Glossary · Management
Three lines model
A governance model, published by the Institute of Internal Auditors, that distinguishes management’s ownership of risk (first line), specialist risk and compliance oversight (second line) and independent assurance by internal audit (third line).
- Field
- Management
- Examined in
- CBA-AIG
- Learning objectives
- 1
Where the CBA Standards examine it
In the specimen paper
At Selangor Cover, a Malaysian insurance broker, the sanctions check is recorded as a first line control. It is written in the team's working guide, it sits in the team's objectives, and the system captures the evidence automatically. Over the past year every failure of the check was found by second line monitoring and none by the team itself. What does this indicate?
Answer
The control is not yet first line owned: the line finds none of its own failures.
Why that is the answer
Ownership of a control is not established by documentation, objectives or automatically captured evidence; those are the conditions that make ownership possible. The test that actually discriminates is who finds the failures. A first line that detects none of its own breaks across a full year is running the check as a task it has been handed rather than as a risk it owns, and a self-detection rate of zero is not a minor shortfall but the whole of the evidence. Note also what follows: the remedy is to build first-line detection, not to move the control anywhere.
Related terms
- GovernanceManagement
The system of rules, roles and processes by which an organisation is directed and controlled, including who decides what and how they are held to account.
- Internal auditManagement
An independent function that provides assurance to the board on whether governance, risk management and controls are effective.