The Three Lines of Defence: A Non-Executive Director’s Guide

By Adrian Lawrence FCA, founder of NED Capital · Part of the Board Governance Hub

The three lines of defence is the framework most organisations use to describe how they manage risk and obtain assurance that their controls are working. For a non-executive director, it is one of the most useful mental models there is, because it answers a question that sits at the heart of the role: how does the board know that what it has been told is true. A NED cannot run the controls, test the transactions or audit the processes personally. What a NED can do is understand how assurance is meant to flow through the organisation, and then test whether it actually does. The three lines of defence is the map for that. Understood well, it lets a non-executive see where assurance is strong, where it is thin, and where the board is relying on comfort that has not really been earned.

This guide explains the model from a board member’s point of view: what each line is, how they should work together, how a non-executive reads the assurance that reaches the board, and the common ways the model fails in practice. It is written for non-executives across the private, regulated and not-for-profit sectors, and it draws on the governance work of NED Capital and the regulatory expertise of our sister practice. Every NED Capital search is led personally by Adrian Lawrence FCA.

The First Line: The Business Itself

The first line of defence is the business — the operational management and staff who own and manage risk as part of doing their jobs. The people who make the loans, serve the customers, run the systems and deliver the services are the first line, because they are closest to the risks and are the ones whose decisions create or control them. In a well-run organisation, the first line is where most risk is actually managed: through good processes, proper controls built into day-to-day work, and managers who take ownership of the risks in their area rather than treating risk as someone else’s problem. For a non-executive, the key question about the first line is whether it genuinely owns its risks or quietly assumes that compliance and audit will catch anything that goes wrong. A first line that has outsourced its sense of responsibility to the second and third lines is a weak first line, however good those other functions are, because no amount of monitoring and audit can substitute for risk being managed properly at source. The health of the first line is the foundation everything else rests on.

The Second Line: Risk and Compliance

The second line consists of the risk and compliance functions. Their job is to set the framework within which the first line operates — policies, limits, standards — to advise and support the business, and, critically, to monitor whether the first line is actually doing what it should. In a regulated firm, the compliance function’s monitoring programme is a second-line activity, as is the risk function’s oversight of the firm’s risk exposures. The second line is where a great deal of the board’s assurance is generated, which is why its independence and resourcing matter so much. The characteristic second-line failure is a function that is too close to the business, too thinly staffed, or too junior to challenge the first line effectively — so that its monitoring becomes a formality and its advice is easily overridden. A non-executive should take a close interest in whether the second line has the standing, the resources and the independence to do its job. Where it does not, the board is relying on assurance that is weaker than it looks. We examine the monitoring side of the second line in detail in our guide to what NEDs need to know about compliance monitoring.

The Third Line: Internal Audit

The third line is internal audit, which provides independent assurance to the board — usually through the audit committee — on whether the first and second lines are working. Internal audit does not manage risk or run controls; it assesses, objectively and independently, whether the organisation’s governance, risk management and controls are effective. Its independence is its whole value: it reports to the board or audit committee rather than to the management it examines, which is what allows it to say uncomfortable things. For a non-executive, particularly one on the audit committee, the third line is a direct and vital source of assurance, and its effectiveness turns on that independence being real. An internal audit function that reports in practice to the executives it is meant to scrutinise, or that is steered away from the areas management would rather it did not examine, is not a genuine third line. A non-executive should understand how internal audit is positioned, resourced and directed, and should value the access to it that the role provides. In regulated firms the head of internal audit is a senior-manager function in its own right, reflecting how seriously the regulator takes the third line; our sister practice explains the role in its note on what the FCA expects from a head of internal audit.

How a Non-Executive Reads the Model

The model’s value to a non-executive is as a lens for reading the assurance that reaches the board. When a report comes to the board saying an area is well controlled, a non-executive can ask: which line is telling us this, and how independent is that line from the activity it is describing. Assurance from the first line — the business saying its own area is fine — is worth least, because it is self-assessment. Assurance from the second line carries more weight because it involves independent monitoring, provided the second line is genuinely independent. Assurance from the third line carries most, because internal audit is structurally independent of both. A non-executive who understands this does not weigh all assurance equally; they ask where it came from and discount it accordingly. The same lens reveals gaps: an area where the board hears only from the first line, with no second- or third-line testing, is an area where the board actually has very little assurance at all, however reassuring the first-line report sounds. Reading board papers through the three lines is one of the most practical skills a non-executive can develop, and it connects directly to the work of the audit committee and the board’s wider risk oversight.

Where the Model Breaks Down

The three lines of defence is only as good as its execution, and there are recognisable ways it fails — each of which a non-executive should watch for. The first is a first line that does not own its risks, assuming the other lines will catch problems; this overloads the second and third lines and leaves risk poorly managed at source. The second is a second line that lacks independence, resources or seniority, so its monitoring is a formality and its challenge is easily brushed aside. The third is a third line whose independence is compromised, so internal audit tells the board what management wants it to hear. A fourth, subtler failure is confusion about which line is doing what — functions duplicating each other in some areas and leaving gaps in others, so that assurance looks comprehensive but is not. And the most dangerous of all is a board that takes the model’s existence as proof that it is working: assuming that because the three lines are drawn on an organisation chart, assurance is actually flowing. It is the non-executive’s job to test that assumption — to ask whether each line is real, independent and effective, rather than taking the diagram at face value. A board that does this has genuine assurance; one that does not is relying on a comforting picture. Getting the right people into these roles, and the right non-executives to oversee them, is central to what we do, and in regulated firms that often means working alongside our sister practice on compliance, risk and internal audit appointments.

Frequently Asked Questions

What are the three lines of defence?

The first line is the business, which owns and manages risk day to day. The second line is risk and compliance, which set the framework and monitor the first line. The third line is internal audit, which independently assesses whether the first two are working. Together they describe how assurance flows to the board.

Why does the model matter to a non-executive director?

Because it is how a NED judges the assurance reaching the board. Knowing which line a report comes from — and how independent that line is — tells a non-executive how much weight to give it, and reveals areas where the board actually has little real assurance despite reassuring reports.

Which line’s assurance should a NED trust most?

Generally the third line, internal audit, because it is structurally independent of both the business and the risk and compliance functions. First-line assurance is self-assessment and carries least weight; second-line assurance sits in between, provided it is genuinely independent and resourced.

What is the most common failure of the model?

A board treating the model’s existence as proof it works — assuming that because three lines appear on the organisation chart, assurance is flowing. The non-executive’s job is to test whether each line is real, independent and effective rather than taking the diagram at face value.

NED Capital | Sister practice of FD Capital and SMF Capital | ICAEW practising certificate held by Adrian Lawrence FCA.