Three tall buildingsThe Institute of Internal Auditors (IIA) has released an update to The Three Lines of Defense Model, now known as the Three Lines Model. Issuance of the new model is both timely and relevant, considering the circumstances surrounding COVID-19 and the anticipated economic/business impact on a prospective basis.

The model is based on six key principles:

  1. Governance –The governance of an organization must have appropriate structures and processes that enable accountability, actions and assurance, and advice.
  2. Governing Body Roles – The governing body ensures appropriate processes and structures are in place for effective governance. It also makes sure that objectives and activities are aligned/prioritized with that of relevant stakeholders.
  3. Management and First- and Second-Line Roles – Management activities include both first- and second-line roles in achieving organizational objectives. First-line roles are more associated with the delivery of products/services and specific support functions. Second-line roles often provide assistance that is focused on managing risk. Both first- and second-line roles operate concurrently.
  4. Third-Line Roles – The role of internal audit is to provide both independent and objective assurance and advice relating to the adequacy and effectiveness of governance and risk management.
  5. Third-Line Independence – Internal audit must maintain independence from management so as not to impair its objectivity, authority, and credibility.
  6. Creating and Protecting Value – These three roles work together to create and protect value when aligned and prioritized with stakeholder interests. Alignment is achieved through communication, cooperation, and collaboration.

Like its predecessor, the updated model includes a diagram that provides a visual reference of these principles in action. It also expands on key roles and relationships included in the updates.

For more information regarding the updated model, or if you have any questions about the key principles above, be sure to reach out to a CRI advisor.