Skip to content
finalstate.aiThe Three Lines Model: Independence Is a Role, Not a Headcount
122Atlas

122THREE HATS, ONE HEAD

The Three Lines Model: Independence Is a Role, Not a Headcount

The Three Lines Model distinguishes management's action and challenge from internal audit's independent assurance to the governing body. Rechecking your own decision cannot create that independence.

One decision-maker writes, checks, and approves the same record.Three routes connect one person to one decision record: decide, check, and approve. The checking route returns to the same owner; no separate assurance relationship is created.DecideCheckApprove
A change of task or prompt can improve a check. It does not remove responsibility for the decision being examined.

THREE ROLES, ONE SYSTEM

Internal audit has a direct route to the governing body

Management contains first- and second-line roles; internal audit reports directly to the governing body.Two roles share a management boundary and exchange a decision record. Internal audit sits outside that boundary, examines the record, and reports upward through a separate route to the governing body. Management also reports to that body.Governing bodyManagement12Internal audit
IIA, July 2026, pp. 12–14. Simplified functional relationships; administrative reporting and external providers are omitted. Overlapping responsibilities require safeguards against self-review.
  • First line: owns risks and operates processes and controls
  • Second line: supplies risk expertise, monitoring, support, and challenge within management
  • Third line: internal audit provides independent assurance and advice without taking management decisions

The IIA's July 2026 statement describes responsibilities, not a required number of departments. First- and second-line roles can be combined. Internal audit reports functionally to the governing body and examines the system, including both management lines. Coordination matters; independence does not require isolation.

Access and authority make a second opinion usable

The reviewer needs relevant records and people, control over the scope of the review, and freedom to report an unwelcome finding. The IIA's independence criteria also cover resources, protection from interference, and safeguards for conflicts. A reviewer who helped make the decision may need to step aside from assuring that same work.

THE MODEL CHANGED

The name changed in 2020; the model continues to evolve

Two IIA publications: the 2013 Three Lines of Defense paper and the 2020 Three Lines Model.A still publication sequence shows the change from the Three Lines of Defense title in 2013 to the Three Lines Model title in 2020. The adjacent caption identifies the further 2026 revision.20132020Three Linesof DefenseThree LinesModel
Publication sequence, not an origin claim. The 2020 paper is historical: the IIA replaced it with a new statement on July 8, 2026.

The IIA published its Three Lines of Defense paper in January 2013. Its July 2020 revision renamed the framework the Three Lines Model and emphasized governance, relationships, and creating as well as protecting value. Coordination was already present in the earlier paper. A new statement published July 8, 2026 now replaces the 2020 paper and expands guidance on assurance, advice, and overlapping roles.

Two signatures can share the same blind spot

An approval chain can catch errors while leaving the decision frame untouched. Reviewers may share the target, incentives, or filtered evidence. Management checks and specialist assurance have value; the question is whether anyone can examine their limits and report beyond the owner of the work.

LOCK THE DECISION EARLY

Accept the study plan before seeing the result

Supported first hypotheses: 146 of 152 standard reports, 96.05 percent; 31 of 71 Registered Reports, 43.66 percent.Two fixed bars share a zero-to-one-hundred-percent scale. Standard reports reach 96.05 percent and Registered Reports 43.66 percent, with the corresponding counts below. The bars compare the same defined outcome in two observational samples.Supported first hypothesis0%50%100%96.05%Standard146 / 15243.66%Registered31 / 71
Scheel et al., 2021, Methods and Results. First hypothesis; first preregistered hypothesis for Registered Reports. The standard sample came from a phrase-filtered search. Observational comparison with unblinded coding.
  • Standard reports: 146 of 152 first hypotheses supported, 96.05%
  • Registered Reports: 31 of 71 supported, 43.66%
  • Authors reported full or partial support; this is not the share of all statistical tests with significant results

Registered Reports receive peer review and in-principle acceptance before results, with publication conditional on adherence and quality requirements. Scheel, Schijen and Lakens (2021) compared a sample of standard psychology reports from 2013–2018 with eligible Registered Reports listed by November 19, 2018. Publication formats were not randomly assigned: hypotheses, authors, journals, and replication frequency differed. The gap is consistent with less publication bias, but does not isolate the format's causal effect.

