Photo by Vitaly Gariev on Unsplash
In many organizations, responsibility for risk is spread across many units: operational management, compliance, risk management, and internal audit. Without a clear division of roles, reviews can overlap while the riskiest areas go untouched.
The Three Lines Model from The Institute of Internal Auditors (IIA) helps address this problem. This article covers its definition, the role of each line, the five principles in the latest version, its relationship with the Global Internal Audit Standards (GIAS), and examples of how it is applied in companies and higher education institutions.
What Is the Three Lines Model?
The Three Lines Model is an IIA framework for distinguishing roles in organizational governance: roles that own and manage risk, roles that provide support and monitoring, and roles that provide independent assurance. The model was previously known as the Three Lines of Defense.
The first major update came in 2020, when the IIA issued a position paper that shifted the focus from defense alone to creating and protecting value. In July 2026, the IIA published a Statement of Position titled Assurance and Advice in Support of Effective Governance: Three Lines Model. The document states that it replaces the prior position paper.
Note that the Statement of Position is not part of the International Professional Practices Framework (IPPF). The IIA wrote it mainly for boards and senior management, so it is guidance applied with professional judgment, not a mandatory standard for internal auditors. The full document is available on the IIA Statements of Position page.
What Are the Roles of the First, Second, and Third Lines?
The 2026 version still uses the terms first, second, and third line. The term line distinguishes roles; it does not describe boxes on an organization chart. The IIA also acknowledges that in practice, roles across the lines may overlap.
| Roles | Main responsibility | Example in a company |
|---|---|---|
| Board (board) | Sets purpose, risk appetite, and expectations, and oversees the pursuit of strategic objectives | Board of commissioners and the audit committee |
| First line (management) | Owns and manages risks, and designs and operates processes and controls | Operations, sales, procurement, finance |
| Second line | Provides specialized expertise, support, monitoring, and challenge on risk management, compliance, and control | Risk management, compliance, information security, quality assurance |
| Third line (internal audit) | Provides independent and objective assurance on governance, risk management, compliance, and control, as well as advisory services without assuming management responsibility | Internal audit unit (SPI) or internal audit division |
| External assurance providers | Provide additional confidence from outside the organization | External auditors, regulators, accreditation bodies |
The duties and position of the third line function in companies are discussed in more detail in the article on the Corporate Internal Audit Unit.
What Are the Five Principles of the 2026 Three Lines Model?
The 2026 Statement of Position sets out five principles that explain how assurance and advisory support governance:
- The board sets direction. The board sets purpose, risk appetite, and expectations, and oversees the pursuit of strategic objectives.
- Oversight needs reliable information. Effective oversight depends on reliable, balanced information on performance, risks, and controls.
- Accountability through defined roles. The board and senior management establish accountability by defining roles and responsibilities.
- Distinct sources of assurance. Distinct sources of assurance, including from an independent source, give the board confidence that governance, risk management, compliance, and control are working as intended and promote timely corrective action.
- Advisory complements assurance. Advisory services provide insights, perspectives, and options that support improvement and decision-making.
The 2020 version contained six principles with different wording, ranging from a governance principle to creating and protecting value. If your organization's internal guidelines still refer to the 2020 version, the reference should be updated.
What Does the 2026 Version Emphasize?
The basic structure of the three lines has not changed. What has changed is the emphasis. Some notable points in the 2026 Statement of Position:
- Independence is not isolation. Independence is seen as a combination of position in the organizational structure and practical safeguards, without cutting off communication between roles.
- A cooling-off period before providing assurance. A period of at least about 12 months between being responsible for a process and providing assurance over that process is generally considered sufficient to safeguard objectivity.
- Internal audit as the integrator of assurance. The internal audit function is affirmed as the party that gives the board a comprehensive view of the effectiveness of governance, risk management, compliance, and control.
- Coordination among assurance providers. An assurance map, shared risk taxonomies, aligned reporting, and coordinated planning are cited as ways to reduce duplication and identify coverage gaps.
- Outsourcing does not transfer accountability. The organization remains accountable even when some roles are performed by outside parties.
- External parties are recognized. External auditors, regulators, and accreditation bodies are named as sources of assurance outside the three lines.
This idea of coordination is in line with combined assurance, namely an approach that brings together the work of various assurance providers so that the board receives a complete picture.
How Is the Independence of the Third Line Maintained?
The 2026 Statement of Position lists several essential elements of organizational independence:
- Reporting lines and authority. Typically functional reporting to the board and administrative reporting to the chief executive, with the authority to escalate issues without restriction.
- Autonomy over scope and planning. The third line decides what work is reviewed, how it is done, and what conclusions are drawn.
- Unrestricted access. Access to assets, facilities, information, people, and systems must not be filtered by the party being reviewed.
- Control over resources. Sufficient personnel, expertise, and budget without depending on the functions being reviewed.
- Protection from undue pressure. Assurance providers are protected from retaliation or undue influence.
Beyond structure, there are also practical safeguards: a documented allocation of responsibilities, independent review where there is a risk of self-review, explicit board approval when the internal audit remit is expanded, and timely communication of threats to objectivity. Auditor objectivity and integrity are also governed by the internal auditor code of ethics based on the GIAS.
How Does the Three Lines Model Relate to the GIAS?
The Global Internal Audit Standards were issued by the IIA on January 9, 2024 and have been effective since January 9, 2025. The standards consist of five domains and fifteen principles. The Three Lines Model explains where internal audit sits among other roles, while the GIAS governs how the internal audit function is performed.
