![Three glowing security shields on a dark blue background](https://www.ians.com/_astro/how-to-apply-the-three-lines-of-defense.C7M86HZ5_Z1UWwAy.webp)

# How to Apply the Three Lines of Defense

Understand how the three lines of defense model works and how to allocate risk work across operational, tactical, and strategic teams.

Author: [Josh More](https://www.ians.com/faculty/josh-more) 8 min read June 24, 2025 Updated October 6, 2026

Key points

- Agree first on what each line does. The first line owns and manages risk; the second oversees risk and compliance; and the third, usually internal audit, checks it all independently.
- Place people by their natural work pace: day-to-day operations in the first line, weekly to monthly risk work in the second, and quarterly to yearly independent reviews in the third.
- Treat the second line as a translator and advisor: it helps management set strategy, advises the first line on carrying it out, and leaves daily details to the first line.
- In July 2026, the Institute of Internal Auditors said outsourcing does not change who is accountable, and overlapping roles can work with safeguards, such as a written split of duties.

Since the three lines of defense model (also spelled “three lines of defence”) was first described in a 2013 paper and revised in the [2020 release](https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf), there have been many different interpretations of how the model could best be implemented—some of which misunderstand the purpose of the second line. This piece explains why it is necessary to first understand how the lines work in the real world and then show how to use a framework to more practically allocate work among them.

The three lines at a glance:

| Line | Role in the model | Work cadence |
| --- | --- | --- |
| First line | Owns and manages risk (risk owners and managers) | Operational: hourly to daily |
| Second line | Oversees risk control and compliance | Tactical: weekly to monthly |
| Third line | Provides independent assurance, typically internal audit | Strategic: quarterly to yearly |

## What Goes Wrong When Organizations Apply the Three Lines of Defense?

There are two problematic tendencies in business with respect to the three lines of defense. The first problem arises when people take the three lines of defense model and apply it to existing practices, effectively turning the model into a paperwork exercise but without driving fundamental change.

The second problem occurs when people attempt to make changes and wind up creating an environment of distrust, where the first line views the second line as constantly trying to catch them in mistakes, while the second views the third line in the same way.

## What Are the Three Lines of Defense?

Before any work can be allocated across the lines, it is imperative to develop some consensus around what the three lines are expected to do. As originally conceived:

- **First line of defense:** Owns and manages risks/risk owners/managers
- **Second line of defense:** Oversees risks/risk control and compliance
- **Third line of defense:** Provides independent assurance/risk assurance

Unfortunately, this approach does not align well with how most organizations are structured. The revised model introduces key principles, which improve things significantly, but it still lacks the practical element of time. The revised line descriptions are in the updated diagram below.

In practice, the first line generally involves day-to-day business practices, although there is disagreement about how far this line stretches—with some focusing just on operations with inherent risk and others extending to all operations. The third line is also well understood, focusing largely on what most organizations would term “internal audit.”

The second line is tricky, though, with a fuzzy mission around “overseeing risks” in the first release and “expertise, support, monitoring, and challenge” in the revised paper. The second line is “independent-ish” from the first line, but not as independent as the third line. It is often unclear where the monitoring of day-to-day operations shifts from first line to second line. Similarly, it is unclear where oversight duties of the second line begin to blend with the oversight duties carried out by the third line.

### What changed in 2026: the IIA’s updated Three Lines Model

On July 8, 2026, the Institute of Internal Auditors (IIA) published a new Statement of Position on the Three Lines Model, replacing its earlier position paper on the model.

The update keeps the model’s core structure. The first line, management and operational roles, owns and manages risk. The second line, specialized risk functions, provides expertise, support, monitoring and challenge. The third line, internal audit, provides independent assurance and advice. What it expands is how the lines work together: clearer accountability within each line, independence as the basis of credible assurance, and coordination among management, second-line functions, internal audit and external assurance providers to close gaps and avoid overlap.

![IIA's 2026 Three Lines Model: the board, senior management, the first, second and third lines, coordination and reliance, and external assurance providers](https://www.ians.com/_astro/how-to-apply-the-three-lines-of-defense-figure-3.Dke1fPA5_Zbdb1I.webp)

The IIA's Three Lines Model, 2026 Statement of Position.

The 2026 statement also addresses two common complications:

- **Third parties:** outsourcing does not change accountability. External service providers are categorized according to the function that engages and directs their work.
- **Co-mingled duties:** overlapping roles are “not inherently problematic” when safeguards are in place, such as a documented allocation of responsibilities, independent review where self-review risks arise, and board approval of expanded remits.

