The Three Lines Model | Derivatives Compass

The three lines model is an approach in which a financial institution divides the roles of managing and challenging risk among a first line that runs the business, a second line that supports risk management, and a third line (internal audit) that checks independently. The governing body, such as the board of directors, receives reports and checks from these lines and oversees the whole organization.

The three lines model comes up when a financial institution sorts out where responsibility sits for limit management, new product review, and responding to internal audit.

What the three lines model is

Consider a hypothetical example in which the position of a trader in the front office at a derivatives dealer nears its assigned ceiling (the limit). Keeping the position within the limit is the front office's responsibility. The risk management department watches the situation, challenges it if necessary, and reports to senior management. Later, the internal audit department checks whether the arrangements for setting limits, monitoring, and reporting worked, and communicates the result. These three positions are the first, second, and third lines. Actual procedures differ between financial institutions.

The three lines model keeps responsibility for managing risk in the business itself, and sets up a separate role to support it and another to check independently whether the management works. "Management" is the collective name for the first and second lines¹. The governing body oversees the organization by relying on reports from management and on independent assurance and advice from internal audit². The governing body is the group of people accountable to stakeholders for the organization's success. In a financial institution this is, for example, the board of directors³⁴.

In the 2020 edition of the Institute of Internal Auditors (IIA) "Three Lines Model," a model for all organizations is optimized in four ways. One of them is to direct risk management not only at "defense" and the protection of value but also at contributing to the achievement of objectives and the creation of value⁵.

Roles of the governing body and the three lines

In the three lines model, management under the governing body takes the first and second line roles, and internal audit takes the third line. Figure 1 shows the flow of delegated responsibility and reporting.

Figure 1Relationship between the governing body, the three lines and external assurance providers

Figure description

This figure shows how the roles relate to one another. It is not an organization chart.

A "line" is a distinction between roles, not a level in an organization chart. The numbers of the first, second, and third lines do not describe the order of operations, and all roles operate at the same time⁶.

Role	Held by	Main responsibilities
Governing body	The people accountable to stakeholders for the organization's success (in a financial institution, for example the board of directors)	Sets the organization's risk appetite and oversees risk management¹.
First line	The part of management whose roles deal directly with providing products and services to clients	Directs activities and the use of resources to achieve objectives, including managing risk¹.
Second line	The part of management whose roles support risk management	Provides expertise, support, and monitoring on risk management and challenges, and analyzes and reports on the adequacy and effectiveness of risk management¹.
Third line	Internal audit	Communicates independent and objective assurance and advice to management and the governing body on whether governance and risk management are adequate and effective¹.
External assurance providers	Providers outside the organization	Provide additional assurance to meet legislative and regulatory expectations, or to meet the requests of management and the governing body¹.

The governing body delegates responsibility and resources to management, and establishes and oversees an independent internal audit function¹. The first line reports results and risks to the governing body and maintains the structures and processes that manage the business and its risks¹.

The board of directors decides strategy, risk appetite, and risk management policy⁷. The thinking behind limits and how they are run are covered in Limit Frameworks.

Even where a second line exists, responsibility for managing risk stays with management in the first line⁸. Some second line roles are focused on specific objectives of risk management, such as compliance with laws, regulations, and ethical behavior, internal control, and IT security. Others have broad responsibility, as enterprise-wide risk management does⁸.

How far independence goes

Independence is the defining feature of the third line. The second line is part of management and is never fully independent from it, regardless of reporting lines⁹.

The IIA lists the conditions under which internal audit is independent: accountability to the governing body, unrestricted access to the people, resources, and data the work requires, and freedom from bias or interference in how the audit is carried out⁸. This independence is protected in two further ways. Internal audit does not make decisions or take actions that belong to management's responsibilities. It also does not provide assurance on activities for which it currently has responsibility, or has recently had it⁹.

For example, in an organization where the head of internal audit takes on additional decision-making responsibility for legal compliance or enterprise-wide risk management, internal audit is not independent of that work. If the governing body wants independent assurance and advice on it, a qualified third party provides it⁹.

The second line can also be designed to be more independent. If the second line has a primary reporting line to the governing body, the direction and oversight of the second line can be made independent, to a degree, of the first line and senior management⁹. Some organizations want the heads of risk or compliance to report directly to the governing body, and regulators sometimes require it¹⁰. Some organizations, especially regulated financial institutions, are legally required to build arrangements that secure sufficient independence⁹. Even in these cases, responsibility for managing risk stays with the first line.

Being independent does not mean having no contact. Internal audit and management need to interact regularly so that internal audit's work fits the organization's circumstances, strategy, and operational needs. To avoid overlaps and gaps, internal audit also needs to cooperate and communicate with both the first and second lines¹⁰.

Applying the lines to derivatives business

At a financial institution that deals in derivatives, the front office is placed in the first line, the risk management and compliance departments in the second line, and the internal audit department in the third line. The table below compares the role of each department with the roles in the three lines model. Department names and divisions differ between financial institutions.

Department	Line	Role in the three lines model
Front office (sales and trading)	First line	Takes risk and earns revenue within the risk appetite set by the board of directors. Responsibility for managing risk stays with the first line¹¹⁸.
Back office (operations and settlement)	Some sources treat it as first line	Verifies the details of trades, fixes positions and profit and loss through settlement and accounting, and checks the front office¹².
Risk management department (middle office)	Second line	Takes a comprehensive view of risk, reports it to senior management, and checks the front office¹³.
Compliance department	Second line	Provides expertise and monitoring focused on the objective of compliance with laws, regulations, and ethical behavior⁸⁴.
Internal audit department	Third line	Verifies the risk management processes of the front, middle, and back offices, and provides a check on risk management as a whole¹⁴.

