The IIA's Refreshed
Three Lines Model

00:00:03 The IIA

Hello, welcome to Getting Started With, where our job is to make your job easier.

00:00:09 The IIA

On this episode, we're getting started with the Three Lines model.

00:00:13 The IIA

By the end of this video, you'll understand what the Three Lines model is and why organizations use it, who does what on each line, where internal audit fits and what it means for your work, and what's new in the refresh model.

00:00:24 The IIA

So let's get started.

00:00:27 The IIA

If you're new to internal audit, your first few weeks probably came with a lot of introductions.

00:00:31 The IIA

Who does what?

00:00:33 The IIA

There's a risk team, a compliance team, maybe an information security team, and then there's you, the internal auditor.

00:00:39 The IIA

It's fair to wonder, don't we all basically do the same thing?

00:00:43 The IIA

The answer is no, and the three lines model explains why.

00:00:47 The IIA

The IAA has just released a refreshed version of the model, so there's no better time to get familiar with it.

00:00:53 The IIA

Imagine building a house.

00:00:55 The IIA

The owner decides what they want, sets the budget, and hires a general contractor to make it happen.

00:01:01 The IIA

The crews do the actual building.

00:01:03 The IIA

They pour the foundation, frame the walls, and run the wiring, and they check their own work as they go.

00:01:08 The IIA

A safety officer supports the crews, watches for hazards, and makes sure the work follows the building code.

00:01:15 The IIA

And then there's one more person.

00:01:17 The IIA

The owner hires an independent inspector who doesn't work for the contractor.

00:01:22 The IIA

The inspector answers directly to the owner, and their job is to step back and look at how the whole build is coming together.

00:01:30 The IIA

Hold on to that picture, because you've just met the Three Lines Model.

00:01:35 The IIA

So, what is the Three Lines Model?

00:01:37 The IIA

It's the IA's framework for how organizations arrange the roles that manage risk and provide assurance and advice.

00:01:45 The IIA

As the refresh statement of position puts it, assurance and advice are provided throughout the organization to assess and enhance the organization's ability to achieve its objectives.

00:01:54 The IIA

The model groups those roles into three lines, all serving the board.

00:01:59 The IIA

In our house, the board is the owner.

00:02:02 The IIA

The board provides strategic direction and oversight, while senior management, our general contractor, designs the structures to achieve the organization's objectives.

00:02:11 The IIA

Before we walk the lines, here are two terms to learn because every line provides one or both.

00:02:17 The IIA

Assurance is a statement intended to increase the level of stakeholders' confidence about an organization's governance, risk management, compliance, and control processes.

00:02:27 The IIA

In plain terms, assurance is an independent check that tells the board whether things are working, and it's the core product of your audit work.

00:02:35 The IIA

Advice is information provided to an organization's stakeholders without providing assurance or taking on management responsibilities.

00:02:43 The IIA

In plain terms, advice means offering helpful insights without making management's decisions for them.

00:02:50 The IIA

Now let's meet the three lines.

00:02:52 The IIA

The first line is management, the people doing the work.

00:02:55 The IIA

In our house, that's the building crews.

00:02:57 The IIA

The first line owns and manages the risk day-to-day.

00:03:01 The IIA

It designs and operates processes and controls.

00:03:04 The IIA

Think of an accounts payable team that processes invoices and also runs the checks that catch duplicate payments.

00:03:11 The IIA

The first line is close to the action, first to spot a problem and responsible for fixing it.

00:03:16 The IIA

The second line is made-up of support and specialist roles, like risk management, compliance, or information security.

00:03:23 The IIA

That's our safety officer walking the site with a trained eye.

00:03:26 The IIA

The second line provides expert support, advice, challenge, and monitoring.

00:03:32 The IIA

It helps strengthen how the first line manages risk.

00:03:35 The IIA

Second line roles are still part of management, but they often have some separation from day-to-day operations, which lets them challenge the first line when needed.

00:03:44 The IIA

And the third line is internal audit.

00:03:47 The IIA

That's you.

00:03:48 The IIA

In our house, you're the independent inspector who answers straight to the owner.

00:03:52 The IIA

Third line provides independent and objective assurance and advice.

00:03:56 The IIA

It reports functionally to the board, not to the managers whose work it reviews.

00:04:01 The IIA

That reporting line is what makes your assurance credible.

00:04:04 The IIA

The inspector's report means something precisely because the contractor can't edit it.

00:04:10 The IIA

Here's something to watch out for.

00:04:11 The IIA

Independence is not isolation.

00:04:14 The IIA

Some new auditors think being independent means keeping everyone at arm's length.

00:04:18 The IIA

Not true.

