Why Responsibilities Need to Be Distinct
Operational risk is managed most effectively when responsibility is clear. When a payment error, system outage or processing failure occurs, an insurer needs people who can act on the operation, functions that can provide risk oversight, and an independent function that can assess whether the overall approach is working. These roles are connected, but they are not interchangeable.
The three-lines model organizes these responsibilities by role, not simply by department name or reporting level. An insurer may use different titles or organizational structures; the important question is what each role actually does. The model also does not remove the governing body's oversight responsibilities. The board and executive oversight discussed in the earlier material on operational risk remains important, while the three lines clarify how management and internal audit contribute.
What Each Line Does
First-line roles sit closest to the activity that creates or handles risk. In an insurance operation, claims staff, underwriting teams, policy-administration staff and the managers responsible for those processes are examples. They carry out the work and are responsible for managing the risks associated with it. That responsibility includes following applicable requirements, operating assigned procedures and responding to problems in their area. A risk function can advise them, but it does not take away their ownership of the operation's risks.
Second-line roles support and oversee risk management across the organization. Depending on the insurer, these roles may include operational risk, compliance or other specialist functions. They may establish or interpret risk frameworks, provide guidance, monitor information, identify concerns and challenge management where appropriate. Their work helps the organization judge whether risks are being addressed consistently. They generally do not run the first-line process or take over the business manager's accountability for it.
Third-line internal audit provides independent and objective assurance. It can assess whether governance, risk management and controls are appropriately established and functioning, and it can communicate findings to relevant leaders and the governing body. Internal audit may offer advice, but it must preserve its ability to assess the matters independently. It should not assume management responsibility for a process or control that it may later need to audit.
| Role | Primary contribution | Claims-operation illustration |
|---|---|---|
| First line | Owns and manages risks in the activity | Claims management runs claim handling and addresses payment-process issues |
| Second line | Provides expertise, monitoring and challenge | Operational risk reviews relevant risk information and challenges the business's response |
| Third line | Provides independent, objective assurance | Internal audit assesses whether governance and risk management arrangements are adequate |
The lines are not a sequence in which a risk is handed off and the earlier function stops being responsible. Nor is the second line simply a superior management layer. The first line continues to manage its risks while the second line supports and challenges that work; internal audit can later provide assurance over the arrangements. Their contributions overlap in subject matter, but their accountabilities differ.
Why the Roles Must Remain Distinguishable
The separation follows from the purpose of each role. Someone responsible for running an insurance process must be able to make operating decisions and take action on its risks. A second-line function can help assess whether the approach is appropriate, but if it takes over operating decisions, it becomes harder to distinguish oversight from ownership. Internal audit needs a different position: if it designs or operates the process it later assesses, it risks providing assurance on its own management work.
This is a role-based justification, not a claim that the lines never communicate. Information should move between them. The business explains its processes and response; the second line can question and monitor; internal audit can use relevant information while maintaining independent judgment. The safeguard is that advice and communication do not quietly turn into management of the activity being overseen or audited.
Identify the operation where the risk arises and the managers responsible for delivering it. This points to first-line ownership.
Determine which specialist functions provide risk guidance, monitoring or challenge without taking over the operation.
Determine whether internal audit is assessing governance and risk management objectively, rather than managing the process it evaluates.
Worked Applications
Worked Example: Duplicate Payments in Claims
A hypothetical insurer discovers that some claims were paid twice after a change to its claims platform. Claims operations processes payments. The operational risk team monitors significant operational risks. Internal audit has an upcoming review of claims governance. Identify the role of each function and distinguish immediate management from oversight and assurance.
Method. Start with the activity that produced the exposure, then distinguish the functions by their responsibility rather than by who noticed the problem first.
Step 1: Claims operations is first line. It runs the payment process and is responsible for managing the risks arising from that work. It should investigate the affected claims, take appropriate steps to address the payment issue and manage the operational response. The fact that the platform change may have contributed does not transfer ownership to the operational risk team.
Step 2: Operational risk is second line. It can help the business interpret the issue in the context of its risk framework, monitor the matter and challenge whether management's response addresses the risk. It should not become the function that processes claim payments or make the business's operating decisions.
Step 3: Internal audit is third line. It may independently assess whether governance and risk management arrangements for claims processing are adequate. It should not take over the investigation or approve management's operating response if doing so would make it responsible for work it may later assess.
Check. Operations manages the activity; operational risk supports and challenges; internal audit independently assures. The common mistake is to assign ownership to the risk team because the issue is a “risk” event. The correction is to assign ownership to the managers who run the affected operation.
