Eye on Tech · YouTube · 3:03
This 120-second introductory explainer defines the Three Lines Model as a standardized risk-management structure attributed to the Institute of Internal Auditors (IIA). It first states that risk is inherent in every company and that managing risk affects operational and financial success. The video then builds a diagram of the "Three Lines of Defense Model": the first line is management, which owns risks from daily activities; the second line is risk management and compliance, which implements and monitors the risk program; and the third line is audit, described in narration as internal and external auditors who objectively ensure the first two lines are effective and evaluate the risk management program. A top bar labeled "Governing Body" directs and receives reports from all three lines, and the presenter lists its responsibilities as establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process. Near the end, a heading for "3 Lines Model Benefits" appears, but the clip stops before any benefits are explained. This video segment outlines the key benefits and challenges of the Three Lines Model in risk management. Benefits include improved communication, increased governance, efficient resource allocation, and holistic risk awareness. Challenges involve skills gaps in the first line of defense, an over-focus on compliance, the need for change management, unclear risk ownership, and a lack of meaningful reporting.
Use the learning inspector for key ideas and moments, or open the reading tabs for the complete notes.
Generated from the video's visuals and explanation; not verbatim speech.
The clip opens by asking whether a company has three lines of defense, then presents the topic as an introduction to the Three Lines Model.
It first frames the problem in business terms: risk is inherent in every company and business endeavor, and the way an organization manages that risk affects operational and financial success.
From that motivation, the presenter introduces the Three Lines Model as one standardized approach to risk management. She says it involves three lines of defense against risk and attributes the model's definition to the Institute of Internal Auditors, abbreviated IIA. The stated purpose is to provide structure around risk management and internal governance.
Before detailing the model, the video briefly shows a TechTarget article titled "What is risk management and why is it important?" as supporting context. The visible article text defines risk management as the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, and the narration directs viewers to the linked article for more background.
The main explanation then shifts to a diagram titled "Three Lines of Defense Model." The first component introduced is the first line: management. The video states that this line controls and takes ownership of risks associated with daily activities. The example given is managing risk at a high level, such as ensuring products and services are delivered safely to customers.
Next, the second line is added to the diagram. This line is identified as risk management and compliance. The presenter names example roles such as risk manager, compliance officer, and information security officer. The function of this line is to implement and monitor the company's risk management program and to keep track of regulatory issues or unethical behavior.
The third line is then introduced as audit. The narration says it includes internal and external auditors whose job is to objectively ensure that the first and second lines are effective and to review and evaluate the risk management program. Visually, the third box is labeled "INTERNAL AUDITORS," while a separate vertical bar on the right is labeled "External Auditors."
After the three lines are in place, the diagram shows arrows connecting them to a top bar labeled "Governing Body." The presenter explains that all three lines report to and receive direction from this body, which she describes as the top leadership or management team that makes decisions.
The clip then specifies the governing body's risk-management responsibilities: establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process. These points are reinforced by icons of a gauge, speech bubbles, and a clipboard with a magnifying glass.
At the end, the presenter begins to transition into the advantages of the model, saying it helps organizations proactively manage and address risks. A heading reading "3 Lines Model Benefits" appears, but the clip ends before any specific benefits are listed.
The Three Lines Model provides significant advantages for organizational risk management. It improves communication, encouraging better information sharing across departments. It increases governance, which helps minimize legal and reputational risks. Furthermore, it allows for efficient resource allocation by distributing responsibilities across all three lines of defense, and promotes complete risk awareness by offering a holistic view of potential threats.
However, implementing this model comes with distinct challenges. Organizations often face skills and knowledge gaps within the first line of defense, which is crucial for comprehensive risk management. There is also a risk of focusing too heavily on compliance rather than tailoring the approach to the organization's specific needs. Gaining employee buy-in requires effective change management. Additionally, risk ownership can become unclear, particularly in the first line, and there may be a lack of meaningful reporting to evaluate the true effectiveness of these risk management efforts.
To wrap up, consider the risk management approach your own company utilizes and who should bear the responsibility for it. You are encouraged to share your thoughts in the comments section and to like and subscribe for more content.
