In today’s world, with unpredictable economic and geopolitical events that have contributed to relentless volatility, it is essential for risk and compliance professionals and their teams to extend their capabilities to help cut through the silos and develop risk-sensing and measurement capabilities. There is a business imperative for organizations to become proactive, data-driven, and risk-intelligent in how they manage risk.
The Institute of Internal Auditors Inc.’s (IIA) Three Lines Model provides a framework for organizations to align activities using communication, coordination, cooperation, and collaboration.[1] It highlights leading practices to strengthen and sustain collaboration across the three lines and offers practical considerations to elevate an organization’s risk, compliance, and internal audit programs.
What is the Three Lines Model?
As the name suggests, the Three Lines Model comprises three “lines”: a governing body, management, and internal audit. Each line offers unique perspectives to help ensure the organization’s risks are appropriately managed across the enterprise.
The objectives of the Three Lines Model are:
-
To provide clarity on roles overseeing risk and controls.
-
To align risk management objectives to help achieve optimal assurance activities and a lower cost of compliance.
-
To help prevent over-indexing on risk mitigation activities and enhance focus on value creation.
The Three Lines Model is centered around the following two goals:
-
Risk-based decision-making: A considered process that includes analysis, planning, action-taking, monitoring, and review while considering the potential impacts of uncertainty on organizational objectives.
-
Assurance: Independent confirmation and confidence related to achieving objectives.
The Three Lines Model was formerly known as the “Three Lines of Defense Model” but was shortened in 2020 by the IIA to de-emphasize a defensive approach. This acknowledges that risk-based decision-making is as much about seizing opportunities as it is about defensive moves.
Additional 2020 updates to the Three Lines Model included:[3]
-
Enhanced mechanisms to improve interactions and responsibilities of those charged with governance.
-
A greater emphasis on the role of the governing body, management, and internal audit to enhance the value of the organization, not just protect it.
-
Increased recognition of emerging risks in advance to prepare the organization to mitigate, address, or take advantage of them.
-
Increased awareness of the importance of communication and collaboration.
-
Confirmation that the role of internal audit is relevant and assists the organization both strategically and operationally.
