thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Three Lines Model

IIA model describing governance roles: management (first and second lines), internal audit (third line), and the governing body.

Definition

Updated by the IIA in 2020 from the Three Lines of Defense, the model assigns first-line roles to operational management that owns and manages risk, second-line roles to risk management and compliance functions that provide expertise and oversight, and third-line roles to internal audit for independent assurance. The governing body is accountable to stakeholders.

Example

The security operations team is first line, the risk function is second line, and internal audit is third line.

Exam tip

Internal audit is the third line and must remain independent of the first two.

Related terms