The IIA's Three Lines Model: An Update of the Three Lines of Defense (2020, updated September 2024)

Why it Matters

The original Three Lines of Defense was widely used but often read as a rigid org chart focused only on protecting value. The 2020 update takes a principles-based view, broadens the scope to creating value as well as protecting it, and explains how the roles work together, which is why banking supervisors, GRC standards, and audit committees now cite it.

Key benefits include:

• Clarify roles and accountability

State who is accountable for governance, who manages risk, and who provides independent assurance, and how they interact.

• Strengthen governance

Give the governing body a clear basis for oversight, delegation to management, and reliance on internal audit.

• Protect internal audit independence

Position the internal audit function with organizational independence from management so its assurance is objective.

• Align assurance across providers

Coordinate first and second line monitoring, internal audit, and external assurance so coverage is complete without duplication.

• Connect risk management to value

Treat risk management as a contribution to achieving objectives and creating value, not only as defense.

How it Works

The paper sets out six principles: governance requires appropriate structures and processes; the governing body ensures those structures exist and sets objectives and risk appetite; management's responsibility for objectives comprises first line roles that deliver products and services and second line roles that assist with managing risk; the internal audit function provides independent and objective assurance and advice on governance and risk management; third line independence from management is essential; and all roles together create and protect value when they are aligned with each other and with the prioritized interests of stakeholders.

Organizations implement the model by documenting the governing body's oversight arrangements, assigning first and second line roles within management, which may be blended or separated, establishing an internal audit function with direct reporting to the governing body, and defining how the lines communicate, cooperate, and collaborate. Regulated firms often map their risk, compliance, and audit charters to the model and use it in board reporting.

SmartSuite supports the model by recording the roles, charters, and responsibilities of each line, linking first and second line controls and monitoring to the risks they address, and tracking internal audit plans, findings, and management actions in one system with reporting to the audit committee.

Key Elements

• Principle 1: Governance

Accountability by a governing body to stakeholders, actions by management to achieve objectives, and assurance and advice by an independent internal audit function.

• Principle 2: Governing body roles

The governing body ensures appropriate structures and processes are in place and that organizational objectives and activities align with the prioritized interests of stakeholders.

• Principle 3: Management and first and second line roles

First line roles deliver products and services to clients; second line roles assist with managing risk; the two may be blended or separated.

• Principle 4: Third line roles

The internal audit function provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management.

• Principle 5: Third line independence

Internal audit's independence from management is critical to its objectivity, authority, and credibility.

• Principle 6: Creating and protecting value

All roles working together contribute to the creation and protection of value when they are aligned through communication, cooperation, and collaboration.

• External assurance providers

External providers add assurance to satisfy legislative and regulatory expectations and requests from management and the governing body.

Framework Scope

The model applies to all organizations, regardless of size, sector, or ownership, and covers the governing body, management in its first and second line roles, the internal audit function, and external assurance providers. It is used in charters, board and audit committee reporting, regulatory expectations for banks and insurers, and as the assurance backbone of GRC programs.

Framework Objectives

The IIA published the model so that organizations can identify the structures and processes that best support the achievement of objectives and strong governance and risk management.

Clarify and strengthen the principles that underpin the three lines.

Broaden the scope from defense alone to creating and protecting value.

Explain how the governing body, management, and internal audit work together.

Establish the independence of the internal audit function from management.

Enable a principles-based application adapted to each organization's objectives and circumstances.

Align the model's terminology with the Global Internal Audit Standards.

Framework in Context

The Three Lines Model is referenced by the Basel Committee's operational risk principles, by prudential regimes such as APRA CPS 230, by COSO's internal control and ERM frameworks, and by the OCEG Red Book, and it complements the Global Internal Audit Standards that govern the third line. Compliance program benchmarks such as USSG §8B2.1 and the DOJ's Evaluation of Corporate Compliance Programs rely on the same separation of operational, oversight, and independent assurance roles.

Common Framework Mappings

Organizations map the model's roles and principles to the governance, risk, and control frameworks they already use so that lines of responsibility are consistent across the program.

Mapped frameworks include:

COSO IC 2013

COSO ERM 2017

ISO 31000:2018

BCBS PSMOR 2021

BCBS Operational Resilience Principles

APRA CPS 230

OCEG Red Book 3.5

USSG §8B2.1

DOJ ECCP

SOX

COBIT 2019

Global Internal Audit Standards