The Three Lines of Defence

The three lines of defence provide a framework for effective governance. In this article we will explore that the three lines of defence model involves, and how you can apply it.

Problem: many organisations, especially smaller ones, do not put in place effective governance systems. These systems support success and ultimately promote long terms survival of the organisation. Effective risk management is a key component to building resilience and tackling uncertainty. However, it is rare for organisations to build effective defences against the threats and challenges they face.

Solution: understand what the three lines of defence are and think about ways you can implement them for your business.

________________________________________________________________________________________________

________________________________________________________________________________________________

Contents

• What is the Three Lines of Defence Model?

• First line of defence

  • How to implement the first line of defence

• Second line of defence

  • How to implement the second line of defence

• Third line of defence

  • How to implement the third line of defence

What is the Three Lines of Defence Model?

The “three lines of defence” model is a widely used framework in corporate governance for managing risks. In this explainer we’ll benchmark the lines of defence in the context of effective information governance. However, they apply to all areas such as financial management and stakeholder engagement. The three lines of defence are:

First line of defence

The first line of defence comprises the business units and functions responsible for day-to-day operations and managing risks inherent in their activities. The first line is responsible for identifying and assessing risks. They develop risk management plans, implement controls, and monitor their effectiveness.

For example, in the context of information governance, the first line of defence includes the employees and business units that create, store, process, and use information. They are responsible for ensuring that information is accurate, complete, timely, and secure. The first line of defence also includes IT and security teams that implement technical controls to protect information and detect and respond to security incidents.

How to implement the first line of defence:

• Think about the structure of your organisation. Do you have the right roles in your structure for effective delivery?

• Are role descriptions clear, and set out responsibilities and accountabilities properly?

• Have you implemented the right training and development to ensure effective operational activity?

• Have you defined your core performance metrics, and are you collecting and reviewing performance data?

• Are there effective routes for people to escalate issues and risks that they identify as part of their day to day work

Second line of defence

The second line of defence rests with management functions that provide oversight and support to the first line of defence. The second line is responsible for establishing policies, procedures, and standards for risk management and compliance, monitoring compliance with these standards, and providing guidance and support to the first line.

In the context of information governance, the second line of defence includes compliance and risk management functions that establish policies, procedures, and standards for information governance, monitor compliance with these standards, and provide guidance and support to the first line. This may include conducting audits and assessments, providing training and awareness programs, and developing incident response plans.

How to implement the second line of defence:

• Are there effective management structures in place to define, interpret and implement policies?

• Are managers enabled to take and enact decisions speedily based on the information they are getting?

• Do the right forums exist for organisation wide scrutiny of performance, threats and issues?

• Is organisational performance over time measured so that before and after comparisons are possible, and organisational trajectories can be properly evidenced?

• Does organisational leadership have a clear strategy for the future and know what needs to be put in place to deliver that strategy?

________________________________________________________________________________________________

________________________________________________________________________________________________

Third line of defence

The third line of defence comprises internal audit functions that provide independent assurance on the effectiveness of the first and second lines of defence. The third line is responsible for assessing the adequacy and effectiveness of risk management and control processes, identifying gaps and deficiencies, and making recommendations for improvement.

In the context of information governance, the third line of defence includes internal audit functions that assess the effectiveness of the first and second lines of defence in managing information risks and complying with information governance standards. This may include reviewing controls for accuracy, completeness, and effectiveness, assessing the adequacy of incident response plans, and making recommendations for improvement.

How to implement the third line of defence:

• Do you have access to some form of independent oversight that can play the role of a critical friend?

• Are they able to provide their insights and conclusions to the highest level of organisational management?

• Are the lines of communication two-way so you can explain the actions you have taken to implement their recommendations, or conversely explain convincingly why you will not?

• Is this source of assurance a selling point for your organisation – a way of demonstrating organisational health and operational resilience?

Internal audit doesn’t necessarily mean appointing an external company to review and scrutinise what you do. For smaller organisations it can mean getting other colleagues to look at what you are doing, and how, and offer constructive advice and support to help you improve. It may be your accountant or solicitors can act as your critical friend in some circumstances. A relevant trade body or association may be able to provide impartial advice and support. Sometimes regulators may be able to help. In terms of information governance the Information Commissioner can be a source of advice. Other roles that may be able to help include investors, mentors or independent consultants.

In Summary

The three lines of defence model provides a clear framework for managing risks and ensuring effective management and delivery within organisations. The first line of defence is responsible for identifying and managing risks, the second line provides oversight and support, and the third line provides independent assurance. This model helps ensure that risks are identified and managed effectively, and in accordance with established standards and best practices.

Other Content Like This:

• Why Risk Management is Good Business (no matter what business you’re in)

• Governance, Confidence and Resilience

• Risk Assurance

• The Hierarchy of Risk Controls

________________________________________________________________________________________________

________________________________________________________________________________________________