Risk management is everyone’s job, but without clarity, it’s easy for accountability to slip through the cracks. The Three Lines of Defense (3LoD) — also known as the Three Lines Model — is a framework developed by the Institute of Internal Auditors (IIA) to clarify roles, strengthen accountability, and align governance with strategy.
From the board and senior management to internal audit and front-line staff, the model ensures that everyone plays a part in managing risk effectively.
Widely used by financial institutions (FIs) and financial services companies, the Three Lines of Defense improves risk oversight, clarifies decision-making, and transforms risk management from a compliance obligation into a source of strategic value.
Related: Learn how integrated risk management tools can help all three lines work together.
What are the Three Lines of Defense?
The Three Lines of Defense is a globally recognized risk management framework that helps organizations establish clear roles and responsibilities for managing and overseeing risk.
Guided by management and the board, the three lines collaborate to ensure that activities and controls are operating as intended, protecting the organization by aligning with its risk tolerance while supporting its strategic objectives.
Here is how those responsibilities typically look at a financial institution:
| Line | Who is involved? | Primary responsibilities | Example |
| First line | Operational managers and front-line staff across sales, customer service, etc. | Manage risks and operate controls in daily activities | A wire-transfer team follows approval procedures, documents exceptions, and escalates problems. |
| Second line | Risk management, compliance, and other specialist functions | Provide guidance, monitor risk, and challenge how it is managed | Risk or compliance reviews exceptions, tests adherence to policies, and recommends control improvements. |
| Third line | Internal audit | Independently evaluate governance, risk management, and controls | Internal audit assesses whether the wire-transfer controls and related oversight work effectively. |
What is the Three Lines Model?
The Three Lines Model is an updated version of the original Three Lines of Defense framework introduced by the IIA. Released in 2020, it broadens the focus of risk management beyond protection and compliance to emphasize how effective governance also enables strategy and creates organizational value. While the updated name reflects this expanded purpose, it’s still commonly known as the Three Lines of Defense.
The 3 Lines of Defense consist of:
First line of defense
The first line of defense is the operational management and staff who own the risks created by their day-to-day activities. Whether in sales, customer service, operations, or processing functions like wire transfers, these teams are responsible for designing and applying internal controls to manage risks in their business areas. As the front line, they are closest to the risks and play a critical role in ensuring processes run effectively, efficiently, and in alignment with the organization’s risk appetite.
Second line of defense
The second line of defense provides oversight, expertise, and guidance to support and challenge the first line in managing risk, while also serving as a bridge to the third line. In FIs, this typically includes the risk management and compliance functions, which establish policies, procedures, and monitoring frameworks to help ensure business activities remain within the organization’s risk appetite.
- Risk management evaluates the risks associated with business activities. When an activity falls outside the institution’s risk tolerance, the second line can direct the front line to add or adjust internal controls — or the organization might decide to discontinue the activity. Risk management also identifies high-risk areas that require enhanced monitoring and testing to ensure the first line is operating effectively and in compliance with regulations.
- Compliance identifies applicable laws and regulations, translating them into practical policies and procedures across the organization. Leveraging a compliance management system (CMS), compliance supports the first line in execution and highlights regulatory risk exposures that should be factored into risk assessments. Compliance teams can go deeper on this role in our guide to the 3 lines of defense in a CMS.
Software gives the second line a way to do this work consistently. With compliance management software, compliance teams can pinpoint applicable regulations and build customized compliance checklists, while policy and change management tools keep the program current. On the risk side, enterprise risk management software can streamline the risk assessment process with configurable templates and hundreds of risk controls, with heat maps and dashboards to report results. When used together, compliance and risk teams work from one shared single source of truth.
By challenging and guiding the first line while communicating risks upward, the second line helps ensure business activities are both compliant and aligned with the institution’s risk appetite — setting the stage for independent assurance from the third line.
Related: Managing Complaints: The Role of the Three Lines of Defense
Third line of defense
The third line of defense is internal audit, which provides an independent and objective evaluation of risks and controls. Its role is to assess the effectiveness of governance, risk management, and compliance practices, identify weaknesses, and confirm that corrective actions are taken. Internal audit reports its findings directly to the board, senior management, and other key stakeholders, ensuring transparency and accountability.
By identifying and addressing risk proactively, the third line helps the institution resolve problems internally — before they can escalate.
Internal audit has to show its work, and it has to show that the issues it raises get fixed. Audit management software gives audit teams one place to document testing, using digital workpapers and review templates, with workflows that carry each audit through quality review. When it connects to findings management software, issues raised in an audit can be tracked through remediation in the same system, which makes it easier to confirm that corrective action happened.
How can organizations implement the Three Lines of Defense Model?
Like any risk management approach, implementing the Three Lines of Defense requires more than a framework. Execution brings it to life.
FIs can strengthen their framework by focusing on four key steps:
1. Build a value-creating foundation
Start by clearly defining roles and responsibilities so every team member understands how their work supports strategic goals. Equally important is maintaining open communication channels across all three lines to promote the free flow of information.