THE SEALED NOTE

Seal the criterion before the result arrives

A criterion is sealed before the result is revealed; a later deviation is recorded separately.The original document remains fixed. The result appears only after its criterion has been sealed. A separate deviation record is then connected to the result, leaving the prior criterion intact.CriterionResultDeviation
Illustrative pilot. A dated rule constrains later reinterpretation; it is neither a Registered Report nor independent audit.
  • Before the pilot: date the criterion, exclusions, and analysis plan
  • After the result: retain that record and explain deviations

Consider a pilot whose continuation depends on a reproducible improvement. Write down what counts as improvement, which observations can be excluded, and how the comparison will be made. Preserve that version when results arrive. This makes changes inspectable; it does not establish whether the criterion itself is a good way to select the correct answer. The same owner still controls the experiment.

BORROW THE LOGIC

An outside reviewer needs more than distance

An outside reviewer examines the full decision record and has a separate route for reporting concerns.The operator and sealed record remain on the left. Evidence becomes accessible to a separate reviewer on the right. A marked concern then travels from the reviewer directly to the agreed recipient above, avoiding the operator. The caption states that access, conflicts, and reporting terms must be established.OperatorReviewerRecipient
Solo-work adaptation, not a formal Three Lines diagram. An outsider supplies useful separation only if conflicts, evidence access, and an unsuppressed reporting route are addressed.
  • Use the sealed record and a separate challenge pass for management checks
  • Agree on evidence access, conflicts, review scope, and who receives findings
  • If the owner controls every report, record that limit on independence

For consequential work, arrange a competent reviewer who did not make the decision, can inspect the underlying record, and can report concerns without the operator's permission. This is a practical adaptation, not a claim to have built an internal audit function. The 2026 IIA statement classifies outsourced work by the function that directs it; hiring an outsider does not change accountability or create a third line by itself.

THE INTERVENTION LOG

Record what changed and why

Illustrative log: A is revised for a missing exclusion; B is escalated for an ownership conflict; C proceeds after a reproduced check.Three decision rows pair dispositions with reasons. The first is returned for revision, the second escalated, and the third allowed to proceed. These are invented examples, not a measured intervention rate or a target for disagreement.Illustrative decision logIDOutcomeReasonAReviseMissingexclusionBEscalateOwnershipconflictCProceedCheckreproduced
Illustrative decision log: three invented entries, no time series or rate. Different decision types and proposal quality can produce different outcomes.
  • Decision A: revise because an exclusion was missing
  • Decision B: escalate because the reviewer had an ownership conflict
  • Decision C: proceed because a separate check reproduced the result

These three invented entries show the information a decision log can preserve. Record the proposal, review outcome, reason, and decision type. Repeated unchanged approvals can prompt inspection of reviewer behavior, including loss of practiced judgment; they cannot diagnose it. Better proposals and easier work can also reduce interventions. Compare like decisions before treating a change in the log as a change in scrutiny.

INDEPENDENCE, NOT HEADCOUNT

Trace the route from evidence to the governing body

An unobstructed route carries evidence through internal audit to the governing body.Records connect to the audit reviewer; a marked finding follows a direct upward reporting route to the governing body. Management remains beside the route rather than acting as its gatekeeper. The diagram tests evidence access and freedom to report, not reviewer headcount.Governing bodyEvidenceInternal auditManagement
Formal model, simplified. Independence depends on responsibilities and safeguards as well as access and the direct reporting route shown here.

A review is constrained when the work's owner can filter its evidence or suppress its findings. In the formal model, internal audit has access, authority, and a direct reporting relationship with the governing body. In a smaller arrangement, name the recipient and disclose the limits. Building the check includes deciding who can question the decision-maker.

Read the transcript

01 · THREE HATS, ONE HEAD

A solo operator writes a proposal, checks it, and approves it. Three activities leave one person responsible for the original decision. A different prompt may catch an error. Returning tomorrow may change the judgment. Neither removes that responsibility. The Institute of Internal Auditors' Three Lines Model distinguishes management's action and challenge from internal audit's independent assurance to the governing body. The question is who can examine the decision without being responsible for it.

02 · THREE ROLES, ONE SYSTEM

Follow the decision record through an organization. First-line management owns the risks and operates the process. Second-line specialists supply expertise, monitoring, support, and challenge. Both roles sit within management, and they can be combined. Internal audit examines how the system works, including the first two lines. It provides independent assurance and advice without taking management decisions. Its functional reporting route goes directly to the governing body. The lines also coordinate their work. If responsibilities overlap, the organization needs explicit safeguards against reviewing its own work.

