The IIA's Three Lines Model: An Update of the Three Lines of Defense

1 card

1. 01

   The three lines are not hierarchical floors but concurrent roles; the rule holding them together is that nobody assures their own work.

   The IIA's Three Lines Model: An Update of the Three Lines of Defense · 2020

   Nobody can give independent assurance over their own work, however competent they are.

   The model the Institute of Internal Auditors updated in July 2020 no longer speaks of lines of defence but of roles. The governing body sets direction and demands accountability. Management covers the first and second lines: the first delivers products and services and therefore owns the risks that come with them; the second brings expertise, monitoring and challenge — compliance, information security, quality. The third line is internal audit, providing independent and objective assurance on governance and risk management, reporting both to management and to the governing body. Two expensive confusions live here. The information security officer is second line: advising, monitoring, challenging, but never assuring their own work. And internal audit does not design controls or keep the risk register, or it forfeits its independence. The same rule governs certification: whoever implemented the system cannot audit what they implemented.

   “The internal audit function provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. It achieves this through the competent application of systematic and disciplined processes, expertise, and insight.”

   Open the card →