What is Three lines model? | ARSEN Audit Glossary

Q: What is Three lines model?

A model allocating risk management and control responsibilities between business units (first line), risk management and compliance functions (second line) and internal audit (third line). The first line owns and manages risks, the second line provides frameworks and oversight, and internal audit gives independent assurance. The board and audit committee oversee all lines; the external auditor is an assurance provider outside the model.

The first line owns and manages risks, the second line provides frameworks and oversight, and internal audit gives independent assurance. The board and audit committee oversee all lines; the external auditor is an assurance provider outside the model.

Source: IIA Üç Hat Modeli (2020)

Related terms

Internal auditAn independent, objective assurance and consulting activity that evaluates the effectiveness of an organisation's risk management, control and governance processes.Enterprise risk management (ERM)The process of identifying, assessing, managing and monitoring, in an integrated way, the risks that could affect an organisation's achievement of its objectives.Audit committeeA committee of the board of directors responsible for overseeing financial reporting, internal control, internal audit and the independent audit.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Compliance auditAn examination of whether an organisation's activities are carried out in accordance with the relevant laws, regulations, contracts or internal rules.Compliance officerThe authorised person responsible for running the compliance programme for the prevention of money laundering and terrorist financing at an obliged entity.

Last updated: October 31, 2026 · This definition is for general information only.