As a user of company compliance and business address services like those provided by us here at London Registrars, you may have previously encountered references to the ‘three lines of defence’ model. This is a well-established governance framework for risk management and will help your organisation to set out clear roles and responsibilities in this vital area.

The ‘three lines of defence’ model was developed as a result of concerns about the potentially greater risk of accidents in organisations where additional layers of redundancy and safeguards are added.

It was feared that such extra layers could make systems unduly complex, thereby increasing the inevitability of failure. Firms implementing the ‘three lines of defence’ model therefore do so with the aim of defining clear roles and responsibilities, and maintaining separation between those roles, to help prevent accidents.

Defining the three lines of defence

The model sets out three distinct groups within an organisation that are necessary if risk is to be effectively managed. The aim is to provide a simple and effective way to enhance risk management communication through the clarification of essential roles and duties.

The roles and responsibilities are spread across first, second and third lines of defence. The first line of defence concerns functions that own and manage risk.  The second line of defence relates to functions that monitor risk and compliance. Finally, the functions that  make up the third line of defence are those that provide independent assurance on risk management.

The board and senior managers are the primary stakeholders served by these lines. Crucially, the three lines are closely aligned in their work, partnering with each other to ensure the strongest possible risk management.

How can your company ensure the success of this model?

The ‘three lines of defence’ model is as much about the wider system as it is about the individual lines. To implement this risk management model successfully within your own firm, it is vital to freely share information, coordinate activities and keep stakeholders informed.

Information must flow dynamically across the three lines if your organisation is to achieve the best possible results from this model. However, the exact way each line of defence works will depend on what suits your organisation.

For more comprehensive corporate governance, risk and compliance support, and business address services, do not hesitate to contact the London Registrars team.

16 August 2019