Governance roles and the Three Lines Model
The governing body oversees the organization. Management’s first-line roles deliver services and manage risk; second-line roles provide expertise, monitoring, and challenge. Internal audit provides independent assurance and advice. The lines describe roles, so an organization chart alone does not establish how responsibility works.
Simplified role map based on the IIA Three Lines Model
Management
First-line roles
Own risks and operate controls
Specialist roles
Second-line roles
Support, monitor, and challenge
Internal audit
Third line
Provide independent assurance and advice
Coordinate information and coverage across roles. Preserve accountability and safeguards for independence.
Who owns the action?
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Governing body | Oversee accountability and challenge management on significant risk and performance. | Taking over routine control operation. |
| Management: first and second lines | Operate controls and provide risk or compliance expertise, monitoring, and challenge. | Calling compliance monitoring independent internal audit merely because it reports separately. |
| Internal audit | Evaluate governance, risk management, and control with suitable independence. | Accepting management risk or becoming the control operator. |
Governing body
Oversee accountability and challenge management on significant risk and performance.
Avoid: Taking over routine control operation.
Management: first and second lines
Operate controls and provide risk or compliance expertise, monitoring, and challenge.
Avoid: Calling compliance monitoring independent internal audit merely because it reports separately.
Internal audit
Evaluate governance, risk management, and control with suitable independence.
Avoid: Accepting management risk or becoming the control operator.
A decision path you can use
- 1Identify the business decision
- 2Assign operating and oversight responsibilities
- 3Preserve independent evaluation
Understand the method
Work through the reasoning
Begin with governing-body oversight
The governing body is accountable for oversight and direction. It relies on management information and independent assurance to understand whether the organization is pursuing its objectives appropriately. Oversight does not mean operating every control personally. A board may require clarity about a serious exposure while leaving the design and execution of the response with management.
In a case, distinguish requesting information from taking over the process. Asking the CAE about an unresolved access restriction supports oversight. Approving individual supplier invoices is an operational act. A useful governance arrangement makes decision rights and reporting routes clear, so significant matters reach the people with authority to address them without confusing oversight with day-to-day management.
Understand first- and second-line roles as management roles
First-line roles deliver products and services and manage the associated risks. Second-line roles provide expertise, support, monitoring, and challenge on risk-related matters. These roles can be organized in different ways. A risk specialist may challenge business assumptions while still belonging to management rather than providing the independence associated with internal audit.
The model describes responsibilities rather than requiring three isolated departments. A smaller organization may combine activities, but combining them does not make the underlying responsibilities disappear. Identify who owns the risk, who monitors or challenges the response, and how concerns are communicated. A separate job title is not proof that the work is objective, effective, or suitable for reliance.
Locate internal audit’s independent contribution
Internal audit provides independent assurance and advice about governance, risk management, and control. It can use information from management’s monitoring activities, but must evaluate that information for its own purpose. A second-line compliance review may be valuable evidence without automatically supporting every conclusion in an internal audit report.
Internal audit should avoid becoming the owner of the risks and controls it will later evaluate. Facilitating a discussion about risk can be useful advisory work. Selecting the organization’s risk response or approving its operational exceptions changes the responsibility. If the function has additional roles, the implications and safeguards need explicit consideration through its governance arrangements.
Coordinate coverage without treating reports as interchangeable
A coverage discussion should identify the risk, scope, timing, methods, and limitations of each provider’s work. Two reports about cybersecurity may cover different systems or periods. Counting them as duplicate assurance without reading their scope can hide a gap. Conversely, repeating the same narrow test may waste effort while another significant risk remains unexamined.
Coordination can align plans and share information, while reliance requires a separate assessment of the provider and work. Keep those decisions distinct. The governing body benefits from an honest picture of combined coverage and unresolved gaps, not a diagram suggesting that the existence of three lines guarantees complete protection.
Original teaching example
Apply the method to a decision
The scenario
A sales team approves discounts, compliance monitors exceptions, and internal audit reviews whether the discount-control process is effective.
The decision
Sales performs a first-line role, compliance a second-line role, and internal audit independent evaluation.
All three may examine the same transaction for different purposes. Coordination can avoid duplication, but it does not transfer accountability for pricing decisions from management to audit.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
The compliance team has checked the policy, not the transactions
The situation
A compliance team confirms that every branch has adopted a sanctions policy. Management tells internal audit that sanctions risk is fully assured and asks it to cancel transaction testing.
Reason through it
Policy adoption and transaction screening answer different questions. The second-line review supplies useful information about implementation of a document, but its scope may not cover whether screening operates or alerts are resolved. Audit should examine the review’s evidence and identify the remaining assurance need.
Take the decision
Coordinate with compliance and avoid unnecessary duplication, while retaining work needed to answer the operating-effectiveness objective. A provider’s organizational line does not expand its tested scope.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Are the three lines necessarily three departments?
No. Roles can be combined or distributed depending on the organization. The useful questions are who owns risk, who monitors and challenges it, and who can independently assess the result.
Does the Three Lines Model require three separate departments?
It describes roles and relationships rather than a mandatory organization chart. Combining roles requires clarity about responsibilities and safeguards; it does not remove the need for appropriate independent assurance.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Governance, Risk Management, and Control (30% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Domains I and III; Standard 9.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
- IIA Three Lines Model: 2026 Statement of Position
- Executive summary, pages 3-4; coordination and reliance, pages 15-16. Supports the role distinctions and the need for coordination with safeguards. This professional guidance supplements the exam syllabus; its publication does not establish when a particular exam question changes.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.