Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
The Three Lines Model and Risk Oversight
The three lines
The governing body oversees all three lines and is accountable for risk governance.
Where IT roles sit
| Role | Usual line |
|---|---|
| Business process owners | First |
| IT operations and development | First |
| IT risk function, risk practitioner | Second |
| Compliance; often information security | Second |
| Internal audit | Third |
Keeping the lines clean
- The first line owns risk and runs controls.
- The second line sets the method, monitors and challenges, but doesn’t own.
- The third line stays independent; it doesn’t design or run controls.
- All three coordinate so effort isn’t duplicated and gaps don’t appear.
Example. A second-line risk team started approving firewall changes itself to speed things up. Within a year it was effectively running a first-line control, and nobody independent was challenging network risk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who provides independent assurance | Internal audit (third line) |
| Who owns IT operational risk | First-line management |
| Role of the risk function | Second line: frameworks, monitoring, challenge |
| Who oversees all three | The governing body |
In short
- The first line owns and manages risk: business and operational management, including IT operations.
- The second line provides expertise, frameworks, monitoring and challenge: risk management, compliance and often security.
- The third line, internal audit, provides independent assurance to the governing body.
- The governing body oversees all three and is accountable for risk governance.
- Each line must keep its role: the second line advises rather than owns, and audit stays independent.
Exam traps
- Placing internal audit in the first or second line.
- Making the second line the owner of first-line risks.
- Letting internal audit design controls it will later assess.
- Assuming the lines can't cooperate; they should coordinate without merging roles.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The three lines
1 / 7