The IIA's Three Lines Model: An Update of the Three Lines of Defense

The Institute of Internal Auditors. (2020). The IIA's Three Lines Model: An Update of the Three Lines of Defense: An Update of the Three Lines of Defense.

Type

Report

Intellectual base

Grey literature

Year

2020

Link

https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/

Cited from

systems_cybernetics

Cited by

3 citations across 3 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Swiss Cheese Model (Layered Defense with Aligning Holes)
  • In financial risk controls, position limits, risk-manager veto, internal and external audit, and regulators stack as leaky layers, with major fraud cases reading as alignment under correlated holes.

    This sourceOperational management, risk/compliance functions, and internal audit as stacked 'lines of defense' against governance and control failures — leaky defensive layers in financial-risk governance.

Mechanisms

• Audit Cycle
  • The guarding discipline is the three lines of defense separation

    This sourceAssigns internal audit an independent reporting relationship to the governing body, which receives and considers its findings.

• Compliance Review
  • It is the natural home of the second line of defense — a control function separate from the operators (the first line) that tests their work against the rules before it reaches independent audit (the third line).

    This sourceInstitute of Internal Auditors, Position paper, July 2020. https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/ Places risk and compliance support and challenge in second-line management roles, operational delivery in the first line, and independent assurance in internal audit as the third line.

Verification

Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.

Does it back the claim? Not recorded. Neither this nor any other of the 3 citations of this work carries a recorded support check.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Links previously used in the corpus

Before the registry existed this work was also linked 1 other way.

• https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf ×1

Registry ID ref:c47d799a2d95 · see in the full table