By the end you will be able to
- 1Assign risk responsibilities to the business, to risk and compliance, and to internal audit.
- 2Explain the 'three lines of defence' and how the IIA's 2020 Three Lines Model changed it.
- 3Describe where the board, internal audit and external assurance providers sit.
- 4Spot when three lines exist on paper but fail in practice.
Why it matters
Ask a trader who manages the desk's risk and you may hear “the risk department”. Ask the risk department and you may hear “the traders”. When everyone thinks someone else owns a risk, nobody does. The three lines model exists to settle that question.
Core explanation
Own it, oversee it, assure it
A restaurant kitchen is a good picture. The chefs cook, taste and keep their stations clean: they own food safety in every dish. A head of food safety writes the hygiene rules, checks fridge temperatures and can stop a dish going out. An auditor visits now and then and tells the owner whether the whole system really works. Remove any one of them and food poisoning becomes more likely.
A financial firm splits risk responsibilities the same way:
| Line | Who | Role |
|---|---|---|
| First | Business units: lending, trading, sales, operations | Take risk to serve clients; own and manage it with day-to-day controls. |
| Second | Risk management, compliance and similar specialists | Set frameworks and policies, measure and monitor, challenge the first line. |
| Third | Internal audit | Give the board independent, objective assurance on whether the first two lines work. |
The first line is not a junior partner. The people who make loans and trades see the risk first and are best placed to control it, with controls such as limits, approvals and reconciliations. The second line, led by the CRO (L2.3.03: The CRO and the risk function) and the head of compliance, brings expertise and an independent view. The third line, internal audit, reports to the board's audit committee, so it can criticise anyone, including the CRO.
From “defence” to “model”. The idea spread in the 2000s as the “three lines of defence”, and the Institute of Internal Auditors (IIA) set it out in a 2013 position paper. Banking supervisors adopted the phrase; the Basel Committee's 2015 governance principles still use it. In July 2020 the IIA published an update, the Three Lines Model, and dropped the word “defence”. You will hear both names; they describe the same split of roles.
| Three lines of defence (2013) | Three Lines Model (2020) | |
|---|---|---|
| Tone | Protecting the firm from loss | Protecting and creating value |
| Lines | Separate layers, like walls | Roles that work together; first and second line roles can sit close |
| Governing body | In the background | Shown explicitly, with internal audit accountable to it |
| Internal audit | The last line of defence | Independent assurance and advice to the governing body |
ExploreThe IIA's Three Lines Model (2020)
Click each role to see what the model says it does.
Governing body
Answers to stakeholders for oversight. Sets direction and appetite, delegates to management and provides the resources, and oversees internal audit, which reports to it directly.
Where the lines fail
- The first line hands risk over: “risk will tell us if it's a problem”.
- The second line goes native: risk staff adopt the business's view, as the Archegos report found at Credit Suisse (L2.3.01: Why risk governance matters).
- The third line is ignored: Barings' internal audit flagged the weakness in August 1994; nobody acted.
- Gaps and overlaps: a risk nobody covers, or three teams testing the same control.
Try it
Place each activity in the right part of the model. Watch for the trap: the business monitoring its own risks is still the first line.
Place itWho does what?
Pick an activity, then click the box on the diagram where it belongs.
Placing: A loan officer checks a borrower's income before approving a mortgage
Management
Worked example
A new product through the three lines
A UK retail bank wants to launch a “buy now, pay later” loan for online shoppers. Follow the product through the model.
Launching a product, line by line
Step 1 of 6- 1
Governing body
The board has set an appetite for unsecured consumer lending. The new product must fit inside it.
Regulatory lens
Supervisors expect banks and insurers to organise risk this way, though they rarely prescribe a chart. The BCBS Corporate governance principles for banks (2015) and its Principles for the sound management of operational risk (2011, revised 2021) use the three lines of defence. In the US, the OCC's heightened standards (2014) for large banks write the split into rules as “front line units”, “independent risk management” and “internal audit”. EBA guidelines on internal governance do the same for the EU, and supervisors in the UK and Asia-Pacific use the same language in their reviews. Internal audit itself follows the IIA's Global Internal Audit Standards (2024).
Sparks
SparkA fourth line?
SparkWhose line is compliance?
Key takeaways
- First line: the business takes risk and owns it. Second line: risk and compliance set frameworks, monitor and challenge. Third line: internal audit gives independent assurance.
- The governing body oversees all three; internal audit is accountable to it, usually through the audit committee.
- The IIA's 2020 Three Lines Model replaced 'three lines of defence', stressing value creation and collaboration, and keeping internal audit independent.
- External auditors and supervisors add assurance from outside the firm.
- The model fails when the first line hands risk over, the second line goes native or the third line is ignored.
Reaction
Check what stuck
Question 1 · objective 1
Who owns a credit risk taken when a bank's business lending team makes a loan?
Question 2 · objective 1
Which activity is a second line role?
Question 3 · objective 2
Why did the IIA drop the word 'defence' in its 2020 update?
Question 4 · objective 3
To whom should the head of internal audit be primarily accountable?
Question 5 · objective 4
The Archegos report found Credit Suisse's risk function 'adopted the business's justifications' for limit breaches. Which line failed there?
Glossary
- First line
- The parts of the business that serve clients and take risk, and so own and manage that risk.
- Second line
- Specialist functions, such as risk management and compliance, that set frameworks, monitor and challenge the first line.
- Third line
- Internal audit: gives the board independent, objective assurance that risk management and controls work.
- Control
- An action or check that keeps a risk within bounds, such as a limit, an approval or a reconciliation.
- Assurance
- An independent opinion, based on evidence, on whether something works as it should.
- Compliance
- The function that helps the firm follow laws, regulations and its own codes, and checks that it does.
Deep Dives & Origins
Deep Dives
- Institute of Internal Auditors, The IIA's Three Lines Model: An update of the Three Lines of Defense, July 2020. Beginner.
- Arndorfer, I. and Minto, A., The “four lines of defence model” for financial institutions, FSI Occasional Paper No 11, BIS, December 2015. Intermediate.
Origins
- Institute of Internal Auditors, The Three Lines of Defense in Effective Risk Management and Control, position paper, January 2013.
- Institute of Internal Auditors, The IIA's Three Lines Model: An update of the Three Lines of Defense, July 2020.
- Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015.
- Office of the Comptroller of the Currency, Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, 12 CFR part 30, appendix D, 2014.
- Paul, Weiss, Rifkind, Wharton & Garrison LLP, report to the Credit Suisse Group Special Committee on Archegos Capital Management, 29 July 2021.
Watch this lesson
Video version
Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.