The model is clear, the naming misleads.
The 2020 revision of the IIA Three Lines Model dropped the word “defense” and introduced “roles” instead of “lines”. That is not cosmetic. The old reading of three lines, operations / risk & compliance / internal audit, suggested a forced separation that does not work in mid-cap organisations. The new reading is role-based: one person may serve different roles in different contexts.
Distortion 1: “First line does risk management.”
No. The first role achieves the organisation’s objectives and manages the risks tied to those objectives. Risk management as a specialism sits in the second role, the second supports, advises and oversees. In Dutch practice we often see the risk officer parked inside the business “because it is close to the risk.” That weakens both their independence and their supporting capacity.
Distortion 2: “Compliance is second line, hence independent.”
Compliance is in the second role, but reports to senior management like other second-role functions. Dutch practice often shows compliance setting up its own kingdom, with a direct line to the supervisory board, disconnected from the Chief Risk Officer. That weakens coherence. The 2020 version is firm: second-role functions deliver one coordinated risk-management perspective, with one accountable owner.
Distortion 3: “Internal Audit sits next to second line.”
Internal Audit is a separate role, not “the third line beside the second”. The difference is that IA reports to governance (Audit Committee), not to executive management. In Dutch mid-cap organisations we frequently see the Chief Audit Executive (CAE) reporting to the Chief Financial Officer (CFO) or Chief Risk Officer (CRO). That damages independence. The 2020 version is explicit: solid line to governance, dotted line to executive.
Three repair routes, without reorganisation.
- Rewrite the charters: amend only the Internal Audit Charter and Risk Management Charter to name reporting lines clearly.
- Make the chain visible: one A4 with who reports to whom, approved by board and supervisory board.
- Test once a year: in the past twelve months, did the supervisory board hear anything that should first have been filtered by one of the three roles? If yes, fix that piece.