The Three Lines Model helps organisations identify structures, design processes and assign responsibilities that best assist the achievement of objectives and facilitate strong governance and risk management. It makes the case for the three essential players in audit. At the same time, it clarifies the main essential elements governance requires at its most basic: accountability, actions and assurance and advice.
What is New?
The model encourages a principles-based approach to match the needs and circumstances of an organisation. Clearly, all organisations are different and there can be no one-size-fits-all approach. This led to the model’s explicitly defined six principles on which it is based.
On top of that, there is a change in the use of language, eliminating the use of “lines” and instilling the idea of “roles.” Defining the key roles and describing the relationships among those core roles in the new Model confirms coordination and alignment are essential to ensure organisational coherence and avoid silos.
The new model amplifies the critical need for assurance on the adequacy and effectiveness of risk responses, including controls, as a fundamental component of governance. This is achieved through the competent application of systematic and disciplined processes, expertise and insight by internal audit.
The Six (6) Principles:
1) Governance
Governance of an organization requires appropriate structures and processes that enable:
2) Governing Body Roles
The governing body ensures:
3) Management and First and Second Line Roles
Management’s responsibility for actions (including managing risk) to achieve organizational objectives comprises both first and second line roles. First line roles are most directly aligned with the delivery of products and/or services to clients of the organization, including support functions to make this possible. Second line roles provide assistance with managing risk.
4) Third Line Roles
Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management (including internal control) through the competent application of systematic and disciplined processes, expertise, and insight. It reports its findings to management and the governing body to provoke continuous improvement. In doing so, it may consider assurance from other internal and external providers.
5) Third Line Independence
Internal audit’s independence from the responsibilities of management is critical to its objectivity, authority, and credibility. It is established through: accountability to the governing body; unfettered access to people, resources, and data needed to complete its work; and freedom from bias or interference in the planning and delivery of audit services.
6) Creating and Protecting Value
Governing body roles together with first, second, and third line roles collectively contribute to the creation and protection of value when they are aligned with each other and with the prioritized interests of stakeholders. Alignment of activities is achieved through communication, cooperation, and collaboration, and supports the reliability, coherence, and transparency of information needed for risk-based decision making.
Applying the Model
The Model accommodates the existence in organisations of varying structures. Organisations can structure however they like depending on goals, resources, regulation culture, etc. First and second line roles remain within the responsibility of management. Whereas the internal audit is dependent of the responsibilities of management.
What Internal Auditors should do?
It helps internal auditors to have a better understanding of their roles and subsequently to be able to demonstrate appropriate flexibility and scalability to widen the applicability of internal audit activity within the organisation.
Article search by : Pn. Nurfarah Hanani Binti Abdul Hamed
Date of Input: 10/05/2021 | Updated: 21/05/2021 | nurmiera
Tingkat 2,
Blok F, Bangunan Sekolah Perniagaan dan Ekonomi(SPE),
Jalan Persiaran Tulang Daing,
Universiti Putra Malaysia,
43400 Serdang.