What is the Three Lines Model in risk management?

Conditions

• Applies to companies and business endeavors where risk must be managed.
• Presented as one of several standardized risk-management approaches.

Reasoning, step by step

1. Identify the model as a standardized approach to risk management.
2. Recognize that it involves three lines of defense against risk.
3. Note that the model is defined by the Institute of Internal Auditors (IIA).
4. Understand its purpose is to provide structure around risk management and internal governance.

Example

The presenter states: "The three lines model is one of a few standardized approaches to risk management involving... three lines of defense against risk. Defined by the Institute of Internal Auditors or IIA, the model intends to provide structure around risk management and internal governance."

Common misconceptions

• Thinking it is the only standardized approach to risk management.
• Assuming it only applies to financial institutions.

Watch the explanation

Explore next

• What does the first line of defense do?
• Which roles belong to the second line of defense?
• What is the purpose of the third line of defense?