Three Lines or Just Three Departments?

Many organizations say they have a Three Lines Model.

They have Operations.
They have Risk and Compliance.
They have Internal Audit.

But the existence of three functions does not automatically mean the Three Lines Model is working.
Sometimes, we simply have three departments.

And that is different.
The model depends on clarity of roles and accountability.

First Line — Own the risk

Management and operational teams own the business activities, decisions, controls, and risks that come with them.
Risk ownership should remain with the people responsible for running the business.

Second Line — Support, monitor, and challenge

Risk, Compliance, and other second-line functions provide expertise, oversight, monitoring, and challenge.
Their role is not to take ownership away from management, but to help strengthen how risk is understood and managed.

Third Line — Provide independent assurance

Internal Audit provides independent and objective assurance over governance, risk management, and internal control.

Its role is not to operate management controls or replace second-line oversight.
The Three Lines Model works when these responsibilities remain distinct but connected.
Not when one line replaces another.
Not when accountability is transferred.
And not when additional functions simply create more layers of bureaucracy.

The more useful test is not:
“Do we have Three Lines?”

It is:
“When something goes wrong, can we clearly identify who owned the risk, who provided oversight and challenge, and who independently assessed whether the system was working?”

If that answer is unclear, the issue may not be the organizational chart.
It may be the governance model itself.

Because having three functions is not the same as having an effective Three Lines Model.

Different roles. Clear accountability. Stronger governance.

Beyond the numbers. Inside the business.