We design and implement the three lines of defense model in your organization: operational risk management, a compliance and oversight function, and independent internal audit. A corporate governance framework that protects value and follows IIA best practices.
Free consultation
We reply within 24 h
From the initial diagnosis to implementation and audit of the model: a risk management framework tailored to your organization.
We define the structure of roles and responsibilities for each line: first line (operational management), second line (compliance, risk control, regulatory compliance) and third line (internal audit). Tailored to the size, sector and complexity of your organization.
We review your current three lines model: risk coverage, independence of internal audit, effectiveness of controls, coordination between lines and alignment with the IIA 2020 principles.
Design and implementation of the compliance function as the second line: policies, procedures, risk oversight, reporting to senior management and coordination with the first and third lines.
Identification, assessment and prioritization of risks. Definition of the risk appetite approved by the governing body and alignment with the three lines of defense.
In obliged entities, the AML/CFT function is a specialized second line of defense: compliance officer, monitoring, suspicious transaction reporting and due diligence.
For regulated entities (investment firms, asset managers, payment institutions), the three lines of defense are a supervisory requirement: MiFID II, Solvency II, Basel III and sector-specific rules.
Financial institution, industrial company, regulated startup or multinational group: the model adapts to the size, sector and risk profile of each organization.
“For financial institutions, the three lines of defense are a regulatory requirement. The first line manages operational risk, the second includes compliance, internal control and risk management, and the third is internal audit, reporting directly to the audit committee.”
“In non-financial companies, the model adapts: the first line is the heads of each area, the second can be a single compliance officer or one shared with legal and risk, and the third can be partly outsourced if there is no internal audit function.”
“Fintechs must put the three lines in place from the start. With small teams, first- and second-line roles can be combined, but the independence of the third line is non-negotiable in the eyes of the regulator.”
“In multinational groups, the three lines are replicated at the local and global levels. Coordination between the corporate compliance function and the local units is key to avoiding coverage gaps and duplication.”
Without a structured risk management framework, the organization is exposed to control gaps, duplication and a lack of independent oversight.
Gaps in risk coverage: without defined roles, some risks have no owner. Nobody identifies, assesses or mitigates the risks that fall between functional areas.
Duplicated functions: without coordination between lines, several areas may be controlling the same thing while other critical risks go unattended. Inefficiency and a false sense of security.
Lack of independence in oversight: if internal audit reports hierarchically to operational management, it loses the objectivity needed to challenge management decisions.
For financial institutions, implementing the three lines of defense is an explicit regulatory requirement. Its absence or deficiencies can lead to supervisory requests for information and even penalties.
Article 31 bis of the Spanish Criminal Code requires an organization and management model with oversight and control measures. The three lines of defense are the natural structure for meeting this requirement.
Investors, partners, regulators and clients expect robust corporate governance. The three lines of defense are the international standard for demonstrating maturity in risk management.
We design, review or audit your three lines of defense model: roles, responsibilities, coordination between lines, risk appetite and alignment with IIA 2020. A framework that protects and builds trust.
The three lines of defense model (3LoD) is a governance and risk management framework that structures the organization into three levels of protection: the first line (operational management, which owns the risks), the second line (oversight, compliance and risk control functions) and the third line (independent internal audit).
It was popularized by the Institute of Internal Auditors (IIA) and updated in July 2020 with the “Three Lines Model,” which puts greater emphasis on value creation, coordination and alignment with the organization’s objectives.
It depends on the sector and the jurisdiction. For financial institutions (banks, investment firms, asset managers, insurers), implementing the three lines is an implicit or explicit regulatory requirement stemming from MiFID II, Solvency II, Basel III and EBA and EIOPA guidelines.
For non-financial companies, it is not legally mandatory, but it is the good-practice standard in corporate governance. In addition, Article 31 bis of the Spanish Criminal Code requires an organization and management model with oversight and control measures, which the three lines of defense satisfy naturally.
In July 2020, the IIA published the “Three Lines Model” (dropping “of defense” from the name), with significant changes from the 2013 model:
The compliance function sits in the second line of defense. Its role is to oversee regulatory compliance, advise the first line on regulatory risks, set policies and standards, and report to senior management and the governing body.
In some organizations, compliance may coexist with other second-line functions such as risk management, internal control, information security or money laundering prevention. The key is that each function has a clear mandate and that there are no gaps or overlaps.
Yes, with some nuances. The first line is inherently internal (it is operational management). The second line can draw on external advisers, but responsibility remains with management. The third line (internal audit) can be outsourced in whole or in part, although regulated entities are required to keep a minimum internal function.
There is also an informal “fourth line”: external auditors, regulators and supervisors who provide additional assurance from outside the organization.
Article 31 bis of the Spanish Criminal Code provides that a legal entity can be exempt from criminal liability if it has an organization and management model that includes oversight and control measures to prevent offenses. The three lines of defense are the natural structure for meeting this requirement.
The first line implements the operational controls, the second line (compliance) oversees compliance and criminal prevention, and the third line (internal audit) verifies the effectiveness of the model. The UNE 19601 standard on criminal compliance management systems is aligned with this approach.
In the IIA’s updated model (2020), the governing body (board of directors, audit committee) has an explicit and central role: it sets the organization’s objectives, defines the risk appetite, delegates responsibilities to management and oversees how the three lines work.
