An organisation onboards a vendor who has access to sensitive customer data without completing a security review. The business team believes the risk function should have identified the issue. The risk team says vendor selection is the business team’s responsibility. Meanwhile, internal audit points out that it had already highlighted weaknesses in vendor controls during an earlier review.

This situation highlights a common risk management problem. Different teams have responsibilities, but ownership and accountability are not always clear.

The Three Lines of Defence Model helps address this challenge. It defines how an organisation manages risk, provides oversight, and conducts independent reviews. It also helps ensure that risks are identified and addressed before they affect business operations.

Key Takeaways

• The first line owns and manages risks through daily business activities.
• The second line provides risk oversight, policies, monitoring, and guidance.
• The third line offers independent assurance through internal audit.
• The IIA updated the model in 2020, placing greater emphasis on collaboration and value creation.
• Clear responsibilities help organisations improve governance, risk management, and compliance.

Where Does the Three Lines Model Come From?

The three lines concept gained popularity in financial services. In 2013, the Institute of Internal Auditors (IIA) published its position paper on the Three Lines of Defence Model in effective risk management and control. Banks, insurance companies, and other large organisations gradually adopted it as a standard approach to managing risk.

However, the original model received criticism for being too rigid. It presented the three lines as separate layers of defence and did not give enough attention to the board’s role or the importance of collaboration.

In July 2020, the IIA introduced an updated version called the Three Lines Model. It removed the word “defence” and placed greater emphasis on governance, accountability, collaboration, and value creation.

Although the updated model has a different name, many organisations still use the term Three Lines of Defence. Both refer to the same basic approach to defining risk management responsibilities.

The Three Lines of Defence Framework Explained

The three lines of defence framework divides risk management responsibilities into three main roles. Each line has a different purpose, but all three work toward the same goal: protecting the organisation and supporting its objectives.

The Governing Body

The board and its committees oversee the organisation’s governance and risk management activities. They set the risk appetite, establish accountability, and ensure that appropriate resources and processes are available.

Understanding risk appetite and risk tolerance helps the governing body define how much risk the organisation is willing to accept.

First Line: Risk Ownership and Management

The first line includes business units and operational teams responsible for daily activities. These teams identify, assess, and manage risks arising from their processes.

Their responsibilities include:

• Identifying and managing operational risks.
• Designing and implementing internal controls.
• Monitoring business activities and control performance.
• Reporting incidents and emerging risks.
• Conducting risk and control self-assessments.

For example, an IT team manages system access, applies security patches, and maintains infrastructure security.

Second Line: Risk Oversight and Compliance

The second line includes functions such as enterprise risk management, compliance, information security risk, and legal teams.

These functions develop policies, establish risk management frameworks, monitor compliance, and guide business teams. They also challenge the first line when controls are ineffective or risks are not managed properly.

However, the second line does not take ownership of risks from business teams. Its role is to provide oversight and support.

Third Line: Independent Assurance

The third line consists of the internal audit function. It independently evaluates whether governance, risk management, and internal controls are working effectively.

Its responsibilities include:

• Reviewing the effectiveness of internal controls.
• Assessing risk management processes.
• Identifying control weaknesses and gaps.
• Reporting audit findings to the board or audit committee.
• Recommending improvements.

Internal audit must remain independent of the activities it reviews. External auditors, regulators, and certification bodies also provide assurance, but they operate outside the three lines model.

Risk Management Roles and Responsibilities by Line

Clear risk management roles and responsibilities help prevent confusion between business teams, risk functions, and internal auditors.

Responsibility	First Line	Second Line	Third Line
Typical functions	Business units, operations, IT, product teams	Risk management, compliance, information security, legal	Internal audit
Main responsibility	Owns and manages risks	Provides oversight and guidance	Provides independent assurance
Control design	Designs and implements controls	Sets standards and advises	Reviews control effectiveness
Control operation	Operates daily controls	Monitors and oversees	Does not operate controls
Risk monitoring	Monitors operational risks	Conducts ongoing risk monitoring	Performs independent reviews
Reporting	Senior management	Senior management and board access	Board or audit committee

The first line cannot transfer its risk ownership to the second line. Similarly, internal audit should not design or operate the controls it reviews, as this can affect its independence.

Three Lines of Defence Examples

The model becomes easier to understand when applied to real business situations. The following three lines of defence examples show how responsibilities are divided across different industries.

Example 1: Loan Fraud in a Bank

• First line: The lending team verifies customer identity, checks income documents, follows credit policies, and identifies suspicious loan applications.
• Second line: The fraud risk team defines fraud indicators, monitors unusual transactions, and reviews lending practices to identify potential risks.
• Third line: Internal audit reviews loan approvals, tests fraud controls, and reports weaknesses to the audit committee.

Example 2: Third-Party Risk in a Fintech Company

• First line: The procurement team and vendor relationship owner collect security documents, review contractual requirements, and manage the vendor relationship.
• Second line: The risk or compliance team sets vendor risk policies, classifies vendors by risk, and monitors high-risk relationships. A structured approach to third-party risk management in BFSI helps organisations manage these responsibilities.
• Third line: Internal audit checks whether vendor assessments are completed, policies are followed, and identified issues are addressed.