The Three Lines Model is introduced as a standardized approach to risk management that organizes defenses against risk into three lines and provides structure for risk management and internal governance. The video attributes the definition to the Institute of Internal Auditors (IIA).
The opening claim is that risk is inherent in every company and business endeavor, and that how an organization manages risk determines its operational and financial success. This motivates the need for a structured model.
The first line of defense is management. Its responsibility is to control and take ownership of risks associated with daily activities. The video gives the example of ensuring products and services are delivered safely to customers.
The second line consists of risk management and compliance roles, such as risk manager, compliance officer, or information security officer. This line implements and monitors the company's risk management program and watches for regulatory issues or unethical behavior.
The third line is the audit function. The narration says it includes internal and external auditors who objectively ensure the first and second lines are effective and who review and evaluate the risk management program. In the diagram, the third box is labeled "INTERNAL AUDITORS" and a separate vertical bar is labeled "External Auditors."
All three lines report to and receive direction from the governing body, described as the top leadership or management team that makes decisions. In risk management, the governing body establishes risk appetite, maintains open communication about goals, and creates and manages an internal audit process.
The final seconds begin moving into the advantages of the model. A heading reading "3 Lines Model Benefits" appears, but no specific benefits are developed within this clip.
The Three Lines Model enhances risk management through improved communication, increased governance to minimize legal and reputational risks, efficient resource allocation across all lines of defense, and complete risk awareness via a holistic perspective.
Implementing the model can lead to skills and knowledge gaps in the first line of defense, an over-emphasis on compliance instead of specific organizational needs, the necessity for change management to secure employee buy-in, unclear risk ownership, and a lack of meaningful reporting to assess effectiveness.
Explore conditions, steps and evidence. Supplementary explanations are labeled separately from content shown in the video.
The presenter says "Institute of Internal Auditors or IIA".
On-screen text shows "Institute of Internal Auditors" and then adds "IIA" beneath it.
IIA
Abbreviation for Institute of Internal Auditors.
Organization name associated with the model definition.
Diagram title reads "Three Lines of Defense Model"; first box header reads "1st Line of Defense".
Presenter says "The first line is management."
1st Line of Defense
Management layer responsible for controlling and taking ownership of risks associated with daily activities.
Organizational role in the Three Lines Model.
Second box header reads "2nd Line of Defense" with subtitle "RISK MANAGEMENT & COMPLIANCE".
Presenter says "The second line includes risk management and compliance roles..."
2nd Line of Defense
Risk management and compliance layer that implements and monitors the company's risk management program.
Organizational role in the Three Lines Model.
Third box header reads "3rd Line of Defense" with subtitle "INTERNAL AUDITORS".
Presenter says "And the third line includes internal and external auditors..."
The diagram labels the third line as "INTERNAL AUDITORS", while the narration also mentions external auditors.
3rd Line of Defense
Audit layer that objectively ensures the first and second lines are effective and reviews/evaluates the risk management program.
Organizational role in the Three Lines Model.
Top horizontal bar is labeled "Governing Body".
Presenter says "All three lines of defense report to and receive direction from the governing body..."
Governing Body
Top leadership or management team that makes decisions and directs the three lines.
Organizational role in the Three Lines Model.
Vertical bar on the right side is labeled "External Auditors".
Presenter says the third line includes "internal and external auditors".
The video does not separately define the exact reporting relationship of the external auditors beyond their placement in the diagram.
External Auditors
Auditors shown outside the three main boxes on the right side of the model diagram.
Organizational role in the Three Lines Model.
Presenter states: "The three lines model is one of a few standardized approaches to risk management involving... three lines of defense against risk. Defined by the Institute of Internal Auditors or IIA, the model intends to provide structure around risk management and internal governance."
Title card reads "Whats Three Lines Model"; later text reads "Institute of Internal Auditors" and "IIA".
The Three Lines Model is presented as a standardized approach to risk management that organizes risk control into three lines of defense and provides structure for risk management and internal governance. The video attributes its definition to the Institute of Internal Auditors (IIA).
Applies to companies and business endeavors where risk must be managed.
Presented as one of several standardized risk-management approaches.
Presenter says: "The first line is management. Their primary responsibility is to control and take ownership of risks associated with daily activities. They manage risk at a high level, like ensuring products and services are delivered safely to customers."
