The three lines of defence model is used widely across different sectors and industries, however it's perhaps the independence of those lines which is the key.
In the ‘compliance’ world we talk about a three lines of defence model.
Audit firms publish reviews of its effectiveness and we, as professionals, have strived to implement these models across multiple industries.
There is a growing acceptance that this model of business protection is ‘best practice’.
Perhaps then the real challenge is not our acceptance, but how this is best implemented.
In my experience, having put this in place across multiple businesses in different sectors, the art is in defining independence; ensuring that each line has accountability and each line can report on the other with honesty and impunity.
Only then can the board have a true picture of where it is on its journey towards effective protection.
