Three lines model (three lines of defence)

What it is

The three lines model is the standard way financial firms organise who does what in risk management and control. It is also known as the three lines of defence.

• The first line is the business and the operations that serve it. It takes risks, owns them and runs the controls day to day.
• The second line is the independent risk management and compliance functions. It sets policies and limits, monitors risk, and challenges the first line.
• The third line is internal audit. It gives the board independent assurance that the first two lines work as designed.

Basel Committee corporate governance principles for banks describe this split. The Institute of Internal Auditors updated its version in 2020 as the Three Lines Model, which stresses collaboration and the governing body’s oversight. EU banking law requires independent risk, compliance and internal audit functions.

Why it matters

Clear lines prevent two failures: risks that nobody owns, and functions that check their own work. Supervisors look for a second line with enough staff, authority and direct access to the board, and for an internal audit that is independent of management. Weaknesses in these lines are a frequent finding in supervisory reviews.

Worked example

Illustrative numbers. Consider outgoing payments in an operations team.

• First line: operations owns the risk of wrong payments. Its control is dual authorisation for every payment above EUR 50,000. The team also reconciles nostro accounts daily.
• Second line: operational risk sets the policy, tracks a key risk indicator (payments released without second approval) with an amber threshold of 2 per month, and reviews the team’s risk and control self-assessment. In one month it records 3 cases and escalates.
• Third line: internal audit samples 25 large payments over six months, finds 2 without evidence of second approval, and rates the control as needing improvement, with an action due in 90 days.

Who uses it

• Internal Auditors and IT Auditors work in the third line and test the first two.
• Operational Risk Analysts and Compliance Officers work in the second line, setting frameworks and challenging the business.
• Risk Advisory Consultants and Internal Audit Consultants help firms design the lines, roles and reporting.
• First-line control and risk teams, often called business control or first line of defence teams, coordinate controls inside the business.

Common confusions

• The second line does not own the first line’s risks. It sets standards and challenges, and the business stays accountable.
• Internal audit is independent of both other lines and reports to the audit committee.
• Some firms add a fourth line for external auditors and supervisors. This is a description, and those parties are outside the firm.
• Being in the first line does not mean having no risk skills. Many first-line teams run detailed control testing of their own.