Box text reads "1st Line of Defense" / "MANAGEMENT" / "Control and take ownership of risks associated with daily activities".
The first line is management. Its role is to own and control risks arising from day-to-day operations, including high-level operational assurance such as delivering products and services safely to customers.
Concerns risks associated with daily activities.
Operates at the front line of business execution.
Presenter says: "The second line includes risk management and compliance roles, like a risk manager, compliance officer, or information security officer. They're responsible for implementing and monitoring the company's risk management program, keeping tabs on any regulatory issues or unethical behavior."
Box text reads "2nd Line of Defense" / "RISK MANAGEMENT & COMPLIANCE" / "Implementing and monitoring the company's risk management program".
The second line consists of risk management and compliance functions. It implements and monitors the organization's risk management program and watches for regulatory issues or unethical behavior.
Includes roles such as risk manager, compliance officer, and information security officer.
Focuses on implementation and monitoring rather than direct ownership of daily operational risks.
Presenter says: "And the third line includes internal and external auditors who objectively ensure the first and second lines of defense are effective, and also review and evaluate the risk management program."
Box text reads "3rd Line of Defense" / "INTERNAL AUDITORS" / "Ensure 1st and 2nd lines of defense are effective review and evaluate the risk management program".
Narration includes external auditors, but the third box itself is labeled only "INTERNAL AUDITORS".
The third line is the audit function. It objectively checks whether the first and second lines are effective and reviews or evaluates the risk management program.
Requires objectivity relative to the first and second lines.
Covers both assurance over line effectiveness and evaluation of the risk management program.
Presenter says: "All three lines of defense report to and receive direction from the governing body, aka the top leadership or management team that makes decisions. In risk management, the governing body is responsible for establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process."
Top bar labeled "Governing Body" with arrows connecting downward to all three lines.
The governing body is the top leadership or decision-making team above the three lines. It directs the lines, receives their reports, establishes risk appetite, maintains open communication about goals, and creates and manages the internal audit process.
Sits above all three lines in the model.
Responsible for strategic direction and oversight rather than day-to-day execution.
The speaker lists benefits such as improved communication, increased governance, efficient resource allocation, and complete risk awareness.
On-screen text displays '3 Lines Model Benefits' followed by bullet points: 'Improved communication', 'Increased governance', 'Efficient resource allocation', 'Risk awareness'.
The Three Lines Model offers several advantages to an organization's risk management framework. These include improved communication that encourages information sharing, increased governance that minimizes legal and reputational risks, efficient resource allocation by distributing responsibility across all three lines of defense, and complete risk awareness through a holistic view of risks.
Applicable to organizations implementing the Three Lines Model for risk management.
The speaker outlines challenges including skills and knowledge gaps, too much focus on compliance, change management needed, unclear risk ownership, and lack of meaningful reporting.
On-screen text displays '3 Lines Model Challenges' followed by bullet points: 'Skills and knowledge gaps in the first line of defense', 'Too much focus on compliance', 'Change management needed', 'Unclear risk ownership', 'Lack of meaningful reporting'.
Implementing the Three Lines Model presents specific challenges. Organizations may face skills and knowledge gaps in the first line of defense required for comprehensive risk management. There can be an overemphasis on compliance rather than addressing the organization's specific needs. Change management is often necessary to gain employee buy-in. Risk ownership may be unclear, particularly in the first line of defense. Finally, there might be a lack of meaningful reporting to assess the effectiveness of risk management efforts.
Applicable to organizations implementing or evaluating the Three Lines Model.
Presenter says: "Risk is inherent in every company and business endeavor. How you manage that risk is what determines your operational and financial success."
On-screen text reads "Risk is inherent in every company and business endeavor".
Risk exists inherently in every company and business endeavor, and how that risk is managed determines operational and financial success.
The subject is a company or business endeavor.
Universal over companies and business endeavors as stated in the video.
Presenter says: "All three lines of defense report to and receive direction from the governing body..."
Arrows connect the Governing Body bar to each of the three line boxes.
Each of the three lines of defense both reports to and receives direction from the governing body.
The organization uses the Three Lines Model as described in the video.
