Three Lines Model
The IIA governance framework describing how management, risk and compliance functions, and internal audit contribute to governance, replacing the older Three Lines of Defence.
The first line owns and manages risk in delivering products and services. The second line provides expertise, support, monitoring and challenge on risk matters. Internal audit is the third line and provides independent, objective assurance and advice to the governing body.
The IIA replaced the Three Lines of Defence with the Three Lines Model in 2020, dropping the word "defence" because it framed risk as inherently bad, something to be protected against rather than managed, and because it encouraged the lines to treat one another as boundaries. That paper was itself superseded on 8 July 2026 by a Statement of Position which addresses the board directly and places collaboration, coordination and reliance between the lines at the centre.
The current statement reaffirms that where a chief audit executive assumes second-line responsibilities, appropriate safeguards must be in place to protect the internal audit function’s independence and its auditors’ objectivity. The arrangement is permitted. The safeguards are the condition.
Sources
The Institute of Internal Auditors, Statement of Position: Three Lines Model, Assurance and Advice in Support of Effective Governance, issued 8 July 2026, replacing the 2020 position paper The IIA’s Three Lines Model: An Update of the Three Lines of Defense.