Three lines of defence

Several experts told us that the "three lines of defence" model is useful as a clear and effective way to strengthen communications on risk management, assurance, and control by clarifying essential roles and duties for various parts of governance, management, and day-to-day operations.

See more information on the "three lines of defence" model

The "three lines of defence" model was described as useful when thinking about the structure of entity, who is responsible for providing assurance, and to what level


When audit committees/management have difficulty understanding different roles and responsibilities, this framework can help clarify the conversation. This framework can help oversight functions explain why an issue occurred and, if steps had not been taken, why they weren't.