The IIA published an update of its "three lines of defense" in July 2020 and named it the Three Lines Model. The update sets out six principles. Finance teams, internal auditors and the CPA firms that advise them use it to settle one practical question: who is responsible for a control, who monitors it and who gives independent assurance on it. This post explains the model and maps it to a finance function.
The six principles
- Governance. An organization needs structures and processes that enable accountability by a governing body to stakeholders, actions (including managing risk) by management to achieve objectives, and assurance and advice by an independent internal audit function.
- Governing body roles. The governing body is accountable to stakeholders for oversight and, among other things, establishes and oversees an independent, objective and competent internal audit function.
- Management and first and second line roles. Management's responsibility to achieve objectives comprises both first and second line roles. First line roles are most directly aligned with delivering products or services to clients and include support functions. Second line roles assist with managing risk, and can focus on specific objectives such as compliance with laws or quality assurance, or span a broader responsibility for risk management. The model says first and second line roles may be blended or separated.
- Third line roles. Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management and reports findings to management and the governing body.
- Third line independence. Internal audit's independence from management's responsibilities is critical to its objectivity, authority and credibility. It is established through accountability to the governing body, unfettered access to people, resources and data, and freedom from bias or interference in planning and delivering audit services.
- Creating and protecting value. All roles together contribute to creating and protecting value when they are aligned with each other and with stakeholder interests, through communication, cooperation and collaboration.
Mapping finance roles
The model describes first line roles as including "front of house" and "back office" activities, so accounting operations belong in the first line. A typical mapping for a hypothetical company with $200 million of revenue:
| Role | Line | Example responsibilities |
|---|---|---|
| Accounts payable clerk, payroll specialist, billing analyst | First | Perform controls: three-way match, payroll register review, credit approval |
| Controller | First | Owns the close, reconciliations, journal entry review; owns the control design |
| Financial reporting manager | First | Prepares statements and disclosures |
| Risk manager, compliance officer, SOX program office | Second | Monitor control operation, challenge management's self-assessments, maintain the RCM |
| Internal audit | Third | Independent assurance on the effectiveness of controls and risk management |
| External auditor | External assurance provider | Provides additional assurance to meet regulatory expectations and to complement internal sources of assurance |
| Audit committee | Governing body | Oversees; receives reports from all lines |
Standard 9.5 of the IIA Global Internal Audit Standards says the chief audit executive must coordinate with internal and external assurance providers, consider relying on their work, and document the basis for reliance, with the CAE still responsible for conclusions. The Three Lines Model is the conceptual map for that coordination.
Where firms get this wrong
The second line does not equal internal audit. A SOX program office that tests controls for management is a second line activity. Management can use it. But internal audit still needs independence from it. If the same people design the controls, test them and then report to the audit committee as internal audit, the third line has disappeared.
The first line owns controls. Many finance teams hand ownership to internal audit or to the SOX office. Internal audit's role is assurance and advice. The owner of the control is the person who operates or supervises it.
Small companies blend roles. The model allows first and second line roles to be blended. A controller may do both. What the model asks is that the blending be deliberate and that the third line stay independent. See the dual-role analysis in /us/blog/internal-audit-independence-and-cae-dual-roles-standard-7-1.
Worked example: a duplicate payment control
Take a control that rejects duplicate vendor invoices.
- First line. The AP supervisor reviews the weekly duplicate exception report and keeps signed evidence.
- Second line. The SOX program office samples the supervisor's reviews each quarter and reports exceptions to the controller.
- Third line. Internal audit includes the control in its disbursements engagement, tests the full population for duplicates, and reports the result to the audit committee. If the SOX office's quarterly results show no exceptions and internal audit's population test finds duplicate pairs, internal audit's report explains the difference. That gap is information for the committee about the second line's effectiveness.
In an ICFR assessment, the SEC's interpretive guidance for management describes two sources of evidence of control operation: direct tests, ordinarily performed by individuals with a high degree of objectivity relative to the controls tested, and ongoing monitoring, which includes self-assessments. The guidance notes that self-assessment covers procedures performed by individuals with varying degrees of objectivity, including the personnel who operate the control. The Three Lines Model supplies vocabulary for that spread: as a rule of thumb, first line self-assessment is the least objective, second line monitoring is more objective, and third line testing is the most. The model does not say this in those terms, so treat it as a working heuristic.
Using the model on engagements
For a CPA firm scoping an ICFR or internal audit engagement, ask the client to complete a one-page role map: for each key control, who operates it, who monitors it and who independently tests it. Gaps and overlaps appear immediately. A key control with no one in the second or third line is a candidate for the audit plan. A control tested by three groups is a candidate for rationalization.
Related reading
- /us/blog/internal-audit-vs-external-audit
- /us/blog/relying-on-internal-audit-au-c-610-direct-assistance
- /us/blog/control-testing-guide
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, The IIA's Three Lines Model: An update of the Three Lines of Defense (July 2020), Principles 1 to 6: https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf
- The IIA, Global Internal Audit Standards (2024), Standard 9.5 Coordination and Reliance: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
- SEC, Release No. 33-8810, Section II.A.2.b (direct tests and ongoing monitoring): https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error