Source: Three Lines Model: Assurance and Advice in Support of Effective Governance, a Statement of Position from [The IIA](https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf)

## What Complicates the Three Lines of Defense Model?

Three factors further complicate this simplified view of risk management:

- **Risk ownership:** The placement of risk ownership at the first line can cause complications, because this design co-mingles senior leaders who traditionally “own” the risk with the front-line workers who perform the day-to-day functions consisting of the overall risk management practice. It is common for real-world organizations to push the risk ownership up to the second line of defense, contrary to the model, simply because that is what the political realities of the organization dictate. This issue has been revisited a few times, though it has not been fully addressed.
- **Third parties:** It is unclear which of the three lines is responsible for managing third parties, with various implementations in organizations across the world.
- **Co-mingling of duties:** Ideal models have separation of duties between individuals. However, as we’ve seen with the rise of DevOps, separating duties by role rather than individual is also an accepted practice. With the three lines, the design is such that the second line of defense is responsible for creating risk models, identifying risk management frameworks and defining requirements—all duties often performed by risk owners.

## Why Is the Second Line of Defense Hard to Define?

As can be seen in the literature, the first and third lines are reasonably well-defined, with the second line largely taking on the work that doesn’t cleanly fit in the other two lines. Such tasks can be highly variant and dependent on business culture, structure, and politics.

## How Do You Allocate Work Across the Three Lines of Defense?

To simplify the allocation of work across the lines, it can help to understand people’s natural work cadences and how that maps to how the work is typically done across the lines:

- First line of defense – operational - focused on hourly-to-daily work
  - Business operations
  - Implementing and using security controls
  - Continuous monitoring of the controls
  - Reporting to senior management
- Second line of defense – tactical - focused on weekly-to-monthly work
  - Business tactical analysis/tactics
  - Identifying emerging issues and changes to external requirements
  - Setting and adjusting risk management goals
  - Consulting efforts to improve efficiency, coverage and risk management
  - Reporting to senior management
- Third line of defense – strategic – focused on quarterly-to-yearly work
  - [Independent analysis against standards](https://www.ians.com/consulting/security-program-assessments), laws and regulations, typically annually
  - Reporting to both senior management and board or audit committee

It is critical to understand that when someone who works off a rapidly changing work queue has to work with someone who moves at a much slower pace, the experience can be frustrating for them both – with the operationally-minded person upset at the perceived slowness of the strategic-minded person, and the strategic-minded person irritated that the operationally-minded person doesn’t think deep or “big picture” enough. By allocating people into lines based on their personal natural cadences, and formalizing how the lines work together, many of the roadblocks are seamlessly removed.

Looking at the actual duties of the second line, it is clear the original diagram from 2013 is flawed (see Figure 1) and, while the 2020 revision is significantly better, it is focused on reporting and accountability, not on communication.

![Chart Representing IIA's Original Three Lines of Defense Model](https://www.ians.com/_astro/how-to-apply-the-three-lines-of-defense-figure-1-original.BbPoptmG_Ze1oEH.webp)

Figure 1: IIA's original Three Lines of Defense Model, 2013. Adapted from ECIIA/FERMA Guidance on the 8th EU Company Law Directive, article 41.

![IIA's Three Lines Model, revised in 2020](https://www.ians.com/_astro/how-to-apply-the-three-lines-of-defense-figure-1-revised.CnLwXn_R_Zmbvc9.webp)

The IIA's Three Lines Model: revised diagram from 2020.

It works better to re-conceive the role of the second line as a translation and consultation service that streamlines work between the first and third lines of defense, as well as senior management and external factors (see 2025 revised diagram, Figure 2).

![How to Apply 3 lines of defense](https://www.ians.com/_astro/how-to-apply-the-three-lines-of-defense-figure-2.06spcyaS_ZJdV2u.webp)

Figure 2: 2025 revised diagram.

In this clarification, you can see how management and the board work to determine goals and communicate strategy to the third line of defense. The third line can audit against this strategy and communicate the results to the board. However, to remain independent, the third line cannot determine how the strategy is to be implemented tactically—nor is it in a position to provide guidance for how the organization should handle external factors. Similarly, the first line must be allowed to focus to complete the day-to-day business requirements.

The second line is what makes the entire process function, taking in data from all parties (except the board). They work to understand changes to the external compliance and threat ecosystems and [how vendors can help](https://www.ians.com/ians-intelligence/vendor-assessment-community) address those changes. They work with the third line and management to determine strategy and consult with the first line on how that strategy is best implemented tactically, but it leaves the operational details to be determined by the first line.

With this conception, it becomes much easier to determine how work is to be allocated between the lines. For example, consider the NIST Cyber Security Framework (CSF) “protect” requirement, PR.DS-11. It states “Backups of data are created, protected, maintained, and tested” In the three lines of defense model, the first line would be responsible for implementing the technology to meet the required recovery time objective (RTO) and recovery point objective (RPO). The second line would work with senior management to define specific RTO/RPO requirements and lead the internal testing processes, while the third would be charged with verifying the backup process meets internal requirements.