The closest link is in Domain III, Governing the Internal Audit Function, which covers the relationship between the chief audit executive, the board, and senior management:
| GIAS principle | Standards within it |
|---|---|
| Principle 6, Authorized by the Board | 6.1 Internal Audit Mandate, 6.2 Internal Audit Charter, 6.3 Board and Senior Management Support |
| Principle 7, Positioned Independently | 7.1 Organizational Independence, 7.2 Chief Audit Executive Qualifications |
| Principle 8, Overseen by the Board | 8.1 Board Interaction, 8.2 Resources, 8.3 Quality, 8.4 External Quality Assessment |
On the execution side, Standard 9.4 covers the internal audit plan based on an assessment of strategies, objectives, and risks, while Standard 13.6 covers the engagement work program. Both are discussed in the articles on risk-based audit and internal audit work program. The full text of the GIAS can be downloaded free of charge from the official IIA website.
What Does the Three Lines Model Look Like in a Company?
Take the procurement of goods and services in a company as an example:
- First line: the procurement division runs vendor selection procedures, tiered approvals, and document verification.
- Second line: the risk management and compliance functions set policies, monitor procurement risk indicators, and provide input when deviations occur.
- Third line: internal audit independently tests the effectiveness of procurement controls and reports the results to the audit committee.
- Board: the board of commissioners, through the audit committee, discusses the audit plan, receives reports, and monitors follow-up.
- External parties: external auditors audit the financial statements, including the impact of procurement transactions.
How Is the Three Lines Model Applied in Higher Education?
As of October 21, 2026, the IIA has not issued guidance specific to universities. However, the GIAS has a section on applying the standards in the public sector, which is relevant to state universities. The three lines principle can also still be used, because universities face academic, financial, research, information technology, and reputational risks. Its application within the governance, risk, and compliance framework is discussed in the article GRC in universities, and the SPI's relationship with the audit committee, board, inspectorate, and BPK is discussed in the article SPI coordination.
| Roles | Example in higher education |
|---|---|
| Board or supervisory body | The body that performs the oversight function according to the institution's form and statute |
| First line | Faculties, study programs, finance bureau, procurement unit, research management |
| Second line | Risk management unit, quality assurance office, legal and compliance unit, IT security unit |
| Third line | Internal Audit Unit (SPI) |
| External assurance providers | BPK, external auditors, BAN-PT or independent accreditation bodies |
A quality assurance office that conducts an internal quality audit can be mapped as a second line role, because its activities help monitor compliance with higher education standards. The SPI sits in the third line and provides independent assurance on governance, risk management, and control.
The position and legal basis of the SPI on campus are discussed in the article University SPI.
A simple assurance map for a campus can be laid out as follows:
| Risk area | First line | Second line | Third line | External |
|---|---|---|---|---|
| Management of research grant funds | Research managers and researchers | Finance or risk management unit | SPI audit of fund use | Grant providers, BPK |
| Procurement of goods and services | Procurement unit | Legal and compliance unit | SPI audit of the procurement process | BPK |
| Student data security | Academic information system administrators | IT security unit | SPI audit of access controls | External IT auditors |
| Compliance with education standards | Study programs | Quality assurance office | SPI review of quality governance | BAN-PT or LAM |
Internal audit needs in educational institutions are also discussed on the page Audithink for Educational Institutions.
What Are Common Mistakes When Applying the Three Lines Model?
- Treating the lines as a rigid organization chart. The model distinguishes roles, so each unit needs to understand which role it is performing.
- The first line gives up ownership of risk. Having a risk management or internal audit function does not transfer risk responsibility away from management.
- Internal audit takes on second line roles without safeguards. If the chief audit executive also holds other functions, board approval and independent review are needed.
- Assurance providers work in isolation. The result is duplicate reviews in one area and coverage gaps in another.
- Reports to the board are not balanced. The board needs reliable information on performance, risks, and controls, not just good news.
How Does Internal Audit Software Support the Third Line?
The third line needs well-organized documentation so that the assurance it provides can be accounted for to the board. Audithink supports internal audit teams through six main features:
- Risk assessment to map high-risk areas.
- Audit planning based on risk assessment results.
- Work program templates for each engagement.
- Notifications for deadlines and team tasks.
- Monitoring of recommendation follow-ups.
- Automated reports from data recorded during the audit.
Audithink is a tool for managing audits. The division of roles, independence, and governance decisions remain the responsibility of each organization.
FAQ About the Three Lines Model
What is the Three Lines Model?
The Three Lines Model is an IIA framework that distinguishes the roles of management (first line), risk support and monitoring functions (second line), and independent internal audit (third line), under the oversight of the board.
What is the difference between the Three Lines Model and the Three Lines of Defense?
Three Lines of Defense is the earlier name. Since the 2020 update, the focus has shifted from defense to how each role contributes to creating and protecting organizational value.
How many principles does the latest Three Lines Model have?
The IIA Statement of Position published in July 2026 contains five principles. The 2020 version it replaces contained six principles.
Who belongs to the third line?
The third line is the internal audit function, such as the internal audit unit (SPI) in a company or the Internal Supervisory Unit (SPI) in a higher education institution.
Is the Three Lines Model mandatory?
The IIA Statement of Position is not part of the IPPF, so it serves as guidance. Organizations apply it according to their own context and governance needs.
How is the Three Lines Model applied in higher education?
Faculties and work units act as the first line, risk management and quality assurance units as the second line, and the SPI as the third line. The Audit Board (BPK), external auditors, and accreditation bodies provide assurance from outside.
Conclusion
The Three Lines Model helps organizations divide roles clearly: management owns risk, the second line supports and monitors, and internal audit provides independent assurance. The 2026 version emphasizes reliable information for the board, independence that does not mean isolation, and coordination among assurance providers.
If your internal audit team wants to document audit planning, work programs, and follow-ups more neatly, schedule an Audithink demo.