00:04:19 The IIA

The refresh model is clear that preserving independence also requires transparency and constructive engagement across roles.

00:04:27 The IIA

So talk to the first and second lines.

00:04:29 The IIA

Understand their work.

00:04:30 The IIA

A good inspector walks the site and talks to the crews.

00:04:33 The IIA

They don't just pick up a hammer.

00:04:36 The IIA

Now, let's put our house next to the official Three Lines model.

00:04:40 The IIA

The owner is the board.

00:04:41 The IIA

The general contractor is senior management.

00:04:44 The IIA

The crews are the first line.

00:04:46 The IIA

The safety officer is the second line and the inspector.

00:04:49 The IIA

That's internal audit on the third line.

00:04:51 The IIA

This is how the IAA draws exactly what you just learned.

00:04:54 The IIA

When you see this diagram out in the world, and you will, you'll know every player on it.

00:05:00 The IIA

One more thing to watch out for.

00:05:02 The IIA

Don't audit your own work.

00:05:05 The IIA

If you joined internal audit from another part of the business, you shouldn't provide assurance over a process you used to be responsible for.

00:05:12 The IIA

Assurance is incredible if the reviewer designed or operated the process or is evaluating their own past decisions.

00:05:19 The IIA

The updated model notes that a period of at least 12 months between responsibility for a process and providing assurance over it is typically sufficient to safeguard your objectivity.

00:05:29 The IIA

If an engagement touches your old job, raise it with your supervisor early.

00:05:34 The IIA

So, what's new in the refresh model?

00:05:37 The IIA

If you've seen the earlier version, three changes stand out.

00:05:41 The IIA

First, assurance and advice are distinct but complementary.

00:05:45 The IIA

The update treats advice as real value in its own right, delivered across all three lines, not just as a side dish to assurance.

00:05:54 The IIA

Second, independence requires engagement, not isolation.

00:05:58 The IIA

Different roles carry different degrees of independence, and preserving it means fostering transparency and coordination, not building walls.

00:06:07 The IIA

And third, internal audit is the integrator of assurance.

00:06:11 The IIA

Because your function reports to the board and sees the whole organization, it's uniquely positioned to connect the assurance work happening across all the lines into one coherent picture for the board.

00:06:23 The IIA

That integrator role connects directly to the global internal audit standards.

00:06:28 The IIA

Standard 9.5, coordination and reliance, requires the chief audit executive to coordinate with other assurance providers and consider relying on their work.

00:06:38 The IIA

Why does that matter to you?

00:06:39 The IIA

Because coordination reduces duplicated effort and assurance fatigue for the business, and it means the second line's monitoring can sometimes support your engagement once its quality has been evaluated.

00:06:51 The IIA

Just remember, even when internal audit relies on someone else's work, it stays responsible for its own conclusions.

00:06:58 The IIA

The inspector can read the safety officer's logs, but they still walk the site themselves.

00:07:04 The IIA

That brings us to one more turn to learn, assurance map.

00:07:07 The IIA

An assurance map is a high-level document that identifies the holistic risk coverage across the organization by a range of assurance providers.

00:07:15 The IIA

It helps to identify gaps in and duplication of assurance coverage.

00:07:20 The IIA

In plain terms, it's one view of who is checking which risks so nothing gets checked twice while something else gets missed.

00:07:27 The IIA

Here's a pro tip.

00:07:29 The IIA

At the start of every engagement, map who's on which line for the process you're auditing.

00:07:34 The IIA

Knowing who owns the risk and who monitors it tells you who to interview, where evidence should already exist and whether any assurance already covers part of your scope.

00:07:45 The IIA

Let's quickly recap what you just learned.

00:07:47 The IIA

The first line owns and manages risk.

00:07:50 The IIA

The second line supports, monitors and challenges.

00:07:53 The IIA

The third line, internal audit, provides independent and objective assurance.

00:07:58 The IIA

And independence is not isolation.

00:08:00 The IIA

And coordination makes assurance stronger.

00:08:04 The IIA

Learn where you fit, and you'll understand not just what you do, but why it matters to the board.

00:08:11 The IIA

And here's a useful tool.

00:08:12 The IIA

You can download the IIA statement of position on the Three Lines model at the iia.org.

00:08:18 The IIA

It's free, and it's the source for everything in this episode.

00:08:21 The IIA

We've put the link below.

00:08:24 The IIA

Thanks for watching Getting Started with the Freelance Model.

00:08:27 The IIA

If you'd like to keep building, check out Getting Started with ERM 101, where we explore how organizations manage risk across the enterprise.

00:08:36 The IIA

You can find these and other helpful resources, including tools, podcasts, and training at the links below.