The idea that the back office belongs to the first line appears in a footnote of the Japanese edition of the IIA model, which takes first line roles to include both front office and back office activities¹⁵.

What the front, middle, and back offices do is covered in Front, Middle and Back Office Roles.

Differences between institutions and the names used

How responsibilities are divided differs considerably between organizations¹⁸. As an organization grows in size and complexity, management tends to develop functional and hierarchical arrangements and more specialization¹⁹. A function, team, or individual may have both first and second line roles¹⁹. For the control of operational risk, the Basel Committee's 2011 principles say that the structure and content of the three lines of defence often differ between banks. The differences come from the nature, size, and risk management approach of the banks' products, activities, processes, and systems²⁰.

A Bank of Japan document (September 2019) takes up whether staff for the front, middle, and back offices may sit in the same department. Its answer is that it depends on the types of market transactions and how the financial institution takes risk. Where separate departments are hard to set up, it is important to arrange for the middle and back office staff to be able to check the front office. Officers and department heads oversee all three, so the check is not fully effective, and it needs to be supplemented by effective audits²¹.

When the third line takes on part of the second line's roles, the Financial Services Agency (FSA) report of June 2025 explains the following. Smaller financial institutions are expected to find it hard to build a full three lines arrangement, and given the nature of their business, senior management may directly instruct internal audit to carry out compliance audits. In such cases, from the standpoint of overall optimization, it is not ruled out that the third line takes over part of the second line's roles, such as verifying compliance. The report also says that what each of the three lines covers is to be decided according to the circumstances of each financial institution²²²³.

Sources use different names for the same idea. In July 2020, the IIA updated it as "The IIA's Three Lines Model." The earlier name was "Three Lines of Defense"³. The Basel Committee's 2011 principles call it "three lines of defence." The first is business line management, the second is an independent, firm-wide operational risk management function, and the third is independent review²⁴.

The FSA's supervisory guidelines for major banks use the term "three lines of defense system" and give as examples the departments that execute business, the risk management department, and the internal audit department. The point of focus is whether the board of directors has set up policies and reporting arrangements so that checks work through these departments²⁵.

Notes

The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Key Roles in the Three Lines Model" (roles of the governing body, the first and second lines of management, internal audit, and external assurance providers). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸
The Institute of Internal Auditors, "The IIA's Three Lines Model: An Update of the Three Lines of Defense" (July 2020), "Introduction," Principle 1, and Principle 2. ↩
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Key terms" and the last page. The English title and date are on the title page. ↩ ↩²
Financial Services Agency, "金融機関の内部監査高度化に関する懇談会報告書（2025）" (Report of the Council of Experts on Advancing Internal Audit at Financial Institutions, 2025, our translation) (June 2025), glossary Nos. 5 to 8 (page 24) (in Japanese). ↩ ↩²
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Introduction" (the second of the four points by which the model is optimized). ↩
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), footnote 1. ↩
Bank of Japan, Financial Systems and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework, our translation) (September 2019), page 6 (the section on the role of the board of directors, which describes setting strategy, risk appetite, and management policy) (in Japanese). ↩
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), Principle 3 and Principle 5 (both on page 3). ↩ ↩² ↩³ ↩⁴ ↩⁵
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Applying the Model," "Structure, roles, and responsibilities" (page 11). ↩ ↩² ↩³ ↩⁴ ↩⁵
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Relationships Among Core Roles" (page 9; the relationship between the governing body and management, and between management and internal audit). ↩ ↩²
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 6 (front office) and page 29 (role of the front office) (in Japanese). ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 6 (back office) and page 32 (role of the back office) (in Japanese). ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 6 (the section on the middle office, which describes taking an overall view of risk, reporting to senior management, and checking the front office) (in Japanese). ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 6 (internal audit department) and page 40 (role of the internal audit department) (in Japanese). ↩
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), footnote 2. The same footnote says that some consider the roles of support functions (such as HR, administration, and building services) to be second line roles. ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 33 (exercising the check on the front office) (in Japanese). ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 42 (points of internal audit, continued: confirmation of trades by the back office, and risk grasp, measurement, and reporting by the middle office) (in Japanese). ↩ ↩²
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Key Roles in the Three Lines Model," opening text. ↩
The Institute of Internal Auditors, "The IIA's Three Lines Model" (July 2020), "Applying the Model," "Structure, roles, and responsibilities" (page 11). ↩ ↩²
Basel Committee on Banking Supervision, "健全なオペレーショナル・リスク管理のための諸原則" (Principles for the Sound Management of Operational Risk, provisional Japanese translation by the FSA; June 2011), paragraph 17 (page 6) (in Japanese). The English original is Basel Committee on Banking Supervision, "Principles for the Sound Management of Operational Risk" (June 2011). ↩
Bank of Japan, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Developing a market risk management framework) (September 2019), page 39 (in Japanese). ↩
Financial Services Agency, "金融機関の内部監査高度化に関する懇談会報告書（2025）" (Report of the Council of Experts on Advancing Internal Audit at Financial Institutions, 2025) (June 2025), page 11 (explanation of the first stage) (in Japanese). ↩
The same report, page 20, footnote 21 (in Japanese). ↩
Basel Committee on Banking Supervision, "健全なオペレーショナル・リスク管理のための諸原則" (Principles for the Sound Management of Operational Risk, provisional Japanese translation by the FSA; June 2011), paragraph 13 and footnote 6 (pages 4–5) (in Japanese). The English original is Basel Committee on Banking Supervision, "Principles for the Sound Management of Operational Risk" (June 2011). ↩
Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026 version), III-2-3-7-2(1)② (page 145), where the term is "３線防衛態勢" (in Japanese). ↩