Introduction
A sound risk governance system needs both clear accountability and informed challenge. Business managers make decisions and manage the risks created by their activities. Risk and compliance functions provide expertise and oversight. Internal audit independently assesses whether governance and controls are working. The Three Lines model describes how these responsibilities relate; it does not make risk management the responsibility of a single department.
The model is useful only when information moves between the roles. Business managers need to understand expectations and receive relevant challenge. Specialist functions need timely information about exposures and control issues. The governing body needs a clear view of significant risks, while internal audit must be able to report its independent conclusions. The model supports these exchanges without confusing who owns decisions and who provides assurance.
Roles and Accountability
The governing body provides oversight and holds management accountable. It is not a fourth line of operational risk management: it sets direction and oversees the system, while management carries out the organization’s activities. The Three Lines model helps clarify the contributions within that system.
First-line management owns and manages risk. Business leaders and their teams make operational decisions, identify risks connected with their activities, and operate the controls assigned to them. For example, underwriting management is responsible for applying underwriting authority and handling exceptions in its portfolio. A specialist risk function can advise or challenge, but that does not make it the owner of the underwriting decision.
Second-line roles enable and oversee risk management. Risk and compliance professionals develop expertise, advise management, monitor relevant risk practices, and provide challenge. They may identify an emerging issue or report that a process is not meeting an expectation. Their contribution helps management manage risk more effectively, but ordinarily does not replace the first line’s responsibility to make and manage business decisions. A second-line role may also have its own controls and responsibilities; its label alone does not determine whether a particular task is first- or second-line work.
Internal audit provides independent assurance. It assesses whether governance, risk management, and controls are designed and operating effectively, and communicates its findings to appropriate leaders and the governing body. It should not take over management’s responsibility for selecting or operating controls that it may later evaluate. If it identifies a weakness, management decides and implements corrective action; internal audit can then assess the response as part of its assurance work.
| Role | Primary contribution | Accountability that remains with management |
|---|---|---|
| First-line management | Deliver activities; own and manage their associated risks; operate assigned controls | Decisions, risk responses, and control operation in their areas |
| Second-line risk and compliance | Provide expertise, advice, monitoring, and challenge on risk and compliance matters | Business ownership and implementation of management’s risk responses |
| Third-line internal audit | Independently assess and report on governance, risk management, and controls | Management’s decisions and corrective actions |
The lines are not a sequence in which a matter must pass through one department before another can act. Nor does the model require a particular reporting structure for every organization. A small insurer may combine some specialist responsibilities, while a larger insurer may distribute them among several teams. In either case, the roles must be understood clearly enough that advice, monitoring, decisions, and assurance are not mistaken for one another.
Information Flows Between the Lines
The model works through two-way communication and appropriate escalation. Information should be sufficiently timely and complete to support decisions, challenge, and oversight. The precise route depends on the organization’s governance arrangements, but three broad directions help explain the flow.
The governing body and senior management communicate approved direction, delegated responsibilities, and relevant requirements. Specialist functions translate these into guidance or monitoring expectations; business managers apply them in their activities.
Business teams report exposures, control performance, incidents, and proposed responses to management and relevant specialist functions. Material matters are escalated through management channels to senior leaders and, where appropriate, the governing body.
Risk and compliance share analysis and challenge with management. Internal audit communicates independent findings to management and the appropriate oversight body, while preserving its ability to reach and report its own conclusions.
These flows should not turn second-line monitoring into first-line ownership or internal audit into a control operator. A risk team can tell a business leader that an exposure is increasing and request an explanation; the leader remains responsible for deciding and implementing an appropriate response within assigned authority. Internal audit can report that a control is ineffective; management remains responsible for correcting it.
Why the Lines Stay Distinct: A Short Justification
The distinction between managing a control and assuring that control is effective follows from the different purposes of the roles. Management acts to achieve objectives and reduce risk. Assurance evaluates whether the governance and controls used for that purpose are adequate. If the evaluator becomes responsible for operating the control, it would later be evaluating work for which it had direct responsibility. Keeping those roles distinct supports a credible independent assessment.
This is not a claim that internal audit never discusses controls with management. It may explain findings and make recommendations. The key distinction is that management retains authority and responsibility for choosing and implementing its response, while internal audit retains responsibility for evaluating and reporting on the matter independently.
Worked Example: An Underwriting Exception
Scenario. A hypothetical insurer’s regional underwriting team proposes accepting a commercial account that falls outside a routine portfolio guideline but remains within the team’s delegated authority if specified conditions are met. The account has unusual catastrophe exposure. The risk function has asked for a written explanation of material exceptions, and compliance has issued guidance about a relevant regulatory requirement. Identify each role’s contribution and trace the information flow.
Step 1: Identify the decision owner. The regional underwriting manager is first-line management. The manager must assess the account, apply the delegated authority and required conditions, and record the decision. The risk function’s involvement does not transfer ownership of the account to that function.
Step 2: Identify second-line contributions. The risk function can analyze the concentration implications, ask whether the proposed conditions address the exposure, and challenge the manager’s rationale. Compliance can explain the relevant requirement and monitor whether the process follows it. These contributions inform and test the decision; they do not automatically approve the account in place of the authorized manager.
Step 3: Trace the information. The underwriting team sends the exception rationale and exposure details to the relevant management and specialist channels. Risk and compliance communicate their analysis or concerns to the manager and escalate material unresolved matters under the organization’s arrangements. Management reports significant exposure information upward as required.
Step 4: Separate later assurance. Internal audit might independently examine whether exception governance and related controls operate as intended. It should not select the underwriting conditions or approve this account as the business decision-maker.
