The Three Lines of Defense Model in Risk Management

Developed by the Institute of Internal Auditors in 2013, the three lines of defense model (3LoD/TLoD) is one of the most common benchmarks for assigning risk management and control responsibilities effectively and efficiently. The three lines of defense model has been a foundation for managing enterprise risks and governance in many organizations, with each playing a distinct role in risk management.

By adopting the three lines of defense model, banks and financial institutions can effectively structure and implement risk management and internal controls. Further, it can help banks define roles and responsibilities to help prevent, detect, and mitigate various enterprise risks.

In this blog, we will have a closer look at the three lines of defense model, briefly discuss each line of defense, and the importance of internal controls in corporate governance for effective enterprise risk management.

Operational Management – The First Line of Defense

The first line of defense lies with the management or process owners in the organization, who are responsible for owning and managing risks, maintaining internal controls, and executing the control procedures daily.

It consists of identifying, assessing, designing, operating, and implementing controls, internal policies, processes, and procedures to manage and mitigate the risks associated with daily operational activities.

Process owners need the necessary skills, knowledge, and authority to understand the institution’s objectives, environment, and risks and apply relevant policies and risk controls to mitigate them.

Risk Management and Compliance – The Second Line of Defense

The second line of defense – comprising compliance and risk management systems -becomes active when the first line of defense is absent or ineffective. Its purpose is to identify risks and ensure effective management of the first-line-of-defense controls by providing compliance functions and oversight to the frameworks, tools, techniques, and policies.

The second line is independent of the first line and applies controls on an ongoing or periodic basis based on broad risk assessment criteria, and includes the following functions:

• Risk management function
  Facilitates and monitors the implementation of risk management practices through operational management. It also assists risk owners define and report the following throughout the organization:
  • Target risk exposure
  • Adequate risk-related information
• Compliance function
  Keeping an eye on various specific risks. This may include noncompliance with applicable regulatory norms and laws.
• Controllership function
  For monitoring financial risks and financial reporting issues

Internal Audits –­­ The Third Line of Defense

The third line of defense comprises internal audits that provide independent assurance and evaluation through a risk-based approach to the effectiveness of controls and procedures for managing various risks.

Its key role is to assess the first and second line of defense to assure the senior management, board, regulators, and auditors (both internal and external) that controls laid in the organization are operating effectively from both design and operational points.

While internal audits may not implement or direct the processes, they can provide recommendations or advice for effective governance, internal controls, and risk management.

This helps bring a systematic approach to evaluate and improve the effectiveness of internal controls, risk management, and governance processes and achieve the objectives.

Benefits of the Three-Lines-of-Defense Model

Following are the 3 key benefits of implementing an effective and efficient three-lines-of-defense model.

• Improve Coverage

The model enables financial institutions to increase their coverage of risks and internal controls. It helps allocate the ownership and performance of the risks and controls across the defense lines while avoiding unnecessary duplicate work, unintended risks, and gaps in the controls.

• Improve Control Culture

It helps improve the control culture throughout the organization by increasing awareness of risks and controls, which enables the organization to identify and mitigate risks arising from incompatible responsibilities or potential conflicts of interest.

• Improve Reporting

It also helps in timely and insightful reporting while avoiding potentially duplicate and irrelevant information for the board and executive management through a coordinated approach.

Internal Controls, Governance & Risk Management

For effective and efficient corporate governance and risk management, it is critical to establish the three lines of defense model.

• Internal controls are the policies, processes, and procedures to safeguard the organization by preventing, detecting, and mitigating risks.
• Corporate Governance refers to directing, controlling, and evaluating the organization and setting forth the governance structure by a supervisory board to identify rights and responsibilities for managing conflicts of interest between/among shareholders and company management.

Internal controls are also integral to enterprise risk management (ERM) as they help monitor activities and take corrective measures to attain organizational goals.

These may include processes or procedures such as risk assessment to detect areas of inaccuracies and improve them for effective risk management.

Internal controls and enterprise risk management (ERM) are the core components of corporate governance. They help financial organizations identify, analyze, score, and mitigate risks, which is critical for business operations and mandatory for regulatory compliance.

Four Lines of Defense Model

The Financial Stability Institute (FSI) published a paper titled “The four lines of defense model” for financial institutions. The paper discusses past failures and weaknesses in the three-lines-of-defense model and proposes the four-lines-of-defense model in financial institutions.

The four-lines-of-defense model (4LoD or FLoD) precisely addresses the deficiencies in the three-lines-of-defense model by assigning specific roles to external parties (such as external auditors or banking supervisors).

It may provide an autonomous assessment of the first three lines of defense, specifically the audit of the organization’s financial reporting and compliance with regulatory requirements.

It intends to enhance the coordination between internal auditors and external parties, providing additional assurance to senior management, shareholders, and external parties. This setup plays an important role in an organization’s overall governance and control structure.

The Three-Lines-of-Defense Model: Key to Effective Enterprise Risk Management

Financial institutions can embrace and benefit from the three-line defense model, which aims to provide effective and efficient coordination of control responsibilities and communication on risk management and internal controls.

However, implementation of the three lines of defense, including stronger governance, can be challenging without effective coordination, leading to duplicate efforts and/or key risks being misjudged.

Anaptyss as a strategic partner offers 8+ decades of combined deep-domain expertise for comprehensive risk management and governance by modernizing, strengthening, and implementing the traditional three lines of defense model. We can also conduct/facilitate external audits to manage business risks and opportunities.