The Three Lines Model

Why The Three Lines Model Matters

The Three Lines Model is one of the most heavily tested frameworks in the IIA's Certification in Risk Management Assurance (CRMA) exam, and for good reason. It sits at the heart of how organisations structure governance, risk management and assurance. Almost every question in the Internal Audit Roles and Responsibilities domain can be traced back to a single core question: who should be doing what in relation to risk, and how does internal audit fit in?

For a CRMA candidate, the model is important for three reasons:
1. It defines the boundaries of internal audit independence, which is the foundation of credible risk management assurance.
2. It clarifies role allocation, so you can identify when a task belongs to management, to a specialist risk or compliance function, to internal audit, or to the governing body.
3. It explains coordination and reliance, i.e., how internal audit can work with, and sometimes rely on, other assurance providers without compromising objectivity.

If you can confidently distinguish between first, second and third line roles, you will be well placed to answer a large share of CRMA scenario questions.

What The Three Lines Model Is

The IIA published the Three Lines Model in July 2020 as an update to the earlier Three Lines of Defense model (2013). The update was deliberate: the old model was criticised for being too defensive, too rigid and too focused on structures rather than roles. The 2020 model repositions governance and risk management as being about value creation and protection, not just loss prevention.

The model describes four key participants:

1. The Governing Body (e.g., board, audit committee)
Accountable to stakeholders for organisational oversight. It sets the tone, establishes structures and processes for governance, delegates responsibility and resources to management, and ensures an independent, objective and competent internal audit function exists.

2. Management - First Line Roles
Those who deliver products and services to clients and in doing so own and manage risk. First line roles include designing and operating controls, taking day-to-day risk decisions and reporting on planned, actual and expected outcomes.

3. Management - Second Line Roles
Roles that provide expertise, support, monitoring and challenge on risk-related matters. Think risk management, compliance, information security, quality assurance and similar functions. Critically, second line roles are still part of management - they are not independent of management in the way internal audit is. Second line roles help build and maintain the risk management framework, analyse and report on the adequacy of risk management, and may be blended with first line roles.

4. Internal Audit - Third Line Roles
Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. Its independence is achieved through accountability to the governing body (functional reporting), unfettered access to people, resources and data, and freedom from bias or interference in planning and delivering audit work.

Outside these three lines sit external assurance providers (external auditors, regulators, certification bodies) who provide additional assurance to satisfy legislative, regulatory or stakeholder expectations.

The Six Principles of the Model

The 2020 model is built around six principles, and exam questions frequently paraphrase them:

Principle 1 - Governance. Governance requires accountability (governing body), actions including managing risk (management), and assurance and advice (internal audit).
Principle 2 - Governing body roles. The governing body ensures appropriate structures and processes, delegates to management, and establishes an independent internal audit function.
Principle 3 - Management and first and second line roles. Management is responsible for achieving objectives; first and second line roles may be blended or separated, with second line roles providing complementary expertise and challenge.
Principle 4 - Third line roles. Internal audit provides independent and objective assurance and advice through systematic and disciplined processes, reporting to the governing body and management.
Principle 5 - Third line independence. Internal audit's independence from management is critical to its objectivity, authority and credibility.
Principle 6 - Creating and protecting value. All roles work collectively to create and protect value when aligned with each other and with stakeholder interests. Alignment is achieved through communication, cooperation and collaboration.

How The Model Works in Practice

Roles, not structures. The single most important conceptual shift in the 2020 model is that the 'lines' describe roles, not departments or organisational boxes. A single individual or team may perform first and second line roles at once (for example, an operations manager who also carries out compliance monitoring). What matters is the nature of the activity, not the job title.

Flow of accountability and reporting. The governing body delegates to management and receives reporting from both management and internal audit. Management (first and second lines) reports upward on risk and performance. Internal audit reports functionally to the governing body and administratively to senior management. The governing body also oversees internal audit's independence and resourcing.

Second line flexibility. The model explicitly allows second line roles to vary in independence from the first line. Some may be embedded in operational teams; others (such as a chief risk officer reporting to the board risk committee) may have significant independence. The exam often tests whether you recognise that second line independence is a matter of degree, whereas third line independence is a defining requirement.