Applies to all three lines.
Presenter says: "In risk management, the governing body is responsible for establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process."
Icons appear for a gauge, speech bubbles, and a clipboard with magnifying glass during this explanation.
In risk management, the governing body is responsible for establishing risk appetite, maintaining open communication about goals, and creating and managing an internal audit process.
The discussion is within the Three Lines Model framework.
No explicit quantifier beyond the general role description.
The diagram builds sequentially: first the title and three empty boxes, then the first line fills in, then the second, then the third, then the vertical External Auditors bar, then arrows to the Governing Body, then the Governing Body label.
Narration introduces each line in order and then explains reporting to the governing body.
The screen first shows the title "Three Lines of Defense Model" with three empty boxes and a top bar.
Observed animation sequence.
The first box is populated with "1st Line of Defense", "MANAGEMENT", and the responsibility to control and take ownership of risks associated with daily activities.
Observed animation plus matching narration.
The second box is populated with "2nd Line of Defense", "RISK MANAGEMENT & COMPLIANCE", and the responsibility to implement and monitor the company's risk management program.
Observed animation plus matching narration.
The third box is populated with "3rd Line of Defense", "INTERNAL AUDITORS", and the responsibility to ensure the first and second lines are effective and to review and evaluate the risk management program.
Observed animation plus matching narration.
A vertical bar labeled "External Auditors" appears on the right, and arrows then connect the three lines upward to the top bar, which is labeled "Governing Body".
Observed animation plus matching narration about reporting and direction.
The visual build-up presents the model as three operational defense layers under a governing body, with external auditors shown alongside the audit layer.
A webpage screenshot appears with the heading "DEFINITION What is risk management and why is it important?" and visible article text defining risk management.
Presenter says: "To learn more about the importance of risk management, click the link above or in the description below."
The article text is only partially legible at normal viewing scale; the visible wording is transcribed from the clearest frames.
Provide a reference for learning more about risk management before detailing the three lines.
A TechTarget Security article page is shown on screen.
Direct viewers to additional explanation of risk management.
The video displays an article titled "What is risk management and why is it important?" with visible text beginning "Risk management is the process of identifying, assessing and controlling threats to an organization's capital, earnings and operations."
Observed on-screen webpage content.
The narration invites the viewer to click the link above or in the description below to learn more about the importance of risk management.
Observed audio instruction accompanying the article display.
The clip uses an external article screenshot as supporting context for the broader topic of risk management.
The displayed article title and visible opening paragraph match the narrated purpose of explaining risk management.
A title card appears with the TechTarget logo and the text "Whats Three Lines Model".
TechTarget logo
Title text "Whats Three Lines Model"
The presenter view transitions to a branded title card.
The background remains a light geometric pattern.
The title card identifies the topic of the explainer.
Text beside the presenter reads "Risk is inherent in every company and business endeavor".
Presenter
Overlay text
Text appears next to the presenter while she speaks.
Presenter remains centered against the same background.
The overlay reinforces the opening claim that risk is universal in business.
Text beside the presenter reads "Institute of Internal Auditors" and then "IIA".
Presenter
Overlay text "Institute of Internal Auditors"
Overlay text "IIA"
The full organization name appears first, followed by the abbreviation.
Presenter remains on screen.
The overlay attributes the model definition to the IIA.
A dark-background diagram titled "Three Lines of Defense Model" builds step by step with three boxes, a top bar, a right-side vertical bar, and arrows.
Title "Three Lines of Defense Model"
Top horizontal bar
Three rectangular boxes
Right vertical bar labeled "External Auditors"
Up/down arrows between lines and governing body
Boxes fill in from left to right.
A vertical "External Auditors" bar appears on the right.
Arrows appear between the three lines and the top bar.
The top bar becomes labeled "Governing Body".
The overall layout remains a three-column model under a top bar.
The diagram visually encodes the hierarchy and relationships among management, compliance/risk, audit, external auditors, and the governing body.
Three icons appear sequentially beside the presenter: a colored gauge, two speech bubbles, and a clipboard with a magnifying glass.
The icon meanings are inferred from the simultaneous narration; the icons themselves have no text labels.
