Glossary

Three Lines Model

The Three Lines Model distinguishes the roles of management (first line), specialised risk and compliance functions (second line) and internal audit (third line) under board oversight.

The model is maintained by the Institute of Internal Auditors (IIA) and evolved from the earlier Three Lines of Defence. In its Statement of Position of July 2026, the IIA describes management as the first line, which owns and manages risks and designs and operates processes and controls. Second-line roles provide specialised expertise, support, monitoring and challenge. The internal audit function is the independent third line and gives objective assurance on governance, risk management, compliance and control. The board sets purpose and risk appetite and oversees all three.

Regulators apply the same logic. DORA requires financial entities to segregate ICT risk management, control and internal audit functions according to the three lines of defence model or an internal risk management and control model. FINMA Circular 2017/1 requires at least two control bodies within the ICS, the revenue-generating units and the independent control bodies, plus an independent internal audit function.

Pitfalls include treating the lines as organisational boxes rather than roles, second-line functions that take over risk ownership from the first line, and internal audit performing second-line tasks without safeguards for its independence.

In practice

01
Documents for each risk type who owns the risk, who sets standards and challenges, and who provides independent assurance.
02
Gives second-line functions direct access to the board and avoids remuneration incentives that conflict with their control role.
03
Coordinates assurance plans across the lines to avoid gaps and duplicate testing.
04
Applies explicit safeguards whenever internal audit takes on second-line activities.

In MRM-Solution

How MRM-Solution supports it

Model committees, mandates and escalation lines once; the structure is checked for gaps, cycles and independence of the second line.

Book a demo →

Sources

Too good to be true? Then we should talk.

30 minutes. Your use case, maximum impact.

info@mrm-solution.com