Internal audit and risk management - the boundary. Internal audit may:
- Provide assurance on risk management processes, risk evaluation and risk reporting.
- Facilitate workshops, coach management and champion risk management (with safeguards).
Internal audit should not:
- Set the risk appetite.
- Impose risk management processes.
- Take decisions on risk responses or implement responses on management's behalf.
- Be accountable for risk management.
If internal audit temporarily takes on second line roles (common in smaller organisations), safeguards are required: governing body approval, clear communication of responsibilities, and arrangements for independent assurance over those activities.

Coordination and reliance. Principle 6 drives the concept of combined assurance or assurance mapping. Internal audit should coordinate with second line and external providers to minimise duplication and gaps. Internal audit may rely on second line work, but only after assessing its competence, objectivity and the quality of its methodology, and the chief audit executive retains responsibility for the conclusions reached.

Key Differences: 2013 vs 2020 Models

Exam writers like to test this contrast:
- Defense replaced by value creation and protection.
- Functions/structures replaced by roles.
- Rigid separation replaced by acknowledged blending of first and second line roles.
- Governing body given explicit, central accountability rather than sitting above the model.
- Greater emphasis on collaboration and alignment across all roles.

Exam Tips: Answering Questions on The Three Lines Model

Tip 1 - Classify the activity, not the person. When a scenario describes a task, ask: Is it owning and managing risk (first line)? Is it supporting, monitoring or challenging risk management (second line)? Is it independent assurance (third line)? Is it oversight and accountability (governing body)? Titles can be misleading; the activity determines the line.

Tip 2 - Watch for key verbs. 'Accountable' and 'oversight' usually point to the governing body. 'Responsible for managing', 'owns', 'operates controls' point to first line. 'Monitors', 'supports', 'challenges', 'advises on frameworks' point to second line. 'Independent', 'objective', 'assurance' point to internal audit.

Tip 3 - Independence is the dividing line. If an answer option would have internal audit designing, implementing or owning a risk process, control or risk response, it is almost always wrong. The correct answer will preserve internal audit's independence, often by naming management or a second line function as the owner.

Tip 4 - Remember the 'with safeguards' answers. Questions about small organisations or resource constraints often have a best answer that permits internal audit to perform consulting or second line activities provided safeguards are in place (board approval, disclosure, alternative assurance). Beware of absolute options such as 'internal audit must never...' and equally beware of options that allow it with no safeguards.

Tip 5 - Second line is management. A common trap is an option that treats the risk function as 'independent assurance'. Second line roles belong to management and are not a substitute for third line assurance. Internal audit may rely on them only after evaluating their competence and objectivity.

Tip 6 - Know the 2020 wording. If a question asks about the current IIA model, prefer answers referring to 'roles', 'value creation and protection', 'governing body', 'alignment' and 'collaboration'. Answers describing rigid 'defense' layers reflect the superseded 2013 model.

Tip 7 - Reporting lines matter. For questions on independence, the strongest answer typically has internal audit reporting functionally to the governing body (audit committee) and administratively to the CEO or equivalent. Reporting to the CFO or the chief risk officer undermines third line independence.

Tip 8 - Use elimination. CRMA options are often three plausible distractors and one best answer. Eliminate any option that (a) makes internal audit own risk, (b) treats second line as independent, (c) removes governing body accountability, or (d) ignores coordination between assurance providers. What remains is usually correct.

Tip 9 - Think 'best', not 'possible'. Many questions ask what the CAE should do or what is most appropriate. Several options may be technically possible; choose the one most consistent with the Global Internal Audit Standards and the principles of the Three Lines Model.

Quick Revision Summary

- Governing body: accountable for oversight; ensures independent internal audit.
- First line: delivers services, owns and manages risk, operates controls.
- Second line: expertise, support, monitoring, challenge; part of management; may blend with first line.
- Third line: independent, objective assurance and advice; reports to governing body.
- External assurance: additional assurance for regulators and stakeholders.
- Six principles: governance, governing body roles, management roles, third line roles, third line independence, creating and protecting value.
- Golden rule: internal audit assures and advises on risk management but never owns it.

Master these distinctions and the logic behind them, and Three Lines Model questions on the CRMA exam become some of the most predictable marks you can earn.