Internal Audit's Role in Risk Management and the Three Lines

Overview
This topic appears in the Internal Audit Professionalism and Quality area of the CIA Challenge Exam. It covers two linked ideas. The first is the IIA's Three Lines Model, which sets out how governance, management and internal audit share responsibility for risk. The second is the proper role of internal audit in enterprise risk management (ERM), meaning what internal audit should do, what it may do with safeguards, and what it must never do.

Candidates who are already professional accountants often know external audit independence rules well. They can still miss the finer points of internal audit's dual assurance and advisory role. Examiners test this area with scenario questions. These usually ask whether a proposed activity would impair independence or objectivity, or which party holds a given responsibility.

1. Why This Topic Is Important
It protects independence and objectivity. Internal audit's value depends on being seen as independent. If internal audit takes ownership of risk management, it ends up auditing its own work. That destroys the credibility of its assurance.
It clarifies accountability. Unclear roles lead to gaps, where nobody manages a risk. They also lead to duplication, where several functions review the same risk while others go uncovered. The Three Lines Model gives a shared language for allocating responsibility.
It supports good governance. Boards rely on internal audit for an independent view of whether risks are managed within the risk appetite. Regulators, audit committees and external auditors expect this structure.
It is heavily examined. Expect questions on:
• which line owns a risk
• which ERM roles internal audit may take on
• what safeguards are required
• how internal audit coordinates with other assurance providers
It reflects real-world practice. Many organizations have small risk teams. They often ask the internal audit function to set up or run ERM. You must know when this is acceptable and how to protect independence while doing it.

2. What It Is: The Three Lines Model (IIA, 2020)
Background. In 2020 the IIA replaced the older Three Lines of Defense model (2013) with the Three Lines Model. The key shifts were:
• from a purely defensive view of risk to one about creating and protecting value
• from rigid separation to collaboration and alignment
• from a structural chart to a principles-based model that each organization adapts

The six principles
1. Governance: an organization needs structures and processes that provide accountability, actions, and assurance and advice.
2. Governing body roles: the governing body is accountable to stakeholders for oversight. It sets direction, delegates responsibility and resources to management, and oversees internal audit.
3. Management and first and second line roles: management is responsible for achieving objectives, which includes managing risk.
4. Third line roles: internal audit gives independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management.
5. Third line independence: internal audit is independent of management. This is essential to its objectivity, authority and credibility.
6. Creating and protecting value: all roles work together and stay aligned with each other and with stakeholder interests.

The key roles
Governing body (board or audit committee)
• Accountable to stakeholders for organizational oversight.
• Sets the organization's purpose, risk appetite and ethical culture.
• Delegates to management and provides resources.
• Establishes and oversees an independent, objective internal audit function.

Management: first line roles
• Operational managers who deliver products and services and own and manage risks day to day.
• Design, implement and maintain internal controls.
• Examples: sales, production, procurement, IT operations, branch managers.

Management: second line roles
• Provide complementary expertise, support, monitoring and challenge on risk matters.
• Examples: risk management, compliance, information security, health and safety, quality assurance, financial control or controllership.
• These roles sit within management. They may have some independence through reporting lines, but they are not fully independent of management.

Third line: internal audit
• Gives independent, objective assurance and advice on all matters related to achieving objectives.
• Reports functionally to the board and administratively to senior management, typically the CEO.
• Is the only line with independence from management.

External assurance providers
• Examples: external auditors, regulators and certification bodies.
• They sit outside the three lines and give additional assurance to stakeholders.

Relationships in the model
• Accountability and reporting: management and internal audit report to the governing body.
• Delegation, direction, resources and oversight: these flow from the governing body to management and internal audit.
• Alignment, communication, coordination and collaboration: these connect management and internal audit.

Important nuance. The lines are roles, not departments. One person or team may carry out both first and second line roles. Second line roles can also be blended into first line activities. Internal audit, however, must stay independent.

3. What It Is: Internal Audit's Role in ERM
The IIA's position paper The Role of Internal Auditing in Enterprise-wide Risk Management uses a 'fan' diagram. It groups activities into three categories.

