Why Role Confusion Matters
A governance chart can show a business unit, a risk function, and internal audit, yet still leave a material control without an accountable owner. The reverse problem is also possible: several functions may repeatedly check the same transactions while another important risk receives no meaningful assurance. Diagnosing these failures requires looking past titles and asking what each function actually does.
The Three Lines Model distinguishes management of risk from independent assurance about how risk is managed. It is not a requirement that every issue pass through three identical checks. For diagnosis, trace each activity to its decision-maker, its purpose, its scope, and the party accountable for acting on the result.
The governing body oversees management and receives assurance; it is not a substitute control operator. Also, an activity's label does not determine its line. A “risk review” performed by a business manager to approve a transaction is management work, while a second-line review may challenge the quality of that decision without making it.
A Practical Diagnostic Method
Start with the specific risk or control, not the organization chart. For each activity, ask: who sets the control, who performs it, who checks whether it is working, who decides what to do when it fails, and who provides independent assurance? The answers reveal both over-concentration of responsibility and unfilled assurance needs.
State the risk and what the control is intended to prevent or detect. “Review the model” is too vague unless the review objective and scope are clear.
Find the leader accountable for the risk response and the team that owns and operates the control. A committee or function name alone does not establish accountability.
Determine whether second-line activity sets expectations and challenges management, or instead makes the operating decision and performs the control itself.
Check which risks, periods, populations, and control objectives are covered, and whether internal audit can assess the work without reviewing its own management decisions.
Assign management work to an accountable business owner, preserve appropriate second-line challenge, and identify any remaining area that needs independent assurance.
Duplication and Gaps: Count Scope, Not Reports
Two functions checking the same population may be performing different work: one may operate a control, another may challenge its design, and internal audit may independently test whether both are effective. But two reviews with the same objective, sample, period, and method can create duplicated monitoring without adding meaningful coverage. Conversely, many reports do not prove that a critical risk has been assessed.
A simple scope comparison helps expose overlap. Let \(A\) and \(B\) be the sets of file-periods examined by two reviews. Their distinct combined coverage is the union, not the sum of their counts:
This identity follows by counting: adding \(|A|\) and \(|B|\) counts every item in both sets twice, so subtract the intersection once. It describes distinct items examined, not the quality or independence of assurance. Two reviews can examine different items yet use the same inadequate test; a review that covers the whole population can still fail to test the relevant control objective.
Worked Example: Two Monitoring Teams, One Uncovered Risk
A hypothetical insurer’s underwriting team performs a monthly control review of 25 authority-exception files. The second-line risk team also reviews those same 25 files each month using the same checklist. Both teams report their results. The annual internal audit plan includes a review of expense approvals but not underwriting authority or catastrophe accumulation. Diagnose the coverage.
Step 1: Calculate the review counts. Each team reviews \(25 \times 12 = 300\) file-months in a year. Together, the reviews produce \(300 + 300 = 600\) review instances.
Step 2: Separate review instances from distinct file-months. Because the second-line review uses the same files in the same months, the overlap is 300 file-months. Thus the distinct file-month coverage is \(300 + 300 - 300 = 300\), not 600. The second review may still add value if it provides genuine challenge, but identical testing of identical items should not be described as doubling the sample coverage.
Step 3: Diagnose roles and the gap. The underwriting team is performing management’s control. The risk team can appropriately monitor and challenge that control, but repeating the same checklist without distinct analysis risks becoming duplicated monitoring. The described internal audit review does not provide assurance over either underwriting authority or catastrophe accumulation. The latter is therefore an explicit assurance gap in the stated plan.
Step 4: Correct the arrangement. Keep the underwriting team accountable for operating the authority control. Give the risk team a defined monitoring purpose, such as assessing whether exceptions are escalated and whether the control design addresses the risk. Identify an independent assurance activity that covers the material uncovered area. The review counts are checked: 300 + 300 - 300 = 300 distinct file-months.
Method and trap avoided. This is a scope-overlap diagnosis. The common mistake is to call 600 review instances “600 distinct items covered” and conclude that assurance is extensive. That calculation double-counts the same file-months and ignores catastrophe accumulation altogether.
When the Second Line Owns a Control
Second-line functions may establish frameworks, advise on control design, monitor results, and challenge management. The warning sign is not that risk or compliance staff are involved; it is that they become accountable for a control that should be part of managing the business. If the second line sets the operational response, performs it, and reports on its own effectiveness, management ownership and independent challenge can both be weakened.
Diagnose the substance of the activity. Does the function decide whether a business exposure is acceptable, execute the routine action that limits it, or resolve exceptions on management’s behalf? If so, it may have crossed from oversight into management. A second-line function can still escalate an issue, prescribe a required standard within its mandate, or challenge a proposed response without becoming the operational control owner.
Worked Example: Risk Function Operating an Accumulation Limit
A hypothetical insurer has a board-approved maximum catastrophe exposure for each region. The underwriting executive is accountable for regional exposure. However, the second-line risk team maintains the exposure ledger, blocks submissions that would breach the limit, approves exceptions, and reports quarterly that the limit is “under control.” In the last quarter, 4 of 40 proposed submissions were blocked. Diagnose the arrangement.
Step 1: Identify the management objective and accountable leader. The objective is to keep underwriting decisions within the approved regional exposure limit. The underwriting executive is identified as accountable for the exposure, so the operating response should be embedded in underwriting management.
Step 2: Classify the actions by substance. Maintaining the ledger can be an operational control activity; blocking submissions and approving exceptions directly determine which business is written. In this scenario the risk team is not merely challenging underwriting’s process. It is operating a key part of it.
