The Three Lines Model

The Three Lines Model is often misunderstood.

It is not about having three layers of people checking each other.
It is about clarity of responsibility.

First line — Management

Management owns the business, the processes, the decisions, and the risks that come with them.
Risk management is not something that can simply be transferred to Risk, Compliance, or Internal Audit.

Second line — Risk, Compliance and other oversight functions

These functions provide expertise, support, monitoring, and challenge.
Their role is to help management understand and manage risk — not to take ownership of the risk away from management.

Third line — Internal Audit

Internal Audit provides independent and objective assurance over governance, risk management, and internal control.

Its effectiveness depends heavily on maintaining sufficient independence from management responsibilities.

The model looks simple on paper.
The challenge begins when responsibilities become blurred.

When management expects Risk to own the risk.
When Compliance starts operating the controls it is supposed to monitor.
Or when Internal Audit becomes too involved in management decisions — and later has to provide assurance over those same decisions.

Adding more functions does not automatically create stronger governance.
Sometimes the more important question is:

Does everyone actually know what they own?

Different roles.
Shared objective.
Better governance.

Beyond the numbers. Inside the business.