Three lines model
How governance, management and internal audit share roles in managing risk.
The IIA’s model has a governing body accountable to stakeholders; management in first-line roles (delivering products and services and managing risk) and second-line roles (expertise, support and monitoring on risk, such as risk management and compliance); and internal audit as the third line, giving independent assurance and advice.
On the exam
The second line supports and challenges risk management. Independent assurance belongs to internal audit.
Related terms
- Independence and objectivityIndependence is about the function’s position; objectivity is about the auditor’s mindset.
- GovernanceHow an organisation is directed, controlled and held to account.
Test yourself with today’s question of the day.