In plain English
The first line, the business and operational teams, owns and manages risk day to day. The second line, such as risk and compliance, sets the rules and monitors and challenges the first line. The third line, internal audit, gives the board independent assurance that the first two are working.
Each line should be independent of the one it checks. The Institute of Internal Auditors updated the language in 2020 as the Three Lines Model, which emphasizes accountability and collaboration, although many regulators and institutions still use the original three lines of defense wording.
Why it matters to a board
When something goes wrong, supervisors ask which line should have caught it, and whether that line had the authority, skills and information to do so.
Common mistakes
- Compliance doing the first line's work, so the business never takes ownership.
- Internal audit advising on design and then auditing its own advice.
- Second line staff who lack the standing or expertise to challenge.