Worked Example: A Concern Raised by Compliance
In a hypothetical insurer, a compliance specialist notices that a policy-administration team has not consistently documented a required review. The team manager says the compliance function should fix the records because it identified the issue. Explain the responsibilities and a suitable division of work.
Method. Separate identifying or challenging a risk from managing the process in which it arises.
Step 1: Identify first-line ownership. The policy-administration team and its manager run the process and are responsible for managing the risks associated with its work. They should determine what happened in their operation and address the records and process under their management.
Step 2: Identify second-line contribution. The compliance specialist can explain relevant expectations, monitor whether the issue appears broader, and challenge the manager's assessment or response. Finding the concern does not automatically make compliance the owner of the administration process.
Step 3: Preserve role boundaries. The compliance specialist should not quietly take over routine recordkeeping or the team's management decisions merely because the issue was first identified by compliance. Internal audit, if it later reviews the matter, would assess governance and risk management independently rather than perform the remediation.
Check. The team manager owns the operational response; compliance provides oversight and challenge; internal audit can later provide independent assurance. The common mistake is treating the person who detects a problem as the person accountable for managing the underlying operation.
Worked Example: Internal Audit Asked to Design a New Review
A hypothetical insurer experiences errors in policy endorsements. Management asks internal audit to design a new review, train the processing team to perform it, and then issue an independent opinion on whether the review is effective. Analyze the request.
Method. Test whether the proposed work preserves management ownership and internal audit's independence.
Step 1: Assign process accountability. The endorsement-processing manager is first line and remains responsible for managing risks in the process. Management should decide how the operation will be run and who will carry out its work.
Step 2: Identify permissible second-line support. A relevant risk or compliance function can provide expertise, monitor risk-related information and challenge management's approach. That support does not turn the specialist function into the owner of endorsement processing.
Step 3: Protect assurance independence. If internal audit designs and trains staff to operate the review, it takes on management-related work that it is then asked to assess. It should not accept responsibility for the review's design or operation and then claim wholly independent assurance over its own work. It can instead assess management's arrangements independently, subject to its mandate and professional safeguards.
Check. Management owns the process and decisions, second-line functions may support and challenge, and internal audit provides independent assurance. The common mistake is to assume that internal audit's ability to advise means it can own a control and still independently assure it.
Common Misreadings
- “The second line owns all risk.” Risk specialists have oversight and support responsibilities, but the business that carries out an activity remains responsible for managing risks arising from it.
- “The first line is only the front office.” First-line roles include relevant operational teams and their management; they are not limited to customer-facing staff.
- “Internal audit is just another risk-monitoring team.” Internal audit's distinguishing role is independent and objective assurance, not routine oversight or operation of business processes.
- “Three lines means three departments.” Organizations can arrange responsibilities differently. Classify roles by their actual contribution and accountability, not only by their department names.
- “The person who finds a problem owns it.” Detection, oversight and ownership are different responsibilities. A second-line specialist can identify and challenge a concern without becoming the first-line process owner.
Check Your Understanding
For each situation, identify the relevant line or lines and the responsibility that should remain with management.
- A hypothetical insurer's policy-servicing team discovers that address changes were sometimes applied to the wrong policy. Its risk team asks for a summary and questions whether the response covers the full exposure. Identify the first- and second-line roles. (Answer: Policy servicing and its manager are first line and manage the process issue; the risk team is second line and monitors or challenges without taking over the operation.)
- A compliance function issues guidance on a regulatory obligation, samples process information for monitoring, and asks a business manager to explain an apparent gap. Identify its role and the manager's responsibility. (Answer: Compliance performs a second-line role; the business manager remains first line and responsible for managing the relevant operational risk.)
- Internal audit is asked to run a monthly exception report for the claims department and later provide assurance on claims controls. What is the role-boundary concern? (Answer: Running the recurring management report would make internal audit responsible for an operational activity it may later assess; management should own the activity, with internal audit preserving independent assurance.)
- A claims manager disputes a second-line operational risk assessment and asks internal audit to decide which management response to implement. Explain the appropriate roles. (Answer: The claims manager remains responsible for the first-line response; the second line can provide risk oversight and challenge; internal audit should not make the operating decision, but may independently assure governance and risk management.)
- A hypothetical insurer's internal audit team previously advised management about a proposed endorsement review. Management designed and operates the review. What should determine whether internal audit can later provide assurance? (Answer: The actual nature of the earlier advice and any safeguards matter; management must retain design and operating responsibility, and internal audit must preserve objectivity and assess whether it can provide independent assurance without evaluating its own management work.)