Modernizing the three lines of defense model

Pressures on the traditional three lines of defense model

Businesses are continuing to evolve out of necessity, responding to an onslaught of disruption, new business models, and technology. This continuous change affects business operations at all levels, with customers demanding real-time interactions, regulators applying increasing levels of scrutiny, and governance stakeholders requiring assurance in this complex and dynamic risk environment. The result has exposed weaknesses in the traditional three lines of defense (3LOD) risk management model.

In its current form, is the 3LOD framework still relevant and efficient? As the risk landscape becomes more complex and fast-moving, it is critical for organizations to identify and respond to emerging risk events quickly and effectively. We believe that internal audit (IA) should play a key role in this evolution.

Back to top

Current-state challenges with 3LOD

Different groups within organizations play a distinct role within the three lines of defense model, from business units to compliance, audit, and other risk management personnel.

• First line: Management (process owners) has the primary responsibility to own and manage risks associated with day-to-day operational activities. Other accountabilities assumed by the first line include design, operation, and implementation of controls.
• Second line: The second-line function enables the identification of emerging risks in daily operation of the business. It does this by providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support risk and compliance management.
• Third line: The third-line function provides objective and independent assurance. While the third line’s key responsibility is to assess whether the first- and second-line functions are operating effectively, it is charged with the duty of reporting to the board and audit committee, in addition to providing assurance to regulators and external auditors that the control culture across the organization is effective in its design and operation.

While the 3LOD framework is widely acknowledged and understood by a range of industries as the governance model for risk, its implementation varies in form and maturity across the spectrum. Traditionally, the role of IA functions is to provide assurance while maintaining objectivity and independence; however, its mandate should continue to evolve as the need to adapt to a business-focused, technology-driven, advisory mindset is amplified.

Back to top

3LOD future state and opportunities

IA functions with the strongest impact in their organizations are those which are adapting to change; collaborating; and making investments in digital assets, analytics, and automation. New technologies have created an opportunity to enable a variety of techniques to improve efficiency and insight from assurance activities, including 100 percent assurance coverage (rather than sampling), automation of assurance tasks, and real-time insight into emerging risks via data-led, continuous monitoring. This creates an opportunity for IA and its future role.

To take advantage of these changes and disruptions, auditors need to rethink their role by adapting to and embracing change, enabling the IA function to become more agile, nimble, and forward-looking, thus driving change through the three lines of defense model.

For IA to be perceived as protecting, building, and preserving value, it needs to truly assure, advise, and anticipate. The IA of the future will play an active role in educating stakeholders and sharing tools, insights, and knowledge. Effective IA functions with a dynamic and forward-looking mindset are likely to be viewed positively by key stakeholders. While the maturity of IA groups within individual organizations will vary, the key is to start identifying current inefficiencies in an organization’s 3LOD model and to encourage innovation with meaningful, strategic steps. Innovation should extend beyond technology, including coordination, communication, audit and risk assessment methodology, and elevating engagement connection with first- and second-line stakeholders. With a renewed vision, IA would be in a better position to strengthen its impact and mobilize itself for future challenges and opportunities.

Back to top

New possibilities for IA

IA is at the cusp of innumerable possibilities to collaborate with the other lines in the three lines of defense model, develop roadmaps, and help improve governance across the organization. Here is a great opportunity for the profession to redefine itself and cement its position as not only a provider of assurance, but also a function that assures, advises, and anticipates. Our point of view represents fulfilling assurance responsibilities with combined core assurance spread throughout the lines of defense, rather than just through IA, but also includes the imminent need for IA to advise the business with anticipation and measurement of risk. These are the critical elements of the IA of the future (see Deloitte POV: Internal Audit 3.0), which will create capacity for IA to focus on the truly most relevant and impactful risks to the organization.

Back to top