The Three Lines Model – when the second line becomes operational

Three Lines – without any defence mode

How compliance and internal audit can make the three lines model effective.

Many institutions have introduced the three lines model into their organisational structure, described it in guidelines and presented it clearly in presentations. And yet audits repeatedly reveal the same weaknesses: unclear responsibilities, operational activities in the second line, duplication of work between compliance and audit, or controls that are documented but not effective.

But the problem is not the model. The problem is its implementation in everyday practice.

From Three Lines of Defence to Three Lines Model

Until 2020, the term Three Lines of Defence Model was used. The term Defence was deliberately chosen to emphasise a protective function. In practice, however, this way of thinking often led to a defensive attitude between the functions.

The result was silo thinking, discussions about boundaries and an overemphasised control mentality.

The Institute of Internal Auditors therefore removed the term “defence”. Since 2020, the Three Lines Model has stood for an understanding of governance rather than a defensive logic. The focus is on

• clear responsibilities,
• transparent cooperation and
• a clear separation between operational responsibility, monitoring and independent auditing.

The core of the model is not defence, but the assignment of responsibility.

This change in perspective is crucial, particularly from the point of view of compliance and internal auditing. It is not about protecting each other, but about ensuring a functioning management and control system.

Where the real problems lie in practice

In day-to-day work, it is clear that the theory behind the model is rarely the problem. The challenges arise in project business, with new regulatory requirements or under time pressure.

Typical observations from audits and compliance reviews are

• The first line carries out controls formally, but without critical assessment or proper documentation.
• The second line effectively takes over operational activities because specialist departments are uncertain or regulatory requirements are perceived as too complex.
• Internal audit reviews structures in which roles are not clearly separated and must identify self-assessment risks.
• Automated controls are assumed to be reliable without regularly questioning data quality or parameterisation.

Especially in phases of transformation, roles become blurred more quickly than expected.

What does this mean for compliance in practice?

Compliance is a monitoring and challenge function, not an operational implementation body. Its central task is to create transparency about regulatory risks and the quality of controls in the first instance.

In concrete terms, this means

• Documenting clear demarcation in projects and consistently leaving operational responsibility in the first instance.
• Establish a structured overview of key first-line controls.
• Carry out risk-oriented spot checks instead of complete operational follow-up checks.
• Address deficits and report them to management without getting involved in operational implementation yourself.
• Regularly review the qualifications of employees with key control responsibilities.

Particularly when it comes to complex issues such as ESG, money laundering prevention or IT compliance, there is a great temptation to get involved in operational implementation. In the long term, however, this weakens the governance structure.

What does this mean for internal auditing?

Internal auditing should not only examine individual controls, but also evaluate the interaction between the lines.

In audit practice, this means:

• actively questioning the understanding of roles and not just checking organisational charts,
• analysing the interfaces between the first and second lines,
• identifying potential self-audit risks in advisory activities at an early stage,
• understanding automated controls, including data sources and parameterisation, and
• defining the three-line interaction as an independent audit focus.

A clear distinction is particularly important when it comes to advisory services. Advisory services are permissible as long as no operational responsibility arises and there is no threat of subsequent self-assessment.

Takeaways for practice

For compliance

• Responsibility for performing controls always remains primary
• Monitoring requires transparency, not detailed operational control
• Clearly separate advisory support from operational activities
• Identify key controls and monitor them specifically
• Document roles in projects in writing at an early stage

For internal audit

• Don’t just check controls, evaluate governance structures
• Consider role mixing as an independent risk
• Critically question automation and don’t assume it reduces risk
• Clearly define and document consulting assignments
• Include interfaces between lines in audit programmes in a targeted manner

The Three Lines Model is not a defence system or a mere organisational chart. It is a governance tool. Its effectiveness is not determined by guidelines, but in project meetings, control evidence and audit reports. These show whether responsibility is clearly assigned, monitoring is effectively exercised and audits are conducted independently.