A. Core internal audit roles (always appropriate)
• Giving assurance on risk management processes.
• Giving assurance that risks are correctly evaluated.
• Evaluating risk management processes.
• Evaluating the reporting of key risks.
• Reviewing the management of key risks.

B. Legitimate roles, but only with safeguards
These are consulting-type roles.
• Facilitating the identification and evaluation of risks, such as running risk workshops.
• Coaching management in responding to risks.
• Coordinating ERM activities.
• Consolidating the reporting on risks.
• Maintaining and developing the ERM framework.
• Championing the establishment of ERM.
• Developing a risk management strategy for board approval.

The closer an activity sits to the bottom of this list, the greater the threat to independence. Safeguards therefore need to be stronger.

C. Roles internal audit should NOT undertake
• Setting the risk appetite.
• Imposing risk management processes.
• Providing management assurance on risks.
• Taking decisions on risk responses.
• Implementing risk responses on management's behalf.
• Being accountable for risk management.

Required safeguards for the legitimate roles
• Management must keep clear responsibility and ownership of risk management.
• The nature of internal audit's responsibilities must be documented in the internal audit charter and approved by the board.
• Internal audit must not manage risks on management's behalf.
• Internal audit should give advice, challenge and support management's decisions, rather than make risk decisions itself.
• Internal audit cannot give objective assurance on any part of the ERM framework it is responsible for. That assurance must come from another qualified party, such as an external provider.
• Any work beyond assurance activities is treated as a consulting engagement, and the related consulting standards apply.
• The arrangement should be temporary where possible. There should be a plan to transfer ERM ownership to management or a second line function.

4. How It Works in Practice
Link to the Global Internal Audit Standards (2024)
• Purpose of internal auditing: to strengthen the organization's ability to create, protect and sustain value. It does this by giving the board and management independent, risk-based and objective assurance, advice, insight and foresight.
• Domain II, Principle 7 (independence): the CAE should report directly to the board. Where the CAE holds roles or responsibilities beyond internal auditing, such as ERM or compliance, the board must be told and safeguards must be put in place. Under the former IPPF this was Standard 1112, CAE Roles Beyond Internal Auditing.
• Objectivity: objectivity is presumed impaired if an internal auditor gives assurance on an activity they were responsible for within the previous year. Under the former IPPF this was Standard 1130.A1.
• Domain IV, Standard 9.1: the CAE must understand the organization's governance, risk management and control processes.
• Standard 9.5, Coordination and Reliance: the CAE coordinates with internal and external assurance providers and may rely on their work. Under the former IPPF this was Standard 2050.
• Former Standard 2120, Risk Management: internal audit evaluates the effectiveness of, and contributes to improving, risk management processes. It does so by assessing whether:
• organizational objectives support the mission
• significant risks are identified and assessed
• appropriate risk responses are selected
• risk information is communicated in a timely way

Risk maturity drives internal audit's role
• Low risk maturity (risk-naive or risk-aware): there is no formal ERM. Internal audit may champion and facilitate ERM, with safeguards. It also does its own risk assessment for audit planning.
• Medium maturity (risk-defined): internal audit facilitates and coordinates, then gradually steps back.
• High maturity (risk-managed or risk-enabled): management owns a strong ERM process. Internal audit relies on management's risk register as input to the risk-based audit plan. It focuses on assurance over the process and key risks.

Combined assurance and assurance mapping
• An assurance map lists key risks against the assurance each provider gives: first line, second line, internal audit and external providers.
• It shows gaps and overlaps. It helps the board see total assurance coverage.
• It supports reliance decisions. Internal audit may rely on second line work after assessing the provider's:
• competence
• objectivity
• due professional care
• quality of work
• Internal audit still keeps responsibility for its own conclusions.

Worked example
The CEO asks the CAE to build and run the new ERM function because there is no risk officer. The appropriate response has five parts:
1. Accept only as a consulting or facilitation role.
2. Get board approval and record the role in the charter.
3. Make sure management owns the risks and decides the responses.
4. Arrange for independent assurance over the ERM framework from another party, such as an external reviewer.
5. Plan to hand ERM ownership over to a Chief Risk Officer.

The CAE should not set the risk appetite or approve risk responses.

