What is the three lines of defense model and how has it evolved?

Question

AcadiFi · Accepted Answer

The traditional three lines of defense model separates risk ownership (Line 1), oversight/challenge (Line 2), and independent assurance (Line 3). The IIA's 2020 update renamed it the 'Three Lines Model' and reframed relationships more collaboratively. Line 1 — operational management and front-office functions own risks in their daily activities. At Bellevue Asset Management, portfolio managers, trading desks, and client-facing teams are Line 1. They identify risks, implement controls, and bear first responsibility for outcomes. Line 2 — risk management, compliance, and other oversight functions provide expertise, challenge, and monitoring. They set policies, validate models, monitor limits, and escalate concerns. They are independent of revenue generation but embedded in business decisions. Line 3 — internal audit provides objective assurance on the design and effectiveness of governance, risk, and control processes. They report to the audit committee, not management, preserving independence. ```mermaid flowchart LR A[Governing Body
Board] --> B[Management] B --> C[Line 1
Business Units] B --> D[Line 2
Risk + Compliance] A --> E[Line 3
Internal Audit] C -.->|Report| B D -.->|Challenge| C E -.->|Assure| A ``` Evolution from 2020: (1) explicit inclusion of the governing body and external assurance providers, (2) emphasis on alignment and collaboration over rigid silos, (3) recognition that Line 2 functions can sometimes perform Line 1 activities (e.g., compliance executing KYC). Critics note the model doesn't prevent failures when Line 2 is under-resourced or culturally deferential to Line 1 — a common issue in fast-growing firms.

What is the three lines of defense model and how has it evolved?

Master Part II with our FRM Course

Related Questions

Practice Questions