Example 3: Cloud Security in a SaaS Company

• First line: Engineering and DevOps teams manage cloud configurations, user access, system updates, and vulnerability fixes.
• Second line: The information security risk team establishes cloud security standards, maintains the risk register, and monitors control effectiveness. It may also arrange independent testing such as Vulnerability Assessment and Penetration Testing.
• Third line: Internal audit reviews the cloud security programme, evaluates governance processes, and checks whether risk acceptance follows approved policies.

These examples show why each line needs a clearly defined role. Risk ownership, oversight, and independent assurance must work together to prevent gaps in control management.

Compliance and Internal Audit Differences

One common area of confusion in the three lines model is the difference between compliance and internal audit. Both functions review controls and identify gaps, but their responsibilities are different.

Area	Compliance (Second Line)	Internal Audit (Third Line)
Main purpose	Helps the organisation meet regulatory and internal obligations	Independently reviews governance, risk, and controls
Scope	Laws, regulations, and internal policies	All areas of organisational risk
Approach	Continuous monitoring and guidance	Periodic, risk-based reviews
Role	Supports and challenges management	Provides independent assurance
Reporting	Senior management with board access	Audit committee or board
Key outputs	Policies, compliance monitoring, and regulatory reports	Audit reports and assurance findings

In simple terms, the compliance function helps the organisation meet its obligations, while internal audit independently checks whether compliance and other control functions are working effectively.

You can also read our guide on internal audits and compliance as two sides of the same coin to understand how these functions work together.

For Indian banks, RBI guidance also emphasises the compliance function’s independence and authority. The Chief Compliance Officer has a defined role, while internal audit operates under a separate risk-based mandate.

The Internal Audit Three Lines Model in Practice

The internal audit three lines model depends on the independence of the third line. Internal auditors must have direct access to the audit committee, access to relevant information, and the authority to review business activities without management interference.

They should not take responsibility for designing or operating the controls they later audit.

Internal audit practices are also evolving with technology. Data analytics, continuous auditing, and AI-assisted testing help audit teams review larger data sets and identify potential control weaknesses more efficiently.

Read more about reimagining internal audit through risk and technology to understand how technology is changing audit practices.

Common Challenges in Implementing the Model

Although the model provides a clear structure, organisations may face challenges when implementing it.

• Unclear responsibilities: Business teams transfer risk ownership to the risk or compliance function.
• Overlapping roles: Second-line teams start operating business controls, or internal audit becomes involved in control design.
• Inconsistent reporting: Different teams use separate risk registers, tools, and rating systems.
• Duplicate testing: Multiple functions review the same controls without proper coordination.
• Limited resources: Risk and compliance teams may lack sufficient resources to provide effective oversight.

These challenges can create gaps in risk reporting and increase operational costs. Organisations can address them through integrated risk management and a shared approach to breaking down GRC silos.

How the Three Lines Fit into a Governance, Risk and Compliance Model

The three lines model defines who manages, oversees, and reviews risks. A governance, risk and compliance model connects these responsibilities through common policies, controls, risk registers, and evidence.

When all three lines work with consistent information, organisations can reduce duplicate testing, improve risk reporting, and make better decisions.

For example, the first line can perform control checks, while the second and third lines use the available evidence for monitoring and independent reviews where appropriate.

Organisations can also adopt continuous controls monitoring to improve visibility into control performance and identify issues earlier.

How CyRAACS Supports Risk Management and Internal Audit

CyRAACS helps organisations strengthen their governance, risk management, and compliance practices through structured frameworks and independent assurance services.

Its GRC services help organisations develop risk frameworks, control libraries, and compliance programmes aligned with requirements such as RBI, SEBI, ISO 27001, and the DPDP Act.

CyRAACS also provides independent IT and information security audit services through its audit services. These services help organisations review control effectiveness, identify gaps, and improve their risk management practices.

The COMPASS platform brings risks, controls, and supporting evidence together, helping teams maintain better visibility and coordination across the three lines.

Conclusion

The Three Lines of Defence Model helps organisations define clear responsibilities for risk ownership, oversight, and independent assurance. Its updated version also highlights the importance of collaboration and value creation.

When business teams, risk and compliance functions, and internal audit work with clearly defined responsibilities, organisations can improve control effectiveness, strengthen governance, and make better risk-based decisions.

Frequently Asked Questions

What are the three lines of defence in risk management?

The three lines are operational management, risk and compliance oversight, and internal audit. The first line manages risks, the second provides oversight, and the third offers independent assurance.

What is the difference between the Three Lines of Defence Model and the Three Lines Model?

The IIA updated the original model in 2020 and renamed it the Three Lines Model. The updated version places greater emphasis on collaboration, governance, and value creation.

Is compliance part of the second line of defence?

Yes. Compliance is generally part of the second line. It develops policies, monitors regulatory obligations, and provides guidance to business teams.

Why is internal audit the third line?

Internal audit is the third line because it independently evaluates the effectiveness of governance, risk management, and internal controls. It reports its findings to the board or audit committee.