03 · THE POINT IS INDEPENDENCE

Now suppose the person reviewing the decision receives only a selected summary. The missing records matter even if the reviewer has an impressive title. Can they inspect the underlying evidence and speak to the people involved? Can they choose what to examine? Can they raise an unwelcome finding without the decision-maker rewriting it? They also need sufficient resources and protection from interference. If they designed the process or made the decision, that creates a self-review threat which the arrangement must address.

04 · THE MODEL CHANGED

The publication history explains the name. In January 2013, the Institute of Internal Auditors published its Three Lines of Defense paper. In July 2020, it renamed the framework the Three Lines Model, emphasizing governance, relationships, and creating as well as protecting value. The earlier paper already called for coordination. On July eighth, 2026, a new statement replaced the 2020 paper. It expands the treatment of assurance and advice, including safeguards when responsibilities overlap. The direct relationship between internal audit and the governing body remains.

05 · APPROVAL IS NOT ASSURANCE

Return to the proposal with two signatures. The second reviewer may have caught a calculation error while accepting the target and evidence chosen by the first. The check leaves another question unanswered: who examines whether the target is appropriate, or whether the evidence was filtered? Specialist reviews can provide assurance within management. Internal audit's broader position allows it to examine those checks as part of the system and report their limits to the governing body.

06 · LOCK THE DECISION EARLY

Registered Reports move one consequential judgment earlier. Authors submit a study plan for peer review before results are known. A journal can grant in-principle acceptance regardless of the outcome, provided the work meets the agreed plan and quality conditions. Scheel, Schijen, and Lakens compared psychology papers. The first hypothesis had reported support in one hundred forty-six of one hundred fifty-two standard reports, or ninety-six point zero five percent. For Registered Reports, it was thirty-one of seventy-one, or forty-three point six six percent. Support included full or partial support, as reported by the authors. This was an observational comparison of sampled literature, not random assignment to publication formats. Different hypotheses, authors, journals, and replication frequency may help explain the gap.

07 · THE SEALED NOTE

A solo operator can borrow the earlier commitment. Consider a pilot that will continue only if its improvement can be reproduced. Before the pilot, write and date the criterion, exclusions, and analysis plan. Seal that version. When the result arrives, compare it with the recorded rule. If the analysis changes, add a deviation record explaining what changed and why. Keep the original criterion visible. This makes a moving rule easier to detect. It does not establish that the original rule was sound, or make its author independent of the experiment.

08 · Advertisement · Bubble AI App Builder

Some ideas do not need another document before they become testable. With Bubble AI, you describe the app you want, and Bubble creates a working starting point: interface, data, and logic you can inspect. From there, you refine visually, connect AI models and services, and turn the first version into something real enough to use.

09 · BORROW THE LOGIC

Next, invite challenge from someone who did not make the decision. Give that reviewer access to the full record, not just the approved summary. Agree on the scope, address conflicts, and establish who receives the findings. A concern must be able to reach that recipient without the operator suppressing it. If the operator controls every report, the independence limit remains. Hiring an outsider alone does not create a third line. In the formal model, outsourced work retains the role of the function directing it. This smaller arrangement borrows the logic of separation.

10 · THE INTERVENTION LOG

Keep a decision log that shows the consequences of review. Here are three illustrative entries. Decision A returns for revision because an exclusion was missing. Decision B is escalated because the reviewer had an ownership conflict. Decision C proceeds after a separate check reproduces the result. These are invented examples, not measured rates. Over time, compare similar decisions and their reasons. Fewer interventions might reflect weaker scrutiny, better proposals, or easier work. A string of approvals should lead back to the evidence, not to a quota for disagreement.

11 · INDEPENDENCE, NOT HEADCOUNT

Trace the route once more. Can the reviewer reach the evidence? Can an uncomfortable finding reach the governing body without the work's owner filtering it? In the formal model, internal audit has the authority and reporting relationship to make that possible. In a smaller arrangement, name the recipient and be clear about the limits. Someone must be able to question the decision-maker and have the finding heard. Another signature matters when the relationship behind it permits that scrutiny.

01 / 11 · THREE HATS, ONE HEAD0:00 / 6:54