The Three Lines of Defence Are Dead. Long Live the Three Lines!
Before abandoning the model, perhaps we should try applying it properly. And could AI ultimately make much of the traditional Second Line redundant?
Dr Jimi M.V. Hinchliffe · JADEtc Academy
Another funeral for the Three Lines?
The Three Lines of Defence model appears to be facing yet another existential crisis, with recent comments by FCA Chief Executive Nikhil Rathi prompting renewed debate about whether the model has outlived its usefulness. Judging by some of the commentary on LinkedIn, one might be forgiven for thinking that the FCA had announced its imminent abolition, although what Rathi actually did was rather more measured and raised reasonable questions about the efficiency and effectiveness of current governance and assurance arrangements.
In his 22 October 2026 Mansion House speech, Market Integrity in a Digital Age, Rathi questioned duplication across risk management and assurance and suggested it might be time to revisit the Three Lines. Before organising its funeral, however, we should ask whether the model is the problem or, as is so often the case, how firms have chosen to apply it. There is also a certain irony in the debate: the Institute of Internal Auditors substantially updated its model in 2020 to address some of the very criticisms now being levelled against it, yet many firms appear not to have noticed.
Is the Three Lines Model responsible for everything wrong with operational risk management?
There is a growing body of commentary, particularly on LinkedIn, advocating the abandonment of the Three Lines Model, with some commentators attributing a remarkably wide range of operational risk management weaknesses to its continued use. Horst Simon, who writes under the name The Original Risk Culture Builder, has been particularly forthright in his criticism, including questioning whether the original or updated model can support an effective risk culture. His LinkedIn commentary provides one example of this wider debate.
While there is considerable merit in challenging established approaches, particularly where they have become excessively bureaucratic or failed to deliver intended outcomes, I am less convinced by the suggestion that the Three Lines Model is somehow the root cause of the wider shortcomings of operational risk management. Such an argument risks attributing to a relatively straightforward governance construct responsibilities it was never designed to fulfil. The model is fundamentally concerned with the allocation of governance roles and responsibilities, including risk ownership, oversight, challenge and independent assurance. It does not determine the quality of risk identification, the effectiveness of controls, the suitability of risk appetite, the maturity of risk culture or the competence of management. These are all essential elements of effective ORM, but they cannot reasonably be expected to emerge simply from adopting a particular organisational model.
Nor is there an obvious reason why clearly defined accountability, constructive challenge and independent assurance should be inherently incompatible with an effective risk culture. Properly implemented, they should help reinforce the behaviours and responsibilities that underpin good risk management. A rigid and confrontational implementation can certainly undermine collaboration and encourage defensive behaviours, but that is an argument for improving the application of the model rather than necessarily abandoning its principles.
We see the same distinction across ORM: risk appetite statements, RCSAs, KRIs, incident management processes and GRC systems can all deteriorate into bureaucratic exercises, yet that does not invalidate their underlying purposes. Replacing Three Lines with another governance model would still leave firms needing to decide who owns risks, who provides effective oversight and challenge, and how independent assurance is obtained. Unless an alternative offers demonstrably better answers, changing the model may simply leave the underlying weaknesses in accountability, culture, competence and implementation untouched.
We should challenge risk management orthodoxy, but be equally willing to challenge the emerging orthodoxy that abandoning established frameworks is necessarily evidence of progress.
A useful model, not a regulatory commandment
One persistent misconception is that the Three Lines are universally mandated by financial regulators. They are not. Regulators expect effective governance, clear accountability, appropriate separation of responsibilities, oversight, challenge and assurance, but relatively few prescribe the Three Lines as a single mandatory organisational blueprint. The model has become widely adopted because it provides a straightforward and familiar way to explain who owns and manages risks, who provides specialist support and challenge, and who offers independent assurance.
That common language has practical value in supervisory discussions. A firm can explain how it has adapted the Three Lines proportionately to its circumstances and move directly to whether those arrangements work. Alternatively, it might announce its innovative Hinchliffe–Sheen Integrated Accountability and Assurance Model, only to spend twenty minutes explaining why it is not essentially the same thing. Whatever the terminology, the supervisor will still want to know who owns the risks, who challenges management and who provides assurance. Different terminology does not necessarily constitute better governance.
When Three Lines become seven
In our consulting and training engagements we have encountered firms with five, six and even seven purported lines of defence, a remarkable evolution of an approach intended to simplify accountability. Some have even included the regulator as one of their lines. Having worked as a supervisor myself, I can say that this was certainly something I pushed back on: regulators supervise firms; they are not part of a firm's internal risk management framework, and their presence cannot dilute the accountability of boards and management.
There is a broader tendency in risk management to confuse complexity with sophistication, adding committees, reviews, frameworks and reporting layers until the original purpose becomes difficult to discern. It reminds me of Jonathan Swift's Gulliver's Travels and the Academy of Lagado, where an architect proposes building houses from the roof downwards, inspired by bees and spiders. Some elaborate governance designs might have emerged from much the same academy. Complexity is not evidence of effectiveness, and adding another line can create precisely the duplication and confusion the model was intended to resolve. Our watchwords remain simple, proportionate and effective.
The Three Lines Model has already moved on
There is a particular irony in today's debate: the Institute of Internal Auditors substantially revised the model in 2020, moving away from the defensive and sometimes confrontational interpretation associated with the original Three Lines of Defence. Yet we continue to be surprised by how many firms in our training and consulting engagements are unfamiliar with the updated IIA Three Lines Model or have not fully considered its implications.