5. How to Answer Exam Questions on This Topic
Step 1: Identify the role being described. Ask yourself:
• Is the person owning risk? That is the first line.
• Is the person overseeing, supporting or challenging on risk within management? That is the second line.
• Is the person giving independent assurance? That is the third line.
• Is the person setting direction and appetite? That is the governing body.

Step 2: Place internal audit activities on the fan.
• Core assurance roles are always fine.
• Facilitation, coaching or coordination roles are acceptable with safeguards.
• Decision-making, ownership or implementation roles are never acceptable.

Step 3: Look for the safeguards. The correct answer often mentions one or more of these:
• board approval
• the charter
• management retaining ownership
• disclosure
• independent assurance by another party

Step 4: Apply the ownership test. If an option would make internal audit accountable for a risk outcome, it is almost certainly wrong.

Step 5: Consider risk maturity and reliance. In mature organizations, the best answer usually relies on management's risk assessment and coordinates with the second line.

Exam Tips: Answering Questions on Internal Audit's Role in Risk Management and the Three Lines
1. Management owns risk. Risk ownership and accountability always rest with management. Overall oversight rests with the board. Internal audit never owns risk.
2. Recognize the forbidden verbs. Answers saying internal audit 'sets the risk appetite', 'decides risk responses', 'implements controls' or 'is accountable for ERM' are traps.
3. Recognize the acceptable verbs. 'Facilitates', 'coaches', 'coordinates', 'champions' and 'consolidates' are acceptable only when safeguards exist. 'Evaluates', 'assures' and 'reviews' are core roles.
4. Know the second line correctly. Risk management, compliance, information security and controllership are usually second line roles. Do not confuse the compliance department with internal audit.
5. The 2020 model stresses collaboration. If a question contrasts the old and new models, the new one emphasizes value creation, principles, flexibility and alignment between lines. It does not rely on rigid walls.
6. Independence comes from the functional reporting line. Internal audit's independence comes from reporting functionally to the board. Second line functions may report to the board too, but they remain part of management.
7. Watch the one-year rule. An auditor who designed or ran a process within the previous year should not give assurance on it.
8. Know who gives assurance on ERM. If internal audit runs ERM, objective assurance on ERM must come from someone else.
9. Read qualifiers carefully. Words such as 'MOST appropriate', 'BEST', 'LEAST likely' and 'should NOT' matter. Several options may be partly true. Pick the one that best protects independence while still adding value.
10. Use process of elimination. First remove options that give internal audit management responsibilities. Then choose between assurance and safeguarded consulting options based on the scenario's context.
11. Remember the role of external assurance providers. External auditors and regulators sit outside the three lines. Internal audit coordinates with them but does not direct them.
12. Know the reliance criteria. Before relying on other providers, internal audit considers their competence, objectivity and due professional care. Reliance never removes internal audit's responsibility.

Common Traps
• Thinking internal audit should refuse all ERM involvement. In fact, safeguarded consulting roles are legitimate and often encouraged.
• Thinking the CRO's risk function is independent assurance. It is second line, not third line.
• Choosing an answer where internal audit 'approves' the risk register or risk responses. Approval belongs to management and the board.
• Assuming the lines must be separate departments. They are roles, and first and second line roles can be combined.

Practice Questions
Q1. Which activity would most likely impair internal audit's independence?
(a) Facilitating a risk workshop
(b) Evaluating the reporting of key risks
(c) Determining the organization's risk appetite
(d) Coaching managers on risk responses
Answer: (c). Setting the risk appetite is a governing body and management responsibility.

Q2. A compliance function that monitors adherence to regulations and reports to the CFO is best described as:
(a) a first line role
(b) a second line role
(c) a third line role
(d) an external assurance provider
Answer: (b).

Q3. The CAE has been asked to coordinate ERM. Which is the MOST important safeguard?
Answer: Management keeps ownership of risks, and the board approves the role as documented in the charter.

Summary
The Three Lines Model allocates roles as follows:
• the governing body gives oversight
• management, through the first and second lines, owns and manages risk
• internal audit, as the third line, gives independent assurance and advice

Within ERM, internal audit has core assurance roles. It may take on facilitation roles with safeguards. It must never take ownership, set the risk appetite or make risk decisions. In the exam, always protect independence, keep risk ownership with management and look for board-approved safeguards.