Three Lines Model

The Three Lines Model is a governance framework that sets out who in an organisation is responsible for managing risk, who oversees and challenges that work, and who gives independent assurance that it is being done properly. The first line is the management that runs the business and owns its risks; the second is the group of specialist functions, such as risk and compliance, that set standards and monitor; the third is internal audit. Above all three sits the governing body, usually the board of directors.

The model is published by the Institute of Internal Auditors (IIA) and is used across industries, but it is most deeply embedded in banking, insurance and payments, where supervisors expect firms to show a clear separation between risk-taking and risk control. It was known for many years as the "three lines of defence" and was reissued under its current name in 2020.

The 2020 version describes roles and not fixed departments:

• Governing body. The board is accountable to stakeholders, sets the organisation's direction and risk appetite, and oversees management. It usually works through committees such as the board risk committee and the board audit committee.
• First line roles. Business and operations managers deliver products and services to customers and are responsible for the risks that this creates. They design and operate day-to-day controls, such as payment approval limits or customer checks at onboarding.
• Second line roles. Functions including risk management, compliance, financial control and information security provide expertise, write policies, monitor exposures against limits and challenge first line decisions. In regulated firms the chief compliance officer and the chief risk officer normally lead these functions.
• Third line roles. Internal audit gives independent and objective assurance to the board on whether governance, risk management and controls are adequate and effective. Its independence rests on reporting to the board or audit committee and on having no responsibility for the activities it reviews.

External auditors, regulators and other outside bodies are described as external assurance providers. They are not a line within the organisation, although some commentators informally call them a fourth line.

The idea of three lines of defence developed in financial services during the 1990s and 2000s, and the IIA set it out formally in a position paper in 2013. Banking supervisors adopted the same language: the Basel Committee on Banking Supervision's corporate governance principles for banks describe business lines, an independent risk management and compliance function, and an independent internal audit function in these terms.

The 2008 financial crisis and later misconduct scandals led to criticism that the model was being applied as a purely defensive structure. The IIA's 2020 revision dropped the words "of defence", put more weight on the governing body, and stated that the lines should work together to create as well as protect value. It also accepted that first and second line roles may be blended or separated depending on an organisation's size, while insisting that the third line remain independent.

In a bank or payment institution the model shapes how specific risks are handled. For financial crime, front-line staff carry out customer checks, the compliance function sets policy and runs the compliance monitoring programme, and internal audit periodically tests the whole framework, often through an AML audit. For operational risk, business units record incidents and assess their own controls, while the risk function aggregates the results and reports against appetite.

Supervisors look for evidence that the second line can genuinely challenge the business, which requires adequate resources, direct access to the board and pay that does not depend on the revenue of the areas it oversees. Accountability regimes such as the United Kingdom's Senior Managers Regime reinforce the structure by assigning named individuals responsibility for each function.

The model has several recognised weaknesses. Clear lines on a chart do not guarantee clear responsibility in practice: first line managers may treat risk as the second line's job, while second line staff drawn into approving individual transactions lose the distance needed to challenge them. Many firms have added control teams inside business units, sometimes called line 1.5 or line 1b, which can blur the boundaries further. Multiple functions testing the same controls create duplicated work and assurance fatigue without necessarily finding problems earlier.

Reviews of bank failures and conduct scandals have repeatedly found that all three lines were in place on paper but that warnings were not escalated or acted on. Critics therefore argue that the model describes structure and says little about culture, incentives and the willingness of boards to listen, which is why it is usually applied together with work on compliance culture and segregation of duties.

• The Institute of Internal Auditors
• Basel Committee on Banking Supervision