Integrating governance, risk and compliance? A multi-method analysis of the new Three Lines Model

As research and practice in corporate governance and risk management evolve, related tools and procedures are also developing in tandem—as is the case with the recent review of the widely adopted and time-tested three lines of defence (TLOD). This new Three Lines Model (TLM) attempts to reflect model criticism and widen the model scope towards integrated governance, naturally setting expectations high. This paper presents the first synopsis of the academic criticisms of TLOD, providing a foundation for analyzing the models. In a multi-method approach, the authors triangulate quantitative approaches from the corpus research with qualitative approaches to inquire about their research questions, in what is the first full review of the two original documents. Several converging results from triangulation support this thesis. The findings reveal a revised model that increases complexity yet gives up important parts of the previous model. While addressing key criticisms and adding important clarifications, the logic and simplicity of the old model seem lost—a conclusion that potentially contributes to the current slow adoption of TLM, not least among regulators. In contrast to the positive initial reactions, this paper concludes that a nuanced and critical view of the revamped TLM is necessary. It points out directions for further improvement—as well as those new elements worth preserving, such as the use of newly introduced principles, so that the model can keep its precision and appeal. This paper also inquires what practitioners should do at this stage, especially considering regulations in specific industries, and how the model authors may further develop the three lines. Finally, research limitations are highlighted as well as four research avenues regarding governance and risk identified.