Lesson 3.47: The three lines model and independence
Organisations separate who runs risks, who oversees them and who gives independent assurance. The Institute of Internal Auditors' Three Lines Model (2020) describes first-line roles (management delivering products and services, owning and managing risk), second-line roles (expertise, oversight and challenge on risk, such as risk management and compliance) and third-line roles (internal audit, independent assurance to the governing body). It works only if each line stays in its role: a second line that operates controls can't challenge them, and an auditor can't audit their own former work. In the lab you map Northwind's teams to lines, find a role conflict and a self-review threat, and write the fixes.
18 min
You will learn to
- Explain the three lines and the governing body
- Map teams and activities to lines
- Find second-line teams operating first-line controls
- Check internal audit's reporting line
- Find self-review threats to independence
Key terms
- First line
- Management roles that deliver products and services and own and manage the risks.
- Second line
- Expertise, support, oversight and challenge on risk.
- Third line
- Internal audit: independent, objective assurance to the governing body.
- Self-review threat
- Assessing work you designed or performed yourself.
- Functional reporting
- Who sets direction and receives results (for audit: the audit committee).
← Getting ready for a SOC 2 audit · All lessons · Working with legal counsel and regulators during an investigation →