“The internal audit function provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. It achieves this through the competent application of systematic and disciplined processes, expertise, and insight.”The Institute of Internal Auditors (IIA) · The IIA's Three Lines Model: An Update of the Three Lines of Defense · 2020 · The IIA, «The IIA's Three Lines Model: An Update of the Three Lines of Defense» (iulie 2020), Principiul 4 «Third line roles»
Nobody can give independent assurance over their own work, however competent they are.
The model the Institute of Internal Auditors updated in July 2020 no longer speaks of lines of defence but of roles. The governing body sets direction and demands accountability. Management covers the first and second lines: the first delivers products and services and therefore owns the risks that come with them; the second brings expertise, monitoring and challenge — compliance, information security, quality. The third line is internal audit, providing independent and objective assurance on governance and risk management, reporting both to management and to the governing body. Two expensive confusions live here. The information security officer is second line: advising, monitoring, challenging, but never assuring their own work. And internal audit does not design controls or keep the risk register, or it forfeits its independence. The same rule governs certification: whoever implemented the system cannot audit what they implemented.
The card says nobody gives assurance on their own work. Let's take the idea further: simultaneous roles only work if each knows when to stop. Whoever advises cannot then judge their own advice. Whoever builds a control cannot say whether the control is good. In a family, the person who cooked dinner is not the one who decides whether dinner was good enough for the guests. That is why internal audit designs nothing it will later assess. Independence is not a title, but a limit imposed on oneself. But what happens when roles overlap in practice, say when management asks internal audit to keep the risk register?
When internal audit keeps the risk register, the problem does not show up right away. The register looks fine, it is updated, everything runs smoothly. The damage appears a year later, when the same audit must judge whether the company's risks were correctly identified. Either way it evaluates, it is judging its own work, and the opinion becomes unusable for the governing body. It is as if the accountant who keeps the books also signed the report saying the books are correct. The solution is not for audit to refuse all help, but for the role to be written down clearly: who owns the activity, who checks it. That raises the next question: who actually decides these boundaries, and who oversees them?
Why it matters Independence is not a formality: an opinion on your own project is worthless, and the certification body rejects the arrangement.