11.1 The Three Lines Model in Assurance Coordination

11.1 The Three Lines Model in Assurance Coordination

[!NOTE] Evolution to Value Creation: In 2020, The Institute of Internal Auditors (IIA) updated the legacy 'Three Lines of Defense' framework to the IIA Three Lines Model. This update transitioned organizational governance from a defensive, siloed risk-containment posture into a collaborative, principle-based model focused on value creation and protection.

In modern governance, organizations face volatile, interconnected risks spanning cyber disruptions, regulatory changes, and business transformations. Managing these threats cannot occur in operational silos. The governing body and senior management require coordinated oversight where operational managers, specialized risk monitors, and independent auditors work in structured alignment. The IIA Three Lines Model provides the foundational architecture for orchestrating this governance and assurance coordination.

---

Foundational Principles and Structural Architecture

The IIA Three Lines Model articulates six core principles: governance structures enabling accountability and action; governing body oversight; management's first- and second-line roles; third-line independent assurance; third-line independence; and collective value creation. The model delineates governance responsibilities across three functional components:

1. The Governing Body

The governing body (e.g., Board of Directors, Audit Committee) holds ultimate fiduciary accountability to stakeholders. It defines organizational purpose, establishes risk appetite, delegates authority and resources to management, and oversees executive performance. It maintains functional oversight of the Chief Audit Executive (CAE), approving the internal audit charter, risk-based audit plan, and resource allocation, while receiving direct, unfiltered assurance reports.

2. First-Line Roles: Operational Management and Controls

First-line roles encompass operational units directly delivering products and services to clients. Operational managers directly own and manage risks, designing, executing, and monitoring day-to-day internal controls. First-line assurance is management self-assurance (supervisory reviews, control self-assessments). While essential, it carries inherent operational bias because managers are evaluated on commercial production targets.

3. Second-Line Roles: Specialized Expertise and Monitoring

Second-line roles provide specialized assistance, frameworks, monitoring, and challenge to first-line operations. Functions include Enterprise Risk Management (ERM), Regulatory Compliance, Information Security (CISO), Quality Assurance, and Legal. Second-line assurance is specialized management assurance. Although separate from frontline operations, second-line functions report to executive management (e.g., CRO, General Counsel, CCO) and therefore lack organizational independence from executive leadership.

4. Third-Line Roles: Independent Internal Audit Assurance

The third line is occupied exclusively by internal audit. Internal audit provides independent, objective assurance and advice on the adequacy and effectiveness of governance, risk management, and internal controls across first- and second-line activities. Internal audit achieves organizational independence through direct functional reporting to the governing body and strict avoidance of operational management duties.

---

Comparative Matrix: Delineating the Three Lines

---

Coordinating Assurance While Preserving Objectivity

Under GIAS Standard 9.5 (Coordination and Reliance), the CAE must coordinate internal audit activities with second-line functions to optimize coverage and eliminate duplicate testing. Coordination mechanisms include establishing a common risk taxonomy with standardized risk definitions and severity scales, sharing second-line risk registers and breach logs during audit planning, and synchronizing review calendars.

However, internal audit must vigorously safeguard its objectivity. Internal audit may utilize second-line monitoring data, but must never allow second-line managers to dictate internal audit scope or conclusions. When executive management pressures the CAE to assume operational second-line duties (such as facilitating ERM or administering the whistleblower hotline), strict safeguards under GIAS Standard 2.2 (Safeguarding Objectivity) must be instituted:

• The CAE's objectivity is formally impaired for auditing that operational area.
• The dual role must be approved by the Audit Committee and documented in the internal audit charter.
• Any required assurance over the managed area must be performed by an independent external party or separate team reporting directly to the board.

---

Eliminating Assurance Gaps and Alleviating Audit Fatigue

Uncoordinated assurance generates two severe governance pathologies: assurance gaps and audit fatigue.

An assurance gap arises when a critical enterprise risk receives no objective evaluation because each layer assumes another function is monitoring it (e.g., operations assumes compliance tracks vendor cybersecurity, compliance assumes internal audit scheduled an audit, and internal audit assumes operational scorecards suffice). To eliminate gaps, the CAE and second-line leaders must construct joint risk universe maps and hold quarterly alignment sessions to establish explicit oversight boundaries.

Conversely, audit fatigue occurs when operational units are overwhelmed by continuous, uncoordinated data requests, interviews, and audits by compliance, risk, internal audit, and external auditors. This churn disrupts business operations and fosters organizational friction. Leading CAEs resolve audit fatigue by establishing a centralized document repository where business units upload core evidence once annually, coordinating integrated testing schedules, and placing structured reliance on validated second-line testing under GIAS Standard 9.5.