Definition
The IIA published the Three Lines Model in 2020 as an update to its earlier Three Lines of Defense. It describes the governing body, which holds accountability to stakeholders, management, whose first line roles deliver products and services and whose second line roles provide expertise and support on risk, and internal audit, the third line, which gives independent and objective assurance and advice. External assurance providers sit outside these lines.
Why it matters in an audit or review
Auditors use the model to understand where risk ownership sits. In an entity with weak second line functions, the auditor expects less monitoring and plans more substantive work. Internal audit's independence from management supports the auditor's evaluation of its work.
Example
Illustrative: a lender's loan officers own credit decisions, and the risk team sets credit policy and monitors limits. Internal audit tests both and reports to the audit committee. The structure shows where each review happens.
Common mistakes
- Reading the lines as a hierarchy rather than roles.
- Giving internal audit ownership of risk controls, which compromises independence.
Sources
- The IIA, The IIA's Three Lines Model: An update of the Three Lines of Defense (2020), https://www.theiia.org
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error