The Three Lines of Defence

In Chapter 42 of the Stage 2 Key Code and Advanced Handbook for the governance of Australian major banks we examine the Three Lines of Defence. We begin with Business Units or Line 1 and examine Westpac Line 1 operation, Westpac Line 1 skills, capabilities and stature, the Westpac Reassessment’s Line 1 ownership and capability to manage risk and the Westpac Reassessment’s Building Line 1 risk and control capability. The other two lines comprise the Risk Management and Compliance Function and Internal Audit. We recognise Corporate Defence Management (CDM) as extending the three lines. We move to consider high risk strategies and (improper) delegation of risk oversight, inadequate oversight, risk management and complexity of financial products. Our governance variables for the complexity of financial products include risk modelling deficiency variables and credit rating deficiency variables. The Chapter then constructs variables for: bank-specific variables exhibiting a deficiency in banking industry knowledge and competence; inadequate risