page contents

Single Blog Title

This is a single blog caption

Corporate Governance Risk Management Line Of Defence

Posted By


As an ardent football (soccer) fan and watcher, you always hear the saying that the best form of defense is attack. That is why today Barcelona and the Spanish National Football (Soccer) team have become household names, because of the way they play the beautiful and wonderful game of football (soccer).

For those who watch and follow the beautiful game I am sure you know that a team is made up of different roles – Goalkeeper, Defenders, Midfielders and Attackers (Strikers). Where all the roles of the team are properly drilled and harnessed by the coach and/or manager, they all will operate like they are one and that brings continued success.

The same can be said of Corporate Governance and Risk Management for companies. As we are all aware, a company is made up of diverse team of internal auditors, enterprise risk management specialists, compliance officers, internal control specialists, quality inspectors, fraud investigators, and other risk and control professionals working together to help their organizations manage risk.

It is not enough that the various risk components and control functions exist — the challenge is to assign specific roles and to coordinate effectively and efficiently among these groups so that there are neither “gaps” in controls nor unnecessary duplications of coverage, just like a football (soccer) team.

Clear responsibilities must be defined so that each group of risk and control professionals understands the boundaries of their responsibilities and how their positions fit into the organization’s overall risk and control structure (i.e. “Enterprise-wide Risk Management Framework”).

The stakes are high. Without a cohesive, coordinated approach, limited risk and control resources may not be deployed effectively, and significant risks may not be identified or managed appropriately. The problem can exist in any organization, regardless of whether a formal Enterprise Risk Management Framework is used.

Fortunately, best practices are emerging that can help organizations delegate and coordinate essential risk management functions with a systematic approach, which is called “The Three Lines of Defense Model

In this model, management control is the first line of defense in risk management, the various risk control and compliance oversight functions established by management are the second line of defense, and independent assurance is the third. Each of these three “lines” plays a distinct role within the organization’s wider governance framework.

(Adapted from ECIIA/FERMA Guidance on the 8th EU Company Law Directive, article 41)

It is important to note that governing bodies and senior management are the primary stakeholders served by the “lines,” and they are the parties best positioned to help ensure that the Three Lines of Defense Model is reflected in the organization’s risk management and control processes.

The Three Lines of Defense Model is best implemented with the active support and guidance of the organization’s governing body and senior management.

The Three Lines of Defense Model distinguishes among three groups (or lines) involved in effective risk management:

  • Functions that own and manage risks.
  • Functions that oversee risks.
  • Functions that provide independent assurance

As the first line of defense, operational managers own and manage risks. They also are responsible for implementing corrective actions to address process and control deficiencies.

Operational management is responsible for maintaining effective internal controls and for executing risk and control procedures on a day-to-day basis. Operational management identifies, assesses, controls, and mitigates risks, guiding the development and implementation of internal policies and procedures and ensuring that activities are consistent with goals and objectives.

Operational management naturally serves as the first line of defense because controls are designed into systems and processes under their guidance of operational management.

In the real world, however, a single line of defense often can prove inadequate. Management establishes various risk management and compliance functions to help build and/or monitor the first line-of-defense controls. These risk management and compliance function forms the basis of the second line defense.

The specific functions will vary by organization and industry, but typical functions in this second line of defense include:

  • A risk management function (and/or committee) that facilitates and monitors the implementation of effective risk management practices by operational management and assists risk owners in defining the target risk exposure and reporting adequate risk-related information throughout the organization.
  • A compliance function to monitor various specific risks such as non-compliance with applicable laws and regulations. In this capacity, the separate function reports directly to senior management, and in some business sectors, directly to the governing body. Multiple compliance functions often exist in a single organization, with responsibility for specific types of compliance monitoring, such as health and safety, supply chain, environmental, or quality monitoring.
  • A controllership function that monitors financial risks and financial reporting issues.

Management establishes these functions to ensure the first line of defense is properly designed, in place, and operating as intended. Though each of these functions has some degree of independence from the first line defense, they are still a function of management. As such the second line defense serves a vital role, however it cannot offer truly independent analyses to governing bodies as it relates to risk management.

The responsibilities of these functions vary on their specific nature, but can include:

  • Supporting management policies, defining roles and responsibilities, and setting goals for implementation.
  • Providing risk management frameworks.
  • Identifying known and emerging issues.
  • Identifying shifts in the organization’s implicit risk appetite.
  • Assisting management in developing processes and controls to manage risks and issues.
  • Providing guidance and training on risk management processes.
  • Facilitating and monitoring implementation of effective risk management practices by operational management.
  • Alerting operational management to emerging issues and changing regulatory and risk scenarios.
  • Monitoring the adequacy and effectiveness of internal control, accuracy and completeness of reporting, compliance with laws and regulations, and timely remediation of deficiencies.

The Internal Audit function is the third line defense. Internal auditors provide the governing body and senior management with comprehensive assurance based on the highest level of independence and objectivity within the organization. This high level of independence is not available in the second line of defense. Internal audit provides assurance on the effectiveness of governance, risk management, and internal controls, including the manner in which the first and second lines of defense achieve risk management and control objectives. The scope of this assurance, which is reported to senior management and to the governing body, usually covers:

  • A broad range of objectives, including efficiency and effectiveness of operations; safeguarding of assets; reliability and integrity of reporting processes; and compliance with laws, regulations, policies, procedures, and contracts.
  • All elements of the risk management and internal control framework, which includes: internal control environment; all elements of an organization’s risk management framework (i.e., risk identification, risk assessment, and response); information and communication; and monitoring.
  • The overall entity, divisions, subsidiaries, operating units, and functions — including business processes, such as sales, production, marketing, safety, customer functions, and operations — as well as supporting functions (e.g., revenue and expenditure accounting, human resources, purchasing, payroll, budgeting, infrastructure and asset management, inventory, and information technology).

Establishing a professional internal audit activity should be a governance requirement for all organizations. This is important for all forms of companies – large, medium and/or small, as they may face equally complex environments with a less formal, robust organizational structure to ensure the effectiveness of its governance and risk management processes.

Internal audit actively contributes to effective organizational governance providing certain conditions — fostering its independence and professionalism — are met.

Best practice is to establish and maintain an independent, adequately, and competently staffed internal audit function, which includes:

  • Acting in accordance with recognized international standards for the practice of internal auditing.
  • Reporting to a sufficiently high level in the organization to be able to perform its duties independently.
  • Having an active and effective reporting line to the governing body.

Due to the fact that every organization is unique and specific situations vary, there is no one “right” way to coordinate the Three Lines of Defense. When assigning specific duties and coordinating among risk management functions, however, it can be helpful to keep in mind the underlying role of each group in the Risk Management Process.

First Line Defense

Second Line Defense

Third Line Defense

Risk Owner/Manager

Risk Control and Compliance

Risk Assurance

·         Operating Management

·         Limited Independence

·         Internal audit


·         Reports primarily to management

·         Greater independence



·         Reports to governing body


All three lines should exist in some form at every organization, regardless of size or complexity. Risk management normally is effective and adequate when there are three separate and clearly identified lines of defense (as described in this article).

Regardless of how the Three Lines of Defense Model is implemented, senior management and governing bodies should clearly communicate the expectation that information be shared and activities coordinated among each of the groups responsible for managing the organization’s risks and controls.


Leave a Reply