The revision emphasises governance, collaboration and complementary roles in creating and protecting value. First and Second Line roles are both part of management, with the Second Line providing specialist expertise, advice, monitoring and challenge; Internal Audit retains its independence from management and provides objective assurance and advice. Collaboration should not be confused with a lack of effective challenge, just as challenge should not become an institutionalised contest between departments. Coordination and appropriate reliance across assurance providers can reduce duplication without compromising necessary independence. Before abandoning the Three Lines, perhaps firms should first try the updated model.
Does anyone actually know which line they are in?
A recurring observation from our training programmes raises an even more fundamental question. We regularly ask delegates which line of defence they work in, and it is not unusual for around 20–30% to be uncertain of the answer, including during a recent engagement. This is an observation from our classes, not a representative industry survey, but it is revealing given how extensively the terminology is used.
Some uncertainty is understandable: smaller firms in particular may have hybrid roles, and individuals can legitimately undertake responsibilities associated with more than one line. The updated model is sufficiently flexible to accommodate such arrangements. However, flexibility in the allocation of roles should not become ambiguity about accountability, authority, oversight or conflicts of interest. Someone involved in managing a risk cannot automatically provide genuinely independent assurance over their own work.
Firms often invest heavily in organisational charts and responsibility matrices while devoting relatively little attention to training people in what their roles mean in practice. First Line managers must understand that they own and manage risk, while Second Line professionals need to understand when to advise, monitor, challenge and escalate rather than simply duplicate management activity. A framework that appears perfectly clear on paper is of limited value if a significant proportion of those operating within it cannot explain their responsibilities.
Three Lines, or three bureaucracies?
The strongest criticism of the Three Lines is that some firms have turned it into an expensive and fragmented operating model. The First Line completes a risk assessment, the Second Line reviews it, another specialist function conducts a related assessment, and Internal Audit subsequently examines both the assessment and the challenge process. Each step may have a rationale, but collectively the organisation can spend more time documenting and reviewing risk management than managing the underlying risks.
Worse, First Line management may begin to regard risk as the responsibility of the risk function, while accountability becomes diffused across overlapping oversight and committee structures. These are serious failures of design and implementation, but they would not necessarily disappear if a firm relabelled its structure as two lines or invented a new governance framework. What matters is whether responsibilities are clear, challenge is constructive, assurance is coordinated and activity adds value.
Could AI make much of the Second Line redundant?
A far more profound challenge to the traditional operating model may come from artificial intelligence. Consider how much Second Line work involves reviewing RCSAs, comparing ratings against methodology, identifying inconsistencies, monitoring KRIs, analysing incidents, interpreting policies and regulatory developments, and producing management information. These activities are increasingly amenable to AI-enabled analysis.
A properly designed system could continuously compare risk assessments across business units, challenge unsupported control ratings, identify discrepancies between reported control effectiveness and incident experience, and generate evidence-based questions for management. It might eventually perform some routine analytical challenge more consistently and comprehensively than periodic human reviews. If AI can undertake much of the monitoring, analysis and methodological challenge currently performed by Second Line teams, how much of the traditional Second Line will remain necessary? Potentially considerably less than we assume.
But can AI provide independent challenge?
Automating activities is not the same as transferring accountability or guaranteeing effective independent challenge. AI depends on the quality of its data, its embedded assumptions, its objectives and the governance arrangements under which it operates. It may replicate flawed methodologies, overlook important context or produce plausible but incorrect conclusions. If the business controls the configuration, evidence and escalation rules of a system intended to challenge its decisions, important questions arise about the effectiveness of that challenge.
There is also the danger of common-mode failure if First Line management, Second Line oversight and Internal Audit rely on the same AI platform, data and assumptions: the organisation could become remarkably consistent while being consistently wrong. Everyone and every system is fallible, and AI is no exception. Independent scrutiny, validation, escalation and accountable human judgement remain essential.
A smaller, smarter and more influential Second Line?
The more plausible future is one in which AI undertakes much of the routine review, monitoring and reporting workload while a smaller group of experienced risk professionals concentrates on complex judgements, emerging and interconnected risks, management incentives, regulatory interpretation and difficult challenges that require organisational authority. Internal Audit would continue to provide independent assurance over the overall arrangements, including the AI systems supporting risk management. This could make the Second Line smaller but more influential, provided firms resist the temptation simply to automate existing bureaucracy and preserve genuine diversity of judgement and effective challenge.
Fix the model before burying it
The FCA is right to question duplication and unnecessary cost, but abandoning a familiar framework because of weaknesses in its implementation would be a superficial response. Boards should instead ask whether risk ownership is understood, whether the Second Line provides meaningful challenge rather than process administration, whether assurance is coordinated, whether hybrid roles and conflicts are managed, and whether employees actually understand their responsibilities. They should also ask whether they have adopted the updated IIA model rather than continuing to operate a rigid interpretation of its predecessor.
The real opportunity is to simplify governance, strengthen First Line accountability, make challenge more constructive and use AI intelligently to eliminate low-value activity. The guiding principles should remain simple, proportionate and effective. Perhaps the Three Lines are not ready for their funeral after all. Perhaps the future is one in which we still have Three Lines, but far fewer people standing in them.
References and further reading
FCA: Nikhil Rathi, Market Integrity in a Digital Age, 22 October 2026
IIA: The Three Lines Model, 2020
Jonathan Swift, Gulliver's Travels (1726), Part III, Academy of Lagado.
The views expressed are those of the author. Discussion of AI is forward-looking analysis, not a prediction of regulatory policy.