IIA-Australia Factsheet - The 3 Lines Model – What Assurance Goes Where  

IIA-Australia Factsheet - The 3 Lines Model – What Assurance Goes Where  

This is a members only resource. Please login to access. 

Author

IIA-Australia

Date

2022

Topics Explored

Internal Audit

Format

Factsheet

Extract/Description

The 3 Lines Model is a top-down model. It was designed around the sources of independent information available to an organisation’s governing authority / board of directors. It is difficult to assess which line an assurance activity should be in without looking at where it is reporting and who is in control.

Key Points

  1. If an assurance activity is commissioned by management, it must be Line 1 or Line 2.
  2. If an assurance activity is commissioned by the governing authority or audit committee, independent of management, it will be Line 3.
  3. Management system audit will not be Line 3 as it is not commissioned independent of management – this applies even when an independent third party performs a surveillance audit or accreditation renewal audit of an organisational management system – it would be considered Line 1 or Line 2.
  4. Assurance activities commissioned by an external party such as a regulator will be external assurance.

Relevant Industries

All

Level of Assumed Knowledge

Intermediate