Check. The manager remains accountable for the underwriting decision; risk and compliance contribute expertise, monitoring, and challenge; internal audit provides independent assurance. The common mistake is to treat the risk function’s review as a transfer of business ownership. Review can inform a decision without transferring the decision-maker’s accountability.
Worked Example: A Claims Control Failure
Scenario. In a hypothetical insurer, a claims supervisor discovers that a manual review control was missed for a group of claims after a staffing change. The supervisor informs the claims leader. Compliance is concerned that the issue may affect a required customer communication, while the risk function asks for an assessment of the control gap. Internal audit has previously reviewed claims controls. Determine the appropriate roles and information sequence.
Step 1: Contain and manage the issue. Claims management is first line. It must establish the affected claims, take appropriate action on the process and customer impact, and arrange operation of the control going forward. It also documents the issue and reports it through the management channels that apply.
Step 2: Obtain specialist input and monitoring. Compliance assesses the relevant communication requirement and advises claims management on its implications. The risk function can help assess the significance of the control failure and monitor whether the agreed management response addresses the identified risk. Neither function becomes the claims process owner merely by providing this support.
Step 3: Escalate material information. The claims leader provides facts about scope, impact, and remediation to appropriate senior management. Specialist functions share their analysis and any continuing concerns through their reporting arrangements. The governing body receives information if the issue is sufficiently significant under the organization’s escalation practices.
Step 4: Preserve assurance. Internal audit may later assess whether the control failure reflects a broader weakness and whether management’s corrective action is effective. Its earlier review does not make it responsible for operating the claims control or fixing the staffing process.
Check. Claims management owns operational remediation. Compliance and risk support and monitor from their respective perspectives. Internal audit evaluates independently. A common mistake is to ask internal audit to design and operate the replacement control; the correction is for management to choose and implement the response, leaving audit able to assess it.
Worked Example: Catastrophe Exposure Information
Scenario. A hypothetical insurer’s property team identifies that several recently bound policies increase exposure in one geographic area. A management-approved concentration limit may be approached. The risk function has access to aggregated exposure information, and the chief executive requests a concise account of the issue for senior management. Explain the roles and information flow without confusing analysis with ownership.
Step 1: Establish first-line facts. The property team verifies the relevant policy information, explains the business decisions that produced the exposure, and reports the position to its accountable manager. The team remains responsible for its underwriting activity and any management response within its authority.
Step 2: Add second-line perspective. The risk function aggregates relevant information, compares it with the applicable management-approved limit, and communicates the result and uncertainty to decision-makers. It can challenge assumptions or request further analysis. That analysis does not itself decide whether the insurer should continue writing the business.
Step 3: Route the issue to decision-makers. The accountable manager and senior management receive the exposure information, the comparison with the limit, and any relevant uncertainty. They determine the response within their authority and escalate as required. The governing body receives material information through the organization’s oversight channels when appropriate.
Step 4: Keep assurance separate. Internal audit could later assess whether exposure reporting and governance processes are reliable. It does not set the business response or certify the underlying exposure simply because it reviews the process.
Check. The property team owns the underlying activity, risk supplies aggregation and challenge, and management decides the response. The common mistake is to equate production of a risk report with authority over the business decision. The correction is to distinguish information and challenge from decision rights.
Common Mistakes and Practical Checks
When using the model, focus on what each role actually does, rather than relying only on its department name. For any significant issue, ask: who makes and implements the business decision; who provides specialist support, monitoring, or challenge; and who can independently assess the governance and controls? A clear answer to each question helps prevent gaps and duplicated responsibilities.
- Calling risk the owner of all risk. A second-line risk function oversees and challenges; business management remains responsible for risks arising from its activities.
- Treating monitoring as approval. A second-line review may inform a decision or raise a concern without replacing the authorized manager’s decision.
- Assigning remediation to internal audit. Audit reports findings and may recommend improvements; management chooses and implements corrective action.
- Assuming three separate departments are required. The model describes roles and relationships. Organizational structure can vary, but responsibilities and reporting must remain understandable.
- Reporting only upward. Effective governance also requires expectations to reach those doing the work and useful challenge to reach the managers able to act.
Check Your Understanding
For each original scenario, identify the principal line roles and the essential information flow. Answers are provided so you can check your reasoning.
- A hypothetical insurer’s motor claims team changes its triage process. The risk function asks for evidence that the change is monitored, while claims management remains responsible for running the process. Who owns the operational risk, and what is the risk function’s contribution? (Answer: Claims management owns and manages the operational risk; the risk function provides support, monitoring, and challenge.)
- A compliance specialist finds a possible reporting requirement issue in an insurer’s renewal process. What should happen to the information, and who remains responsible for changing the process? (Answer: Compliance advises and escalates the concern through appropriate channels; renewal management remains responsible for deciding and implementing process changes.)
- Internal audit finds that a hypothetical insurer’s delegated-approval records are incomplete. Should audit build the replacement recording process? State the appropriate roles. (Answer: No. Internal audit reports the finding and may recommend improvement; management designs and implements the process, and audit can independently assess it.)
- A business unit reports an exposure increase, but its manager believes it is immaterial while the risk function’s aggregation indicates a potentially significant concentration. Describe the appropriate flow without transferring ownership. (Answer: The risk function communicates its aggregation, assumptions, and challenge to management and escalates material unresolved concerns through appropriate channels; management remains responsible for the business response, with significant information reaching senior oversight as appropriate.)
- A small hypothetical insurer has one specialist team that performs both risk monitoring and compliance advisory work. Does that arrangement alone invalidate the Three Lines model? What must still be clear? (Answer: No. The model does not require three separate departments; responsibilities, accountability, escalation, and independent internal audit assurance must still be clear.)