## Beyond the Three Lines of Defense

Reviewing the literature released since 2013, it is clear the three-line model has been challenging for a great many businesses, particularly around the fuzziness in the definition of the second line, which provides oversight, consultation, communication and (in some cases) monitoring services. However, by refocusing the second line on strictly consultation and translation services, it is easier to allocate work in an appropriate manner.

Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our News & blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.

Share this article

About the author

[![Headshot of Josh More](https://www.ians.com/_astro/josh-more.CnlFR6kv_2oNLLa.webp)](https://www.ians.com/faculty/josh-more)

## [Josh More](https://www.ians.com/faculty/josh-more)

IANS Faculty

Josh is the owner and president of Eyra Security, an information security and business improvement consulting firm that specializes in helping startups and organizations in transition take advantage of lean and agile methods, open source technology and varied frameworks used for security, risk management and compliance. He also serves on the GIAC Advisory Board. Additionally, as an active member in the information security community, Josh is a member of ISSA, Agile Iowa, OWASP, DC612, Central Iowa Area Linux Users Group and Infragard.

[View full profile](https://www.ians.com/faculty/josh-more)

## Frequently asked questions

Where does cybersecurity fit in the three lines of defense?

The first line is management, who owns the first line of getting software installed and configured correctly. Typically, that falls under IT with a business owner who owns the risk acceptance. The second line is some type of full-time oversight. Let’s call that compliance or cyber. They have things like an application security program that provides tools and watches the number of vulnerabilities/misconfigurations and reports that back to the first line management.Source: Realigning SecOps and IT Security Control Ownership, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Ross Young](https://www.ians.com/faculty/ross-young)

How do small organizations handle the three lines of defense?

Larger organizations can separate the lines with organizational roles, responsibilities and accountabilities. Smaller organizations combine some of those roles in the same person or the same team. The real key is noting what each line does and how risks are captured, tracked, governed, reported on and mitigated across the three lines in your organization.Source: Structuring Second Line of Defense for Small Orgs, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Todd Inskeep](https://www.ians.com/faculty/todd-inskeep)

What does the second line of defense do in cybersecurity?

Cyber risk management: risk assessments, definition of risk appetite (working with risk functions), directive controls including policies. Cyber program oversight: threat assessment, vulnerability priority and management, control testing. Compliance: audit and assessment preparation, internal assessments, regulatory monitoring. Incident response: planning, tabletops, reporting, execution. These days, the second line of defense is also being given third-party risk management (TPRM).Source: Structuring Second Line of Defense for Small Orgs, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Alex Sharpe](https://www.ians.com/faculty/alex-sharpe)

Which line of defense is the ultimate owner of risk?

Management (first line) owns and manages risks and is responsible for the design and operation of processes and controls. The senior management team, ultimately, the CEO, is accountable to the board for the effectiveness and efficiency of risk management, compliance, and control processes that create and sustain value for stakeholders.Source: Three Lines Model: Assurance and Advice in Support of Effective Governance, a Statement of Position from [The IIA](https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf)

Vendor evaluations

Peer benchmark data

Expert answers

Compliance mapping

Program guidance

Threat intelligence

Templates & tools

Technical deep dives

Emerging tech signals

IANSMCP

Claude

Copilot

![ChatGPT](https://www.ians.com/icons/llms/chat-gpt-logo.svg)

Coming soon

Everything the IANS MCP server draws on

- Vendor evaluations
- Peer benchmark data
- Expert answers
- Compliance mapping
- Program guidance
- Threat intelligence
- Templates & tools
- Technical deep dives
- Emerging tech signals

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Further Reading

[Browse all articles](https://www.ians.com/blog)

[How to Set Up a Strong GRC Program Core components of a GRC program: assess maturity in eight areas, from roles and legal requirements to vendor risk, then build on NIST CSF 2.0 or COBIT 2019. Sep 2, 20257 min read Rebecca Herold Sep 2, 20257 min read Read more](https://www.ians.com/blog/ians-research/how-to-set-up-a-strong-grc-program) [Tips for Advancing Your GRC Program How to build a cross-functional task force and use risk management components to flesh out a GRC program. Apr 3, 20243 min read Joshua Marpet Apr 3, 20243 min read Read more](https://www.ians.com/blog/ians-research/tips-for-advancing-your-grc-program) [How to Develop a More Holistic Risk Management Program How adding a quantitative, cradle-to-grave approach to risk management improves visibility into asset value at risk. Aug 15, 20236 min read Richard Seiersen Aug 15, 20236 min read Read more](https://www.ians.com/blog/ians-research/how-to-develop-a-more-holistic-risk-management-program)