In this month of July 2026, the IIA - The Institute of Internal Auditors published an update to the Three Lines Model, which I usually call the "three lines of management." In my understanding, this update does not bring major conceptual novelties; however, it presents important clarifications for better understanding and practical application.
The updated model offers a principles-based approach, clarifying how various assurance and advisory activities collectively support effective governance, risk management, and compliance.
At its core, the model continues to distinguish roles into three distinct organizational lines, in my view, much more clearly now, while highlighting their complementary contributions to governance, risk management, and internal control systems. The categorization of these roles is as follows:
- First Line (Management): Management owns and manages day-to-day risks. This line is responsible for designing, implementing, and operating processes and controls. Operations management also supervises activities and conducts control self-assessments.
- Second Line (Support and Specialized Roles): Provides specialized support, challenge, and monitoring in specific areas. These roles enhance the processes managed by the first line through targeted assurance and guidance.
- Third Line (Internal Audit Function): Delivers independent and objective assurance on the effectiveness of governance, risk management, and control system processes. It provides a holistic and systemic perspective without assuming management responsibilities. The third line acts as the ultimate internal assurance provider, examining how all parts of the governance and risk landscape work together.
The updated model emphasizes that boards and senior management can strengthen their oversight by leveraging both assurance and advice throughout the organization, such that:
- Assurance - helps confirm whether governance, risk management, compliance, and control processes are adequate and effective.
- Advice - helps identify emerging issues, areas for improvement, and opportunities to increase efficiency, effectiveness, and resilience.
Both forms of value creation are delivered across all three lines, but their nature and depth vary based on the role's proximity to operations, specific expertise, and level of independence.
The update maintains the independence of internal audit as a fundamental concept for credible assurance. This independence is ensured by functional reporting to the board, which promotes autonomy over the objectives and scope of evaluations, unrestricted access to information, and protection against undue influence.
However, as I have been saying, the document clarifies that independence should not be interpreted as isolation. Effective governance requires coordination and transparency across all roles to ensure that insights are not fragmented. By aligning assurance and advisory activities, including those of external providers, such as statutory auditors or regulators, organizations can reduce duplication, fill gaps, and provide the board with a coherent view of risks.
A very positive point of this version is the understanding of practical reality. We know that the implementation of this model often remains at the mercy of organizational complexity, governance structures, resource constraints, or limited operational capacity. This can cause some overlaps, such as, for example, the audit manager taking on typical second-line responsibilities.
In these cases, since independence may be compromised, it is necessary to adopt rigorous countermeasures (safeguards) to preserve objectivity and accountability. Examples include: conducting periodic independent reviews in areas where dual responsibilities exist, ensuring explicit board approval for expanded assignments, and communicating any potential risks to objectivity directly to the board.
The document also makes it clear that it is the board's responsibility to ensure that the organization maintains a balanced and structured set of assurance and advisory capabilities.
Finally, the figure illustrating the Three Lines Model is much clearer, facilitating its correct understanding and application.
It is definitely worth reading the material published by the IIA - The Institute of Internal Auditors regarding the update of the Three Lines Model.
Be Happy!
Material consultado em okai.com.br.