A value-creating framework balances risk and reward. A well-defined risk appetite is critical, but remember: avoiding risk altogether can create vulnerabilities of its own.
Related: Are You Using a Data-Driven Approach to Compliance Risk?
2. Design for flexibility and adaptability
The Three Lines Model looks different in every organization, so be prepared to tailor the model to meet your organization’s size, structure, services, and industry dynamics. Forming committees or working groups can strengthen coordination and help you adjust your approach as business conditions and risks evolve.
3. Build a strong risk culture
Building a strong risk culture requires more than policies — it’s all about daily actions.
Leadership must set the tone from the top by visibly supporting risk initiatives and modeling ethical behavior, creating clear expectations across the organization.
Ongoing dialogue between management and internal audit reinforces alignment and accountability. When risks and remediation are discussed openly and consistently, risk management becomes part of everyday decision-making rather than a compliance checklist.
4. Stay proactive
As your organization evolves, so do its risks — and your Three Lines Model should evolve with them.
Establish controls and processes that capture both current and emerging risks, enabling quick, effective responses. Provide ongoing training so staff can apply these controls with confidence and consistency.
Reinforce accountability by linking risk management to performance reviews and incentive structures. Finally, use tracking systems across all three lines to monitor ownership and progress, ensuring the visibility needed for continuous improvement and informed decision-making.
Related: Tips for Implementing 3 Lines of Defense in your CMS from a Compliance Pro
Overcoming challenges with the Three Lines Model
While the Three Lines of Defense is effective, implementing any new system or strategy comes with challenges.
The table below shows some common objections and how to overcome them.
| Objection/Challenge | Solution |
| Departments focus only on risks within their own areas, creating silos. | Establish a centralized source of truth accessible to management, compliance, risk, audit, and business lines to ensure consistent visibility. |
| Stakeholders hold different views of what constitutes “acceptable” risk, leading to misalignment. | Adopt a common risk language and framework to align perspectives and reduce conflicting interpretations. |
| No one takes clear ownership of risk management, leaving gaps in accountability. | Define ownership through cross-functional governance structures and risk forums that bring leaders together at the organizational level. |
| Employees don’t understand risks or how they connect to strategy, mission, and operations. | Host regular cross-functional discussions to tie risk to strategy, ensuring teams understand enterprise-wide impacts. |
| Duplicated efforts and overlapping resources create inefficiencies. | Consolidate processes and platforms to reduce redundancies, enable collaboration, and embed risk management as an integrated capability. |
What happens when one (or two) of the lines fail?
A breakdown in any line of defense can expose an institution to significant risk. One example of a failed line of defense is when weaknesses in JPMorgan’s internal controls lead to a $250 million penalty from the Office of the Comptroller of the Currency (OCC) penalty for unsafe and unsound practices.
The case highlighted weaknesses in management and control frameworks, including fiduciary oversight, audit, and risk management practices — pointing to failures across multiple lines of defense.
The JPMorgan example underscores the financial, compliance, and reputational risks organizations face when the Three Lines Model is weak or poorly maintained.
Related: What is Dynamic Risk Management and How Does It Work?
Frequently Asked Questions
What is the difference between the first and second lines of defense?
The first line manages risks in daily business activities and applies controls. The second line provides specialist guidance, monitoring, and challenges decisions, if needed. For example, loan staff follow policy and apply controls on every file, while the second line analyzes lending data for problems, such as inconsistent waivers, and can direct changes to the controls that let them through. Accountability for the activity stays with the business.
How does the Three Lines of Defense model differ from traditional risk management approaches?
Traditional risk management often silos responsibilities, with business units, compliance, risk management, and audit functions working independently, managing their own risks without communicating their findings or working towards common risk management goals. This lack of structure can result in inconsistent oversight, unclear accountability, and delayed responses to emerging risks.
The Three Lines of Defense Model addresses these weaknesses by clearly defining roles: the first line owns and manages risk in day-to-day operations, the second line provides oversight and guidance to ensure risks remain within appetite, and the third line offers independent assurance through internal audit. This structured division not only strengthens accountability but also improves coordination, transparency, and the ability to detect and address issues before they escalate.
What software supports the Three Lines of Defense model?
Integrated risk management software supports the model by giving all three lines a shared record of risk, compliance, audit, and findings activity. Ncontracts’ integrated risk management suite connects the modules each line relies on, so business owners, risk and compliance teams, and internal audit see the same data.
Can the Three Lines of Defense model be applied to organizations outside the financial sector?
Yes, while the model is particularly beneficial for financial institutions due to regulatory requirements, its principles apply to any organization aiming to improve risk management and governance.
The Three Lines Model works best when every line sees the same picture of risk. If you’re evaluating enterprise risk management software to get there, the Enterprise Risk Management Buyer’s Guide covers what to look for in a solution, from governance through reporting.
