Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
The Three Lines Model and Independent Assurance
Who checks the checkers?
Every organisation needs three things from its risk management: people who manage risk day to day, people who oversee and challenge that management, and people who independently confirm that the whole system works. The Institute of Internal Auditors (IIA) describes this in its Three Lines Model (updated in 2020 from the older “three lines of defence”).
The three lines
| Line | Who | Role |
|---|---|---|
| Governing body | Board and its committees | Accountable; sets direction; oversees all three lines |
| First line | Business and operational managers, IT operations | Own and manage risk; run controls day to day |
| Second line | Risk management, compliance, often information security | Provide frameworks, expertise, monitoring and challenge |
| Third line | Internal audit | Independent, objective assurance to the board via the audit committee |
| External assurance | External auditors, regulators, certification bodies | Assurance from outside the organisation |
Where security fits
Information security often spans more than one line:
- Security operations (running firewalls, access management, monitoring) is often first-line work.
- Security governance and risk (setting policy and standards, monitoring compliance, challenging the business) is second-line work.
- Internal audit assesses both, independently.
Where exactly security sits varies between organisations. What matters is that risk ownership, oversight and independent assurance are clearly separated.
Working with audit
For the security manager, internal audit is an ally:
- Treat audit findings as independent evidence, not personal criticism.
- Agree action plans with the right owners and target dates.
- Use audit results to support budget requests; an independent finding often carries more weight with the board than the CISO’s own warnings.
- Don’t ask audit to design controls that it will later have to assess. Audit can advise, but designing would impair its independence.
Example. Internal audit finds that privileged access reviews haven’t been done for a year. The CISO agrees a fix with the IT director, then uses the finding to win funding for a privileged access management tool that the board had previously deferred.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who provides independent assurance? | Internal audit (third line) |
| Who owns and manages risk? | First line: business and operational management |
| Role of risk and compliance functions | Second line: oversight, frameworks and challenge |
| Can audit design the controls it will test? | No; it impairs independence |
| Best use of audit findings | Drive agreed remediation and support resourcing |
In short
- First line: management and operations own and manage risk, including running controls day to day.
- Second line: specialist functions (risk, compliance, usually information security) provide frameworks, expertise, monitoring and challenge.
- Third line: internal audit gives independent, objective assurance to the board through the audit committee.
- The governing body is accountable and oversees all three; external auditors and regulators add assurance from outside.
- The security manager should welcome audit findings as independent evidence and use them to drive improvement.
- Independence means auditors don't design or run the controls they will later assess.
Exam traps
- Internal audit is independent of management; the security function is not.
- The CISO shouldn't report to internal audit; that would compromise audit's independence.
- Where security sits (first or second line) varies; what matters is that ownership and oversight are clear.
- Audit giving assurance doesn't transfer responsibility for controls away from management.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The three lines
1 / 8