TOPIC FOR EXPERT/FOCUS 5 3LOD
PROBLEM 1 What is 3 Line of Defense?
The Model enhances understanding of risk management and control by clarifying roles and
duties. Its underlying premise is that, under the oversight and direction of senior management
and the board of directors3, three separate groups (or lines of defense) within the organization
are necessary for effective management of risk and control. The responsibilities of each of the
groups (or “lines”) are:
1. Own and manage risk and control (front line operating management).
2. Monitor risk and control in support of management (risk, control, and compliance functions
put in place by management).
3. Provide independent assurance to the board and senior management concerning the
effectiveness of management of risk and control (internal audit).
Each of the three lines plays a distinct role within the organization’s wider governance
framework. When each performs its assigned role effectively, it is more likely the organization
will be successful in achieving its overall objectives.
Everyone in an organization has some responsibility for internal control, but to help assure that
essential duties are performed as intended, the Model brings clarity to specific roles and
responsibilities. When an organization has properly structured the three lines, and they operate
effectively, there should be no gaps in coverage, no unnecessary duplication of effort, and risk
