It strengthens first-line ownership of risk and gives internal audit a broad information base. As it is not an independent test, results should be validated on a sample basis by internal audit or the second line.
Source: IIA uygulama rehberleri, COSO
Related terms
Three lines modelA model allocating risk management and control responsibilities between business units (first line), risk management and compliance functions (second line) and internal audit (third line).Internal controlProcesses and controls designed by management to provide reasonable assurance regarding the effectiveness of operations, the reliability of financial reporting and compliance with laws and regulations.Risk and control matrix (RCM)A document setting out, for each process, the risks, the controls addressing them, control owners, frequency, type and evidence.Anti-bribery and corruptionThe set of policies, controls and training designed to prevent the offering or acceptance of undue advantages to or from public officials or private sector employees.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Business continuity planA plan to keep critical activities running at an acceptable level and return to normal within set timeframes after a disruption, disaster or cyber attack.
Last updated: November 8, 2026 · This definition is for general information only.