The three lines of defence split risk roles: the first line (operational managers) owns and manages risk; the second line (risk and compliance) sets policy and oversees; the third line (internal audit) gives independent assurance to the board. A fourth line, external audit and regulators, gives assurance to outsiders. The IIA renamed it the Three Lines Model in 2020.
Who does what
| Line | Who | Role | Example in a retailer |
|---|---|---|---|
| 1st | Operational managers and staff | Run controls in daily work | Store managers reconcile tills daily |
| 2nd | Risk management, compliance, finance control, health and safety | Set frameworks and policies, monitor the first line | Compliance team checks stores follow cash-handling policy |
| 3rd | Internal audit | Independent assurance on the first two lines | Internal audit tests the cash controls in a sample of stores |
| 4th | External auditors, regulators | Assurance to outsiders | External auditor reviews cash controls as part of the audit |
History
The Institute of Internal Auditors (IIA) set out the Three Lines of Defence in a 2013 position paper. In 2020 it updated this to the Three Lines Model, removing "defence" and stressing collaboration and value creation. Source: The IIA.
Assurance mapping in four steps
| Key risk | 1st line | 2nd line | 3rd line | Gap? |
|---|---|---|---|---|
| Cyber attack on donor data | IT security controls | Data protection officer review | None this year | Yes: add to audit plan |
| Site safety | Daily site checks | Health and safety team | Audit every 2 years | No |
| Gift Aid claims | Finance processing | Finance manager review | Audit last year | No |
Example based on Historic Places (March 2025 pre-seen).
Lines of defence in ACCA SBL
This sits in risk (syllabus area D) and control and audit (area F). Typical tasks: an organisation where the risk function also runs operations, or internal audit reports to the finance director. Show where the lines are blurred, why that weakens assurance, and how to fix it. See auditor independence and COSO.
Advantages
- Clear roles and accountability
- Avoids gaps and duplication
- Simple for boards to understand
Limitations
- Can create silos and box-ticking
- Lines may blur in small organisations
- First line may assume others will catch problems
FAQs
What are the three lines of defence?
First line: operational managers who own and manage risk day to day. Second line: risk management and compliance functions that set policy and oversee. Third line: internal audit, which gives independent assurance to the board and audit committee.
What is the fourth line of defence?
External assurance from outside the organisation, mainly external auditors and regulators. ACCA material and the book include it as a fourth line.
What is the IIA Three Lines Model?
The Institute of Internal Auditors' 2020 update. It dropped the word "defence" to stress that risk management also creates value, and put more emphasis on the governing body and cooperation between the lines.
What is assurance mapping?
A method of listing all the sources of assurance over each key risk, across all the lines, to find gaps (risks with no assurance) and overlaps (duplicated work).
Is internal audit the second or third line?
The third line. It must be independent of management, reporting to the audit committee.