For two decades, the “three lines of defence” gave organisations a simple way to divide accountability for risk: management owns it, specialist functions oversee it, internal audit provides independent assurance. The model was easy to draw and easy to remember. It was also easy to turn into three separate silos.
In 2020 the Institute of Internal Auditors updated the framework as the Three Lines Model. It dropped “defence” from the name and built the model on six principles, with the governing body at the top and an explicit emphasis on alignment, communication and collaboration between the lines. The message was clear: the roles are distinct, but the work is shared.
What changes in practice
- One risk language. A common taxonomy and rating scale let the board compare what each line reports.
- Coordinated assurance. An assurance map shows who covers which risks, where coverage overlaps and where the gaps are.
- Clear escalation. Each line knows when and how issues move upwards — and what the board expects to hear.
- Independence preserved. Collaboration does not mean internal audit gives up its objectivity or its direct line to the audit committee.
Questions for boards and audit committees
- Do we receive one coherent picture of assurance, or three separate reports?
- Where do the lines overlap — and where does nobody look?
- Is the second line resourced to challenge, not just to advise?
- Does internal audit have the independence and access it needs?
Many LIC members have worked in more than one line during their careers. That range — understanding how controls feel from the inside and how they look from the boardroom — is exactly what the model now asks for.
