Three Lines Of Defense Model

What the Three Lines of Defense Model is

The three lines of defense model is a governance structure that assigns risk ownership, control oversight, and independent assurance to different parts of an organisation. Its core value is accountability, because it prevents one team from designing, operating, and auditing the same control without challenge.

How the model separates responsibility

The first line is the business or operational function that creates and accepts risk as part of running the process. The second line sets policy, monitors compliance, and provides risk or control oversight without owning day-to-day execution. The third line, usually internal audit, evaluates whether governance and controls are working independently and reports to leadership or the board.

This separation matters because it reduces role confusion. If the same group both owns the process and independently certifies it, control failures can be missed, conflicts of interest can go unchallenged, and management may overestimate the strength of the control environment.

Why the model is used in governance

Organisations use the model to make sure risk decisions are not concentrated in one place. It creates a practical division between doing the work, supervising the work, and assuring the work, which is especially useful in regulated environments, large enterprises, and complex operating models.

The model also gives executives and boards a clearer chain of accountability. It helps show who is responsible for control operation, who is responsible for policy and monitoring, and who is responsible for independent challenge, so gaps are easier to spot when something fails.

Where the model breaks down

The framework becomes weak when the second line acts like a duplicate operations team or when the third line is treated as a routine approver instead of an independent assessor. It also loses value when responsibilities are defined on paper but not enforced in practice, leaving control failures to drift between teams.

In mature governance programmes, the model works best when each line has a distinct mandate, enough authority to perform that mandate, and clear escalation paths. Without that discipline, the model can become a label rather than a functioning control structure.

Risk and Threat Considerations

Weakly defined lines of defense can create accountability gaps, duplicate control activity, and blind spots that let issues persist longer than they should. The danger is not only that a control fails, but that no one clearly owns detecting, correcting, or independently challenging the failure.

Failure mechanism: When the first, second, and third lines overlap too much or are too loosely separated, management may rely on false assurance, policy exceptions may accumulate, and material weaknesses can remain unresolved until they surface through incidents or external review.

Impact: The result can be poor control effectiveness, delayed remediation, inaccurate risk reporting, audit findings, and greater exposure to operational, compliance, and fraud risk.

Practitioner Guidance

Governance implication: The model only works when the organisation defines ownership boundaries clearly and keeps oversight distinct from execution. Practitioners should treat the three lines as a decision on accountability, not just an organisational chart.

What to watch for: If the second line is writing controls that it later monitors, or if internal audit is being asked to approve control design, the model is being blurred. That usually signals that responsibility, independence, or escalation paths need to be reworked.

Related resources from NHI Mgmt Group

• Shared Responsibility Model
• Three Lines Model
• What should organisations measure in a layered defense model?
• What breaks when AI runtime defense only inspects chat inputs and model outputs?