Gauge icon
Speech bubble icons
Clipboard with magnifying glass icon
Icons appear one after another as the presenter lists governing-body responsibilities.
Presenter remains on the left side of frame.
The icons visually summarize risk appetite, communication about goals, and internal audit process management.
Near the end, text appears reading "3 Lines Model Benefits".
The segment ends immediately after the heading appears, so no benefits are actually listed within this clip.
Presenter
Heading text "3 Lines Model Benefits"
A new heading appears just before the clip ends.
Presenter remains on screen.
The video is transitioning into a benefits section that is not developed within the provided duration.
Bullet points appear sequentially under the heading '3 Lines Model Benefits' as the speaker discusses each one.
Text heading '3 Lines Model Benefits'
Bullet points
Bullet points appear one by one
Heading remains visible
The visual aids reinforce the spoken list of benefits, making them easy to follow and remember.
The heading changes to '3 Lines Model Challenges' and new bullet points appear sequentially as the speaker discusses each challenge.
Text heading '3 Lines Model Challenges'
Bullet points
Heading changes, previous bullets disappear, new bullets appear one by one
Speaker remains visible
The transition in visuals clearly separates the discussion of benefits from the discussion of challenges.
The third box is labeled "INTERNAL AUDITORS".
The narration says the third line includes "internal and external auditors".
One might infer from the box label alone that the third line consists only of internal auditors.
The narration explicitly broadens the third line to include both internal and external auditors, while the diagram separately shows "External Auditors" as a vertical bar on the right.
The presenter defines the model and then immediately introduces the first line as management.
The first box appears under the model title.
The Three Lines Model contains the first line of defense as one of its three core components.
After defining the model, the presenter introduces the second line as risk management and compliance.
The second box appears under the model title.
The Three Lines Model contains the second line of defense as one of its three core components.
After defining the model, the presenter introduces the third line as audit.
The third box appears under the model title.
The Three Lines Model contains the third line of defense as one of its three core components.
Presenter says the third line objectively ensures the first and second lines are effective.
An arrow points from the third box back toward the second box.
The third line applies assurance and evaluation to the effectiveness of the first line.
Presenter says the third line objectively ensures the first and second lines are effective.
An arrow points from the third box back toward the second box.
The third line applies assurance and evaluation to the effectiveness of the second line.
Presenter says all three lines report to and receive direction from the governing body.
Arrows connect the top bar labeled "Governing Body" to each of the three line boxes.
Within the model, the governing body sits above the three lines and directs them.
The presenter first discusses risk in business and then introduces the Three Lines Model as an approach to risk management.
The article screenshot on risk management appears before the model diagram.
The video presents the general idea that risk is inherent in business as the motivating context for introducing the Three Lines Model.
Presenter defines the Three Lines Model and attributes it to the IIA.
Presenter explains the first line as management owning daily activity risks.
Presenter explains the second line as risk management and compliance monitoring.
Presenter explains the third line as internal and external auditors ensuring effectiveness.
Presenter lists governing-body responsibilities including risk appetite and internal audit process.
External Auditors appears as a vertical bar on the right side of the model diagram.
Narration includes external auditors in the third line discussion.
Speaker lists the positive outcomes of using the model.
Speaker lists the difficulties associated with the model.
Covered · Opening question and title card introduce the topic of the Three Lines Model.
Covered · Presenter states that risk is inherent in business and defines the Three Lines Model as an IIA-associated risk-management structure.
Covered · A TechTarget article on risk management is shown as supporting context; no new model component is defined here.
Covered · The diagram begins building and the first line, management, is defined.
Covered · The second line, risk management and compliance, is added to the diagram and explained.
Covered · The third line and External Auditors are shown, then arrows connect all three lines to the Governing Body.
Covered · The governing body's responsibilities are listed with supporting icons.
Covered · The presenter begins transitioning to benefits, and the heading "3 Lines Model Benefits" appears, but no benefit items are developed within this clip.
Covered · Discussion of the benefits of the Three Lines Model.
Covered · Discussion of the challenges of the Three Lines Model.
Covered · Outro, call to action, and end screen with no mathematical or conceptual content.
Reviewed subject paths
Continue with related videos in the same subject.
YouTube5:38
YouTube10:32
YouTube1:53