The Three Lines Model helps organisations identify structures, design processes and assign responsibilities that best assist the achievement of objectives and facilitate strong governance and risk management. It makes the case for the three essential players in audit. At the same time, it clarifies the main essential elements governance requires at its most basic: accountability, actions and assurance and advice.

 

 

What is New?

The model encourages a principles-based approach to match the needs and circumstances of an organisation. Clearly, all organisations are different and there can be no one-size-fits-all approach. This led to the model’s explicitly defined six principles on which it is based.

On top of that, there is a change in the use of language, eliminating the use of “lines” and instilling the idea of “roles.” Defining the key roles and describing the relationships among those core roles in the new Model confirms coordination and alignment are essential to ensure organisational coherence and avoid silos.

The new model amplifies the critical need for assurance on the adequacy and effectiveness of risk responses, including controls, as a fundamental component of governance. This is achieved through the competent application of systematic and disciplined processes, expertise and insight by internal audit.

 

The Six (6) Principles:

 

1) Governance

Governance of an organization requires appropriate structures and processes that enable:

• Accountability by a governing body to stakeholders for organizational oversight through integrity, leadership, and transparency
• Actions (including managing risk) by management to achieve the objectives of the organization through risk-based decision-making and application of resources
• Assurance and advice by an independent internal audit function to provide clarity and confidence and to provoke continuous improvement through rigorous inquiry and insightful communication.

 

2) Governing Body Roles

The governing body ensures:

• Appropriate structures and processes are in place for effective governance
• Organizational objectives and activities are aligned with the prioritized interests of stakeholders.

 

3) Management and First and Second Line Roles

Management’s responsibility for actions (including managing risk) to achieve organizational objectives comprises both first and second line roles. First line roles are most directly aligned with the delivery of products and/or services to clients of the organization, including support functions to make this possible. Second line roles provide assistance with managing risk.

 

4) Third Line Roles

Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management (including internal control) through the competent application of systematic and disciplined processes, expertise, and insight. It reports its findings to management and the governing body to provoke continuous improvement. In doing so, it may consider assurance from other internal and external providers.

 

5) Third Line Independence

Internal audit’s independence from the responsibilities of management is critical to its objectivity, authority, and credibility. It is established through: accountability to the governing body; unfettered access to people, resources, and data needed to complete its work; and freedom from bias or interference in the planning and delivery of audit services.

 

6) Creating and Protecting Value

Governing body roles together with first, second, and third line roles collectively contribute to the creation and protection of value when they are aligned with each other and with the prioritized interests of stakeholders. Alignment of activities is achieved through communication, cooperation, and collaboration, and supports the reliability, coherence, and transparency of information needed for risk-based decision making.

 

Applying the Model

The Model accommodates the existence in organisations of varying structures. Organisations can structure however they like depending on goals, resources, regulation culture, etc. First and second line roles remain within the responsibility of management. Whereas the internal audit is dependent of the responsibilities of management.

 

What Internal Auditors should do?

It helps internal auditors to have a better understanding of their roles and subsequently to be able to demonstrate appropriate flexibility and scalability to widen the applicability of internal audit activity within the organisation.

Reference: https://global.theiia.org/knowledge/Public%20Documents/GPAI-Three-Lines-Model-An-Important-Tool-for-the-Success-of-Every-Organization.pdf 

 

Article search by : Pn. Nurfarah Hanani Binti Abdul Hamed

Date of Input: 10/05/2021 | Updated: 21/05/2021 | nurmiera