The three lines of defense model is a way of explaining the relationship between functions and roles of risk management and control in an organization. It involves the first line of defense (owning and managing risks), the second line of defense (overseeing or specialising in risk), and the third line of defense (providing independent assurance)1. The third line of defense is typically the internal audit function, which provides objective and independent assurance to the governing body, management, regulators, and external auditors that the control culture across the organization is effective in its design and operation2. The third line of defense must have independence from the business unit, meaning that it is not involved in the execution of business activities or the design and implementation of controls, and that it reports to the highest level of governance, such as the board or the audit committee3. The third line of defense is not limited to an external assessment firm, although external assurance providers may complement or supplement the work of the internal audit function2. References:
* 1: Internal audit: three lines of defence model explained | ICAS
* 2: Modernizing The Three Lines of Defense Model | Deloitte US
* 3: THE IIA S THREE LINES MODEL