, advice, challenge, monitoring and thematic reviews in areas such as compliance, cybersecurity, safety, financial crime and operational risk, and report to senior management or a board-level committee. The third line, the internal audit function, gives independent and objective assurance and advisory insights, reports functionally to the board and does not take on management responsibility.
The board sits above the lines. It sets purpose, risk appetite and expectations, oversees strategic objectives, and decides whether to establish, expand or combine the lines. Its decision depends on the strategic importance of certain risks, the complexity and scale of operations, regulatory and stakeholder expectations, and the need for independent assurance. External audit and regulatory inspections sit outside the three lines and serve external parties.
Internal audit also acts as the integrator of assurance. Because it reports functionally to the board and sees across the organization, it can facilitate coordination and consolidation while avoiding ownership of second-line activities. Its independence also lets it choose not to rely on other providers when their work does not meet its quality expectations.
Key Elements
- Five principles (Part I)
Boards set purpose, risk appetite and expectations. Oversight needs reliable, balanced information. The board and senior management define roles and accountability. Distinct sources of assurance, including an independent one, give confidence. Advisory services complement assurance.
- Independence and safeguards
Beyond the five essentials, safeguards include a transparent allocation of responsibilities, independent review where self-review risk arises, explicit board approval of expanded remits and timely communication of threats to objectivity.
- Assurance and advice
A period of at least 12 months between responsibility for a process or decision and providing assurance on it is typically sufficient to safeguard the reviewer's objectivity. Advisory engagements need defined roles and no management decisions by the advisor.
- Role comparison tables
Compare each line's core roles, strengths, limitations, and independence and objectivity, including that the first line is not independent by design and the third line reports functionally to the board.
- Coordination and reliance
Integrated assurance is described as a more mature form of coordination, not a structural requirement. The internal audit function may support it without owning second-line activities.
- Implementation scenarios
Overlaps are not inherently a problem, though regulation may prohibit them. Each needs documented safeguards, such as board approval of the chief audit executive's remit.
- Glossary
Defines advice, assurance, assurance map, audit committee, board, chief audit executive, compliance, control, governance, risk appetite, risk management and stakeholder, mostly adapted from the Global Internal Audit Standards glossary.
What does it cover?
The principles apply to all organizations, whatever their size or structure, but how governance, risk management, compliance and control are implemented is specific to each one. The Statement is addressed primarily to board members, senior management and chief audit executives. In highly regulated environments, laws may restrict or prohibit some of the arrangements it describes, and the board decides how many lines the organization needs.
What are its objectives?
The Statement is meant to help boards align assurance and advice so that oversight stays reliable, independent and proportionate. Its stated purposes are to:
Describe the roles, responsibilities and relationships among the board, management, internal audit and other parties.
Recognize decision-makers' need for reliable and balanced information.
Recognize that organizations choose structures and processes based on external and internal factors.
Emphasize how coordinated risk management, assurance and advice help achieve objectives, create and protect value and promote trust.
Give practical guidance on overlapping roles and the safeguards that protect internal audit objectivity.
Framework in Context
The Statement replaces the 2020 Position Paper, which The IIA updated in September 2024 to reflect the Global Internal Audit Standards glossary. Its own glossary is mainly adapted from that one. It was issued on July 8, 2026 together with a Statement of Position on the Role of the Internal Audit Function in Enterprise Risk Management. Because Statements of Position are outside the International Professional Practices Framework, the Global Internal Audit Standards remain the mandatory requirements for internal auditors.
Common Framework Mappings
Organizations map the model's roles and principles to the governance, risk, and control frameworks they already use so that lines of responsibility are consistent across the program.
Mapped frameworks include:
COSO IC 2013
COSO ERM 2017
ISO 31000:2018
BCBS PSMOR 2021
BCBS Operational Resilience Principles
APRA CPS 230
OCEG Red Book 3.5
USSG §8B2.1
DOJ ECCP
SOX
COBIT 2019
IIA Global Internal Audit Standards
How SmartSuite Supports IIA Three Lines Model
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Internal Audit Management to keep each line's roles, the board-approved remit of the chief audit executive and the assurance map in linked records, so the board can see who owns a risk, who monitors it and who assesses it independently.
Line Roles and Accountability Register
Record first-line owners, second-line specialized roles and the internal audit function for each process, with the responsibilities the board and senior management have defined (principle 3).
Independence Essentials Tracker
Track the five essentials for the internal audit function: reporting lines, autonomy over scope and planning, unrestricted access, resources, and protection from retaliation.
Assurance Map
Link each risk to the assurance provided by management monitoring, second-line roles, internal audit and external providers, so gaps and duplication are visible.
Overlap and Safeguards Log
Document each case where internal audit performs second-line work or the chief audit executive supervises another function, with the justification, safeguards and board approval.
Advisory and Assurance Separation
Record advisory engagements and who held responsibility for a process, so the typical 12-month gap before assurance work can be checked.
Board and Audit Committee Reporting
Report assurance coverage, open findings and any objectivity concerns to the board and audit committee from the same records, with dashboards and Activity History.
Related frameworks
COSO Internal Control (2013) defines five components and 17 principles of internal control. Public companies commonly use it as the ICFR framework for SOX section 404.
COSO ERM (2017) sets five components and 20 principles for integrating risk management with strategy and performance. It is voluntary guidance from COSO, not a regulation.
ISO 31000:2018 gives guidelines on managing risk through eight principles, a framework and a process for any organization. It is not certifiable. ISO published it on February 14, 2018.
The Basel Committee's seven Principles for Operational Resilience set the international baseline for how banks deliver critical operations through disruption.
APRA CPS 230 requires banks, insurers and super funds to manage operational risk, keep critical operations within board-approved tolerance levels and oversee material service providers.
The Sarbanes-Oxley Act of 2002 (Public Law 107-204) requires SEC-reporting companies to certify reports, assess internal control over financial reporting and use PCAOB-registered auditors.
Frequently Asked Questions For IIA Three Lines Model
It is the Statement of Position Assurance and Advice in Support of Effective Governance: Three Lines Model, published by The IIA on July 8, 2026. It describes how management (first line), specialized support roles (second line) and the internal audit function (third line) provide assurance and advice to the board.
The Statement replaces the 2020 paper, which had six principles. The core structure stays, but the 2026 text has five principles, separate sections on independence, assurance and advice, and coordination and reliance, and application guidance for organizations without separate assurance functions. It is aimed mainly at boards.
Boards set purpose, risk appetite and expectations and oversee strategy. Effective oversight needs reliable, balanced information. The board and senior management define roles and accountability. Distinct sources of assurance, including an independent one, give the board confidence. Advisory services complement assurance.
Yes, for practical reasons such as limited capacity, but the Statement requires safeguards. These include documented allocation of responsibilities, periodic independent review of the area, board approval of the chief audit executive's remit and open communication of objectivity risks. Some regulated sectors prohibit the arrangement.
The Statement is principles-based and does not prescribe an organizational structure, and Statements of Position sit outside the IPPF. Laws and regulations may still specify roles for some organizations. Internal auditors remain bound by the Global Internal Audit Standards, which are mandatory.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.