The IIA's Three Lines Model is a framework for effective risk management and governance, structuring roles into three distinct, collaborative lines. It divides responsibilities between managing risks (1st line), monitoring them (2nd line), and providing independent assurance (3rd line) to the board.
The Three Lines of Defense (3LoD) model is a framework for managing risk by clearly defining roles and responsibilities across three distinct levels: operational management, risk management and compliance, and internal audit.
The third line is the internal audit team, which of course needs to remain independent and objective on matters related to the adequacy and effectiveness of governance and risk management, as well as internal controls.
As originally conceived:
The Three Lines Model by The Institute of Internal Auditors (IIA) emphasizes the distinct roles of managing risks (first line), monitoring risks (second line), and providing independent assurance (third line).
The Big 4 are the largest accounting and auditing firms in the world: Deloitte LLP (Deloitte), PricewaterhouseCoopers (PwC), Ernst & Young (EY) and Klynveld Peat Marwick Goerdeler (KPMG). They're so big that their joint revenue in 2024 was—you guessed it—$212 billion.
A successful internal audit function relies on four fundamental pillars, often referred to as the “4 C's”: Competence, Confidentiality, Communication, and Collaboration. These principles guide auditors in delivering meaningful and impactful results. Let's explore each of these elements in detail.
The Three Lines of Defense is an AML-CFT compliance framework that designates roles for frontline employees managing risks, a team overseeing compliance, and internal audit for oversight. This structure strengthens defenses against money laundering and the financing of terrorism.
The Three Lines of Defense Model addresses these weaknesses by clearly defining roles: the first line owns and manages risk in day-to-day operations, the second line provides oversight and guidance to ensure risks remain within appetite, and the third line offers independent assurance through internal audit.
The third line of defence is the internal audit function. The internal audit function is responsible for providing independent assurance that the organisation's risk management framework is effective.
Let's be blunt: the Three Lines of Defence have become the Three Lines of Delay. The model worked well when organizations were slower and risk was compartmentalized. It gave boards comfort, regulators a structure, and managers a sense of order. But over time, it hardened into bureaucracy.
The process employed by the Office of Internal Audit in performing audits follows three general phases comprising planning, fieldwork, and reporting.
The 3 lines are the image you can see on the scan of a baby girl's genitals: the clitoris, surrounded by the 2 lips of the labia. So if there are 3 lines on your pregnancy scan, you're pregnant with a little girl. "Sonographers look for the distinguishing signs of the different genitalia," says Professor Lees.
The three Ps of compliance | People, processes & products | ManageEngine Academy.
Internal Audit governance ensures clarity over the purpose and responsibilities of the audit. Audit governance ensures clarity over the purpose and responsibilities of the audit, that there's an official mandate and clear departmental goals are in place.
Principle 4: Third line roles
The internal audit function provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management.
Implementing the Three Lines of Defense model involves several key steps: Establish Clear Roles and Responsibilities: Define and communicate the roles of each line – operational management (1st line), risk management/compliance (2nd line), and internal audit (3rd line).
Layer 1: Operators and frontline workers conduct daily audits of their own processes. Layer 2: Supervisors perform weekly audits within their departments. Layer 3: Operations managers conduct monthly audits on quality and review LPA reports.
The four core pillars of an effective Anti-Money Laundering (AML) program are: a designated Compliance Officer, robust Internal Controls (policies, procedures, risk assessments), ongoing Employee Training, and regular Independent Testing (auditing) of the program, all designed to prevent financial institutions from facilitating money laundering or terrorist financing, as mandated by regulations like the Bank Secrecy Act (BSA). Some modern frameworks add customer due diligence (CDD) or risk assessment as a fifth pillar, but these four remain foundational.
AML encompasses laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. To effectively combat these threats, financial institutions must understand the three stages of money laundering: placement, layering, and integration.
A connected risk approach aims to connect risk owners to their risks and promote organization-wide risk ownership by using integrated risk management (IRM) technology to enable improved Communication, Context, and Collaboration — remember these as the three C's of connected risk.
The Audit Bureau of Circulations (ABC) of India is a non-profit circulation-audit organisation. It certifies and audits the circulations of major publications, including newspapers and magazines in India.
ACL Analytics (Galvanize, now part of Diligent) is one of the most popular tools. It is specifically designed for audit professionals and enables users to analyse 100% of the data, identify patterns, anomalies, and issues in financial and operational data.
The “5 P's of Internal Audit” includes 5 video-clips presenting testimonials from audit managers on the topics of Plan, Perform, People, Profile and Product.