The IIA's Three Lines Model describes who does what in governing a company: the governing body oversees, management owns and manages risk, and internal audit gives independent assurance. Combined assurance is the practice of mapping all sources of assurance together so that nothing is missed and nothing is checked three times. The model gives the roles. The map shows the coverage.
Last reviewed: 17 October 2026. Facts checked. We checked the 2020 Three Lines Model roles against secondary summaries of the IIA paper, not the paper itself, so confirm exact wording with the IIA original. We did not check how any specific Indian regulator uses the term.
The Three Lines Model in plain words
The IIA updated its older "three lines of defence" in 2020. Two changes matter. The word "defence" was dropped, and the governing body was brought into the picture. The model is principles-based. It describes roles, not a fixed structure.
| Role | Who | What they do |
|---|---|---|
| Governing body | Board, audit committee | Accountable for governance. Sets direction, gives authority and oversees |
| First line | Operational management | Runs the business and owns and manages risk |
| Second line | Risk, compliance, quality, finance control | Supports management with expertise, monitoring and challenge |
| Third line | Internal audit | Provides independent and objective assurance and advice, reporting to the governing body |
Two points often get lost:
- Risk ownership stays with management. Second-line functions help, but they do not take the risk over.
- Independence is what sets internal audit apart. It reports to the governing body, not to the managers it audits.
In some organisations the first and second lines blend, especially in small companies. The model allows for that, as long as roles are clear.
What combined assurance adds
The model tells you the roles. It does not tell you whether the big risks are covered. Combined assurance does that. It asks, for each key risk: who is checking, how deeply, and how often?
Sources of assurance beyond the three lines include:
- statutory auditors,
- regulators and inspections,
- external certifications and reviews,
- specialist reviews such as IT security tests,
- management self-assessments.
Put them all in one view. That view is an assurance map.
A simple assurance map
| Key risk | First line | Second line | Internal audit | External |
|---|---|---|---|---|
| Revenue misstatement | Monthly reconciliations | Finance controller review | Annual order-to-cash review | Statutory audit |
| Tax non-compliance | Return preparation checks | Tax team review | Compliance audit on rotation | Tax audit where applicable |
| Data breach | System owner controls | Security team monitoring | IT audit | Penetration test |
| Fraud | Approval limits | Whistleblower process | Forensic review on trigger | None |
Colour or score each cell by strength of assurance. The pattern then shows two problems.
- Gaps: key risks with weak or no assurance.
- Overlaps: risks reviewed by many parties while others are ignored.
How to build one
- List the top risks. Take them from the enterprise risk register.
- List every assurance provider. Include those outside the three lines.
- Map provider to risk. Record what each actually does and how often.
- Rate the assurance. Consider depth, independence and frequency.
- Find gaps and overlaps. Decide what to change.
- Share with the audit committee. It uses the map to direct resources.
- Refresh each year. Risks and providers change.
The internal audit annual plan generator and internal audit risk scorer help tie the plan to risk.
Using other people's work
Internal audit can rely on work done by others, but must judge its quality first. The reverse also holds. Statutory auditors may consider the work of internal auditors under SA 610, "Using the Work of Internal Auditors", after assessing objectivity, competence and approach. The statutory auditor keeps sole responsibility for the opinion. See internal audit vs external vs statutory audit.
A short example
Take a mid-sized manufacturer worried about inventory. In the first line, plant managers run daily stock controls. In the second line, the finance controller reviews stock reports monthly. The statutory auditor attends the year-end count. Internal audit has not looked at inventory for three years.
The map shows strong coverage at year-end and weak coverage during the year. The audit committee asks internal audit to review mid-year controls and cut-off. No new function was needed. The map simply showed where attention was missing.
Common mistakes
- Treating the second line as "audit-lite". Its role is monitoring and support, not independent assurance.
- Letting internal audit design or run controls. That harms independence.
- Counting a management review as independent assurance.
- Building the map once and never updating it.
Frequently Asked Questions
What is the Three Lines Model?
The IIA's 2020 framework describing the roles of the governing body, management (first and second lines) and internal audit (third line) in governance.
What changed from the three lines of defence?
The name dropped "defence", the governing body was added, and the model became principles-based and focused on roles, not structure.
What is combined assurance?
A coordinated approach that maps all sources of assurance over key risks to avoid gaps and duplication.
Is the second line independent?
No. Second-line functions sit within management. Only internal audit gives independent assurance, reporting to the governing body.
Who owns the assurance map?
Often the head of internal audit or the chief risk officer prepares it, and the audit committee reviews it.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error