The business lines in the first line identify and manage the risks in their own products, activities, processes and systems. The second line reviews the reports from the business lines and, in large banks, designs and maintains the firm-wide framework. Internal audit, the third line, verifies that the framework works, from a position not involved in building or running it.
The Basel Committee's 2011 principles call it the "three lines of defence," and the FSA's supervisory guidelines call it "３線防衛態勢" (a three lines of defense system). In July 2020, the Institute of Internal Auditors (IIA) renamed its former "Three Lines of Defense" model as the "Three Lines Model."