Three lines of defence

Roles that need it

• Compliance Officer
• Operational Risk Analyst
• Internal Auditor
• Internal Audit Consultant
• Risk Advisory Consultant

Skills it belongs to

• Internal controls and risk oversight
• Control mindset (what could go wrong)
• Corporate governance

Related concepts

• SM&CR (Senior Managers and Certification Regime)The Senior Managers and Certification Regime is the UK individual accountability framework of the FCA and PRA. It has three parts: the Senior Managers Regime, with prior approval and statements of responsibilities; the Certification Regime, where firms certify staff in key roles as fit and proper each year; and the Conduct Rules.
• Fit and proper assessmentA fit and proper assessment checks that members of a bank's management body and key function holders have the knowledge, skills, experience, reputation, honesty, integrity and time commitment for the role. It is required by Article 91 of the CRD and done by the firm and by the supervisor, in the euro area the ECB for significant banks.
• Outsourcing (EBA Guidelines)Outsourcing is an arrangement in which a service provider performs a process, service or activity that the institution would otherwise perform itself. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) set governance, risk assessment, contract and register rules, with stricter terms for critical or important functions.

Sources

• Directive 2013/36/EU (Capital Requirements Directive), EUR-Lex (external site) accessed 31 Oct 2026
• Corporate governance principles for banks, Basel Committee on Banking Supervision (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.