Three lines of defence — is it the right model?

Despite the plethora of legislation, regulatory requirements and industry guidance that financial institutions need to follow, there is an ever-increasing number of scandals involving risk management, governance and compliance failings. Each time a scandal hits the headlines, supervisory bodies, and organisations themselves, consider how to respond and further strengthen the control environment and enhance policies and the related procedures to prevent the same or similar instances occurring. This paper describes the Three Lines of Defence model within financial organisations, considers the Wells Fargo customer account fraud scandal and the departure of Citigroup’s Chief Risk Officer and debates whether the revisions to the Three Lines of Defence model proposed by the Institute of Internal Auditors will strengthen the risk and compliance frameworks within organisations and provide a more robust system of corporate checks and balances, endorsed by both the industry and the regulators.