The Institute of Internal Auditors spent seven years revising its governance framework. The 2020 update renamed the Three Lines of Defence Model, softened the language, added principles. It did not fix the structural flaw that makes the model useless.
The IIA Three Lines Model is a governance structure that separates operational management, oversight functions, and internal audit into distinct roles.
What the IIA Three Lines of Defense Model claims to do
The IIA published its Three Lines of Defence Model in 2013 as a structural diagram of who does what. First line: operational management. Second line: oversight functions like risk and compliance. Third line: internal audit. The premise is that arranging people into these layers produces better governance. It does not. The 2020 position paper renamed it the “Three Lines Model,” loosened the boundaries between lines, and added principles. Neither version addresses the question that actually matters: are the decisions any good?
What the original model gets wrong
The original Three Lines of Defence Model fails to reflect how organisations actually make decisions. It creates unhelpful silos, particularly in the second line, that assume responsibilities rightfully belonging to management. Rather than asking whether decisions achieve their purpose, the model emphasises organisational structure and departmental labels.
The second line is the most problematic. It assumes that a separate group of specialists, typically called risk managers or compliance officers, can meaningfully improve decisions made by the first line by watching from outside. In practice, the second line becomes a reporting function. It produces registers and heat maps. The first line treats this output as a compliance obligation, not useful input. The two lines operate in parallel, not in sequence. The decisions happen in one room. The risk management paraphernalia is maintained in another.
Internal audit need not exist as a separate entity. While independent decision reviews may have value, an “internal regulator” proves counterproductive. The useful question is not “who audits whom” but “are the decisions we made still producing the outcomes we intended?”
The terms “controls” and “risks” have become divorced from their original decision-making context. Controls represent decisions made previously. Treating them as independent “things” wastes resources monitoring elements that may no longer matter. What matters is whether the assumptions behind those decisions still hold. Roger Estall and I made this case in Deciding: controls are not things to be catalogued in a risk register. They are prior decisions whose foundations need ongoing scrutiny.
The Three Lines in practice: a case study
I chaired a statutory public safety organisation whose second-line function had been producing quarterly risk reports for over a decade. Those reports catalogued hazards, assigned likelihood and consequence ratings, and tabled them at board meetings. The register was updated on schedule. The compliance box was ticked. The organisation was allocating 0.03% of its budget to the safety program that was its prime legislative function.
When we finally examined the assumptions behind that allocation, one Critical assumption, that existing controls were effective, turned out to be completely unsupported. No one in the second line had ever tested it. No one in the third line had ever questioned it. It had persisted for years inside a register that nobody read with the intention of acting on it. We raised the allocation to 0.5%. Mortality dropped 60% within two years.
The Three Lines Model would describe that organisation as having all three lines in place. It did. They were fully assembled and fully useless. The register existed. The oversight function existed. The audit function existed. The premise that mattered most had never been surfaced, because the model asks “who is responsible for what?” rather than “what are we assuming, and does it still hold?” International governance standards like the UK Corporate Governance Code face the same limitation: structure without substance.
What monitoring actually requires
What organisations actually need to watch is straightforward: did we do what we said we would, and are the things we are relying on still holding? None of that requires a Three Lines Model. It requires a monitoring plan built into the decision before it is made, following the Universal Decision-Making Method.
The Three Lines Model asks who watches whom. The better question is what needs watching, and how you would know a decision has gone wrong. That question can only be answered at the point the decision is made, by the person making it, not by a separate department reviewing it afterwards.
Why the Three Lines refresh cannot fix the error
The refreshed document relies on sophistry rather than common sense, using undefined terms like governance and risk management interchangeably. Terms appear as nouns, verbs, and adjectives inconsistently. Phrases like “risk-based thinking” are invented concepts lacking clarity.
The “Applying the Model” section abandons previous strictness, permitting organisations to adapt the guidance however they prefer. When a framework tells its adopters to ignore the parts that do not work, the framework is conceding its own failure. Even ISO 31000, which has its own limitations, does not invite adopters to discard whatever they find inconvenient.
The fundamental problem is not how many lines an organisation draws on a chart. It is the belief that risk management, conducted as a separate activity, can improve decision quality. It cannot. Decisions are improved by surfacing the assumptions they rest on and watching whether they hold.
A decision autopsy conducted on any organisation that adopted the Three Lines Model would reveal the same pattern: the structural apparatus was present, but what the organisation was resting its most consequential decisions on had never been surfaced, classified, or tested. The governance failures I have documented all share that shape.
No number of lines, layers, or defence boundaries substitutes for a Decider who has stated the purpose of a decision, named what must be true for it to succeed, and committed to watching whether it does.
COSO ERM failed its first real test for the same reason. The apparatus sits beside the business. It does not enter it. The updated Three Lines Model remains what the original was: a web of interconnected and ambiguous words and half-formed thoughts.
The ambiguity serves consultants and internal auditors by justifying their continued existence while failing to provide practical guidance for the organisations that adopt it. The model gave everyone a role. It gave no one the question.
What organisations need is not another decision-making framework. It is a method that enters the room where decisions happen. Roger Estall and I developed the Universal Decision-Making Method to replace this kind of structural theatre with actual thinking.
You could redraw the three lines and still miss who shaped the next unsafe call.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.