Three Lines of Defence Model to be reviewed

by Tony Rasman | Jul 31, 2019

The Three Lines of Defence model is being reviewed by IIA-Global and IIA-Australia is establishing a task force to submit a response. 

The model has served a broad range of industries for over 20 years, and the objective of the global working group is the creation of a fit-for-purpose model that is adaptive enough to apply to all sectors.

IIA-Australia CEO Mr Peter Jones said immediate past President, Mark Harrison, will be the Chair of the Australian Task Force, which will include senior internal audit practitioners.

IIA-Global said in a statement “the main criticism is that the model suggests rigid structures and creates a tendency toward operational silos, which can be less efficient and effective”.

Mr Jones said internal audit independently evaluates and gives opinion on the adequacy and effectiveness of both the first line and second line of risk management approaches. It is a form of assurance independent of management.

“This model is used by many entities to define and control the risk management environment, and to provide assurance to the Board, audit committee, CEO, senior executives and stakeholders about effective governance”.

ING Head of Corporate Audit Services in Australia Bruce Lawson said The Three Lines of Defence is articulated very well in the risk management strategy, but often the implementation of the model is less effective if driven from the top down.

“Organisations need to raise the risk profile of all roles across the whole organisation so that everyone considers and owns risk as part of their job. This needs to be supported by very clear behaviours and values,” he said.

Mr Jones said “It is now evident that the head of internal audit plays a critical role in achieving good governance and is a critical player as the Third line of Defence”.

“But from our initial research, it’s clear the model is not widely adapted beyond the financial services sector, and the role of each of the defence lines are very blurry”. 

The Task Force will review these elements and make recommendations to the global working group. If members wish to provide a comment before Friday the 23rd of August please refer to IIA-Global exposure document

The Three Lines of Defence task force membership will be announced shortly and the submission to global will be released early September.

Please provide comments to: