Why Map Activities Rather Than Job Titles?
The Three Lines model helps an organization clarify how responsibilities for risk management and assurance fit together. In practice, a task’s label or the department performing it does not always reveal its role. A “control review,” for example, could be a business team’s routine check, a specialist function’s oversight review, or an internal audit engagement. The purpose and accountability of the activity determine the classification.
This tutorial focuses on mapping individual activities. The same function may perform more than one kind of activity, so classify the work being done rather than assigning every task to a line based only on the employee’s title.
These descriptions refer to responsibilities, not necessarily separate departments or levels of seniority. A first-line manager remains accountable for managing the risks of the manager’s operation even when a risk specialist advises or monitors. A second-line function may set organization-wide risk guidance without taking over the business’s responsibility to manage its own risks. Internal audit’s distinct contribution is independent assurance, not operating the controls it later evaluates.
A Practical Method for Classifying an Activity
Start with the activity itself. Ask who is accountable for the underlying operation, what the person is doing, and whether the work is management, oversight, or independent assurance. Do not infer the answer from words such as “monitor,” “test,” or “approve” alone.
Specify the process, exposure, obligation, or control involved. “Reviewing risk” is too broad; “checking whether claims above a threshold received required approval” is more informative.
If the activity is part of delivering the service or managing its exposure, it is generally first-line work. The responsible business leader retains accountability even when others assist.
Specialist guidance, monitoring of adherence, and challenge of business decisions are generally second-line activities, provided the function does not assume responsibility for running the operation.
An internal audit activity that evaluates and reports independently on the adequacy of governance, risk management, or controls is third-line work. Routine business checks are not third-line audit merely because they are called tests.
When an initiative includes several activities, classify each one separately. For example, a business unit may operate a control, compliance may monitor adherence, and internal audit may later provide independent assurance.
A useful justification for this method is that a line is defined by its relationship to risk accountability and assurance, not by the physical action being performed. Consider the action “check a control.” If a claims manager checks the team’s daily approval log to manage claims processing, the check forms part of the manager’s risk management. If compliance examines approval records to assess adherence and challenge the business, that is oversight. If internal audit evaluates whether the control framework is suitably designed and operating effectively, its purpose is independent assurance. The verb is the same; the accountability and purpose differ.
Mapping Common Governance Activities
| Activity and purpose | Typical line | Reason |
|---|---|---|
| Designing and operating a control in a business process | First line | The business manages its operation and the associated risk. |
| Advising a business team on applicable obligations | Second line | A specialist function interprets requirements and supports implementation; the business remains responsible for compliance in its activity. |
| Tracking a unit’s exposure to manage it against approved limits | First line | The risk owner uses monitoring as part of managing the exposure. |
| Monitoring adherence to risk policies across business units and challenging exceptions | Second line | The activity provides oversight and challenge rather than managing each operation. |
| Performing a routine check or self-assessment of a business control | First line | The control owner or operator checks the control as part of ongoing management. |
| Independently evaluating the design and effectiveness of controls | Third line | Internal audit provides assurance rather than operating or owning the control. |
The table gives typical mappings, not automatic answers based on a task name. For example, “monitoring” can describe a business manager tracking the manager’s own exposure or a second-line function monitoring compliance across units. Likewise, specialist functions may provide advice and oversight without relieving first-line leaders of their responsibilities.
Worked Example: Setting and Monitoring a Claims Authority Control
A hypothetical insurer requires additional approval for claims above a specified authority threshold. The claims director establishes how the claims team will apply the threshold. A compliance adviser explains the applicable conduct obligations, and the claims team checks its own daily exception log. Separately, compliance reviews exception trends across several business units and reports recurring breaches. Map each activity.
Method. Classify each activity by whether it manages the claims operation, provides specialist advice or oversight, or independently assures the control. The fact that several activities concern the same threshold does not make them the same line.
Step 1: Establishing how the claims team applies the threshold. The claims director is responsible for managing claims operations. Establishing a process for applying the authority threshold is first-line work. The business owns the control within its process.
Step 2: Explaining relevant conduct obligations. The compliance adviser supplies specialist interpretation and advice. This is second-line work. It does not transfer the claims director’s responsibility to implement the requirements in claims handling.
Step 3: Checking the daily exception log. The claims team uses the check to manage its own work and identify exceptions promptly. This is a first-line check, even though it may be described as control testing.
Step 4: Reviewing trends across business units. Compliance looks across operations for adherence patterns and reports recurring issues. This is second-line monitoring and challenge, not the claims team’s operational check.
Check. The mapping preserves the distinction between the business operating its process and compliance providing oversight. It also avoids treating every check as internal audit: no independent assurance activity has been described.
Worked Examples: Exposure Monitoring and Control Testing
Worked Example: Monitoring an Investment Exposure
A hypothetical insurer’s investment team manages a portfolio with an approved concentration limit. A portfolio manager checks the position each morning and adjusts trades when needed. A risk team member independently compares reported positions with the limit, challenges a proposed exception, and summarizes breaches for a risk committee. Internal audit later examines whether the monitoring arrangements are designed and operating as intended. Classify the three activities.
Method. Determine whether each action manages the portfolio, oversees the risk-management process, or provides independent assurance.
Step 1: The portfolio manager’s daily check and trade adjustments. This is first-line monitoring. The manager uses the information to manage the investment exposure and remains accountable for portfolio decisions within delegated authority.
Step 2: The risk team’s comparison and challenge. This is second-line monitoring and challenge. The risk team checks adherence from an oversight perspective and brings an exception to attention. Its review does not itself make the portfolio manager’s decisions or assume ownership of the portfolio risk.
Step 3: Internal audit’s examination. This is third-line assurance. Internal audit evaluates the adequacy and operation of the arrangements and reports its independent assessment; it does not take over the daily monitoring.
Check. All three activities may use position data and refer to the same limit. Their classification follows what each role is accountable for doing with that information, not the data used.
Worked Example: Testing a Vendor Payment Control
A hypothetical insurer requires a second employee to approve vendor payments above a designated threshold. The accounts-payable supervisor reviews a sample of the team’s work each week and corrects missing approvals. A compliance specialist performs a periodic review of whether units follow the approval policy and discusses exceptions with managers. Internal audit selects payments for an assurance engagement and reports whether the control framework is effective. Map the activities.
Method. Identify the purpose of each review and whether the reviewer manages the process, oversees adherence, or independently assures the framework.
Step 1: The supervisor’s weekly review. The supervisor is part of management of the payment operation. Checking work and correcting omissions are first-line control activities. This remains true even though the supervisor samples completed payments rather than approving every one.
Step 2: The compliance specialist’s policy review. The specialist monitors adherence and discusses exceptions with managers. This is second-line oversight. The business remains responsible for operating the approval control and correcting its process.
Step 3: Internal audit’s engagement. Internal audit independently evaluates the control framework and reports assurance. This is third-line work. Its engagement is different in purpose from management’s weekly check and compliance’s ongoing oversight.
Check. The word “sample” does not determine the line. A sample may be used in first-line supervision, second-line monitoring, or third-line assurance; purpose, accountability, and independence determine the classification.
Common Mistake: Classifying by the Action Word
A frequent error is to map every activity called “testing” or “monitoring” to the third line. That shortcut ignores whether the work is part of managing the operation, providing oversight, or offering independent assurance.
Wrong mapping: “The claims team tests its own daily approval log, so it is third line because it tests a control. Compliance monitors policy exceptions, so it is first line because it monitors activity.”
Correction: The claims team’s daily check is first line because it manages its own process. Compliance’s policy monitoring is second line because it oversees adherence and challenges the business. Third line applies when internal audit independently evaluates and reports on the control or governance arrangements.
The corrected mapping follows the accountability relationship. It does not imply that the first-line check is unimportant or that second-line oversight replaces management. Each activity contributes differently, and the organization needs clear ownership of the underlying risk and control.
Check Your Understanding
For each situation, identify the line for the specified activity and briefly use its purpose or accountability to support the answer.
- In a hypothetical insurer, a policy administration manager establishes a daily reconciliation between issued policies and the billing system and assigns staff to resolve unmatched records. What line is this management activity? (Answer: First line; it manages an operational process and its control.)
- A compliance adviser explains a new documentation obligation to underwriting managers, then leaves underwriting managers responsible for incorporating it into their procedures. What line is the adviser’s activity? (Answer: Second line; it is specialist advice, while the business retains implementation responsibility.)
- A risk function tracks exposure against a risk limit across several business units, challenges reported exceptions, and escalates recurring breaches. What line is this activity? (Answer: Second line; it is cross-unit oversight monitoring and challenge.)
- A business unit samples its own completed premium adjustments each month, identifies missing approvals, and corrects the work process. What line is this check? (Answer: First line; the unit is checking and managing its own operation.)
- Internal audit independently evaluates whether a business unit’s approval controls are suitably designed and consistently operating, then reports its findings. What line is this activity, and why is it not merely another self-check? (Answer: Third line; it provides independent assurance rather than management’s operational control check.)