The governing body receives reports from all three lines and, in particular, from internal audit, which must report to it directly to guarantee its independence from management.
An effective three lines model requires clear roles, real coordination between lines and genuine independence of internal audit.
The business areas are the first to identify and manage risks. They must put internal controls in place, execute mitigation plans and report incidents. Without an effective first line, the whole model fails.
Compliance, risk management and internal control oversee the first line: they set policies, monitor compliance, challenge risk decisions and report to senior management. They act as the organization’s umbrella.
Internal audit provides independent and objective assurance on the effectiveness of the first two lines. It must report to the governing body (audit committee) and be independent of operational management.
If you need help with your three lines of defense model, see our compliance services or request a free consultation.
An effective three lines of defense model is not a decorative org chart: it is a living risk management system with defined roles, real coordination and independent assurance.
1st LineThe business areas own the risks: they identify, assess, control and mitigate them in their daily activity.
2nd LineSpecialized functions that oversee, advise and challenge the first line. They set policies, monitor compliance and report to management.
3rd LineProvides objective, independent assurance on the effectiveness of risk management and internal controls in the first and second lines.
GovernanceThe board of directors or audit committee sets the risk appetite, oversees the three lines and receives reports from all of them. Coordination between lines prevents gaps and duplication.
By sectorRegulatory requirement. Formal three lines with specialized functions and reporting to the supervisor.
Scaled to size. The 2nd line can be compliance + legal. The 3rd line can be outsourced.
Combined 1st and 2nd line roles. 3rd line outsourced. Scales progressively as the company grows.
Identifies, assesses and manages the risks of its own activity. Implements controls and mitigation plans.
Sets risk frameworks, policies and standards. Oversees and challenges the 1st line’s risk management.
Runs the controls designed for its area. Carries out self-assessments and reports incidents.
Designs the internal control framework, monitors compliance with it and proposes improvements to management.
Complies with internal policies and procedures. Applies regulatory requirements in its day-to-day operations.
Interprets the regulations, defines the obligations, trains the 1st line and reports to the regulator when necessary.
Reports incidents and KRIs to the 2nd line and to the management of its functional area.
Reports the overall risk picture to senior management and, where applicable, to the governing body.
If you spot any of these signs, the model needs an urgent review.
If you are designing or reviewing a three lines of defense model, these are the terms you need to master.
Governance framework that structures risk management into three levels: operational management, compliance/risk oversight and independent internal audit. IIA standard.
International organization that sets standards and guidance for internal audit. Author of the three lines of defense model and its updates.
The level of risk the organization is willing to take to achieve its objectives. The governing body defines it and the first line manages it within the established limits.
Area responsible for overseeing compliance with applicable regulations, internal policies and ethical standards. It sits in the second line of defense and reports to senior management.
Function that provides objective, independent assurance on the effectiveness of risk management, internal control and the governance of the organization. It reports to the governing body.
Framework for integrated management of corporate risks. The second line may include an ERM function that coordinates the overall view of risks that cut across the organization.
Spanish standard for criminal compliance management systems. It requires oversight and control measures (the three lines of defense) to prevent offenses and exempt the legal entity from liability under Art. 31 bis of the Criminal Code.
Key risk indicators that make it possible to monitor the organization’s exposure to its main risks. The first line generates them, the second oversees them and the third audits them.
Although they are not part of the internal model, regulators, supervisors and external auditors act as a fourth line of assurance for stakeholders and society at large.
THREE LINES GOVERNANCE CONSOLE
The maturity of the three lines of defense is measured along three axes: role definition (are they clear?), coordination (do the lines work together?) and independence (is the 3rd line truly independent?). This dashboard summarizes the level of requirement by sector.
The complexity and formality of the three lines vary with the regulation that applies to the sector.
Tell us about your situation and we will explain how we can help you design, review or audit your three lines of defense model.
The three lines of defense model is an internationally recognized governance and risk management framework. It originated in a joint position statement by ECIIA and FERMA in 2013 and was formalized and spread worldwide by the Institute of Internal Auditors (IIA). In July 2020, the IIA published a significant update under the name “Three Lines Model,” dropping the reference to “defense” to reflect an approach more focused on creating and protecting value.
The first line of defense is made up of the business areas and operational functions of the organization. They are the risk owners: they identify, assess, control and mitigate the risks tied to their daily activity. They put the internal controls in place and carry out the mitigation plans. Without an effective first line, the entire model loses its foundation.
The second line includes specialized functions such as compliance, enterprise risk management (ERM), internal control, information security, money laundering prevention and other oversight functions. Its mission is to oversee, advise and challenge the first line, set policies and standards, and report to senior management on the state of risks and regulatory compliance.
The third line is internal audit, whose defining characteristic is independence from operational management. It provides objective assurance on the effectiveness of risk management and internal controls in the first two lines. It must report directly to the governing body (board of directors or audit committee) to guarantee its independence.
In Spain, Article 31 bis of the Criminal Code requires an organization and management model with oversight and control measures to prevent offenses. The three lines of defense are the natural structure for meeting this requirement. The UNE 19601 standard on criminal compliance is aligned with this approach. For financial institutions, implementing the three lines is a regulatory requirement stemming from sector rules (MiFID II, Solvency II, EBA guidelines) and from supervision by the Bank of Spain and the CNMV.