Step 3: Interpret the result carefully. The observed block rate is \(4/40 = 0.10\), or 10%. This describes the share of proposed submissions blocked; it does not show whether all exposure was captured, whether the limit was breached, or whether the control was effective. The figure cannot validate the risk team’s “under control” conclusion by itself.
Step 4: Recommend a role correction. Underwriting management should own the exposure ledger, submission controls, and exception decisions, with clear escalation for decisions outside its authority. The second line can define monitoring expectations, independently challenge reported exposure and exceptions, and escalate weaknesses. Independent assurance should assess whether the arrangements work, without relying solely on the risk team’s own report.
Method and trap avoided. Trace decision rights and control performance rather than relying on the title “risk team.” A common mistake is to treat a 10% block rate as evidence of good control. It is only a descriptive ratio; it says nothing by itself about unrecorded submissions, the exposure limit, or the quality of exception handling.
When Internal Audit Performs Management Work
Internal audit can explain control weaknesses and make recommendations. It may also provide advice on a proposed design, provided management makes and owns the decisions and the audit function preserves its ability to provide objective assurance. The concern becomes acute when auditors select operational thresholds, approve management’s response, run a control, or take responsibility for remediation and then audit that same work.
The diagnosis is a self-review risk: auditors may be asked to assess a decision or control they helped create or operate. A strong assurance plan cannot cure that conflict simply by assigning a different audit team if the function itself remains responsible for the management work. Separate advice from ownership, document who made the decision, and identify any limitation on the assurance that can reasonably be provided.
Worked Example: Audit Designs and Later Tests a Remediation Program
A hypothetical insurer’s internal audit team finds inconsistent review of large commercial claims. Management asks audit to design a new claims dashboard. Audit selects the alert thresholds, assigns staff to clear alerts, and signs off on monthly completion. Six months later, the audit plan asks the same function to conclude whether the dashboard and alert-clearing process are effective. Diagnose the roles and set out a response.
Step 1: Separate advice from management decisions. Audit could describe the finding, explain risks, and recommend that management establish suitable monitoring. Selecting the operational thresholds, assigning staff to clear alerts, and signing off on completion go further: these are design and operating responsibilities for claims management.
Step 2: Identify the self-review issue. The planned audit would assess thresholds and a process that internal audit selected and operated. The function would therefore be evaluating its own management work, weakening the independence and objectivity of the assurance conclusion.
Step 3: Restore management ownership and define assurance limits. Claims management should decide the dashboard design, thresholds, staffing, and evidence of completion, and should be accountable for operating the process. Internal audit should stop performing those duties. Its future assurance plan must account for the prior involvement; the function should not present an unqualified independent conclusion on work it designed and operated. Any assurance arrangement must be sufficiently objective and should not be treated as a device for disguising the original role conflict.
Step 4: Check the diagnosis. The key facts are not merely that audit gave advice or that six months passed. Audit made operational choices, performed an ongoing sign-off, and was then assigned to evaluate those choices. The conflict follows from the activities and responsibility, not from the timing.
Method and trap avoided. Map each action to its decision-maker and operator, then compare those roles with the proposed assurance scope. The common mistake is to say that audit’s involvement was only “consulting” because management requested it. The specific actions show that audit took on management work.
Common Diagnostic Errors
| Misleading shortcut | Why it fails | Better diagnostic question |
|---|---|---|
| Count each function as one layer of assurance. | Three named functions do not prove distinct scope, appropriate roles, or effective testing. | What risk, control objective, population, and period does each activity actually cover? |
| Assume second-line involvement means ownership. | Advice, standards, monitoring, and challenge can be appropriate second-line work. | Who makes the operational decision and remains accountable for the control? |
| Call repeated reviews “stronger assurance.” | Reviews may duplicate the same sample and test while leaving other risks uncovered. | What distinct analysis or independent conclusion does the additional review provide? |
| Assume an audit recommendation makes audit responsible for implementation. | Management remains accountable for choosing and carrying out remediation. | Who selects the response, operates it, and accepts the residual risk? |
A useful correction should be specific. “Improve independence” is not enough if the actual issue is that the risk team approves underwriting exceptions. Name the action to move, identify the management owner, preserve the appropriate monitoring or challenge, and state what assurance remains absent.
Check Your Understanding
For each hypothetical situation, classify the role issue and identify the most important correction.
- A claims team checks 18 files each month for required documentation. Compliance checks the same 18 files using the same checklist. Each team reviews the files in all 12 months. How many distinct file-months are covered by these two reviews, and what should be clarified about compliance’s role? (Answer: 216 distinct file-months; clarify what distinct monitoring or challenge compliance adds beyond the claims control, since the second review duplicates the same scope.)
- A second-line model-risk team sets a required validation standard and challenges business explanations for model changes. The business team selects and operates its models. Is second-line control ownership established by these facts? (Answer: No; standard-setting and challenge are second-line activities, while model selection and operation remain with business management.)
- A business unit reports that its access control passed 10 monthly self-checks. The second line reviewed the same checklist, but internal audit has not assessed access administration. What is the likely diagnostic concern? (Answer: Potential duplicated monitoring and an independent assurance gap; the 10 self-checks do not establish independent assurance.)
- Internal audit recommends that a claims manager improve large-loss escalation. The manager chooses the threshold and owns the revised process; audit later tests whether it operates. Is this automatically management work by audit? (Answer: No; on the stated facts management made and owns the decisions, while audit recommended and later tests the control.)
- Internal audit chooses a new claims escalation threshold, monitors alerts each week, and is assigned to audit the process at year-end. Identify two distinct problems. (Answer: Internal audit has taken on management/control-operating work and faces a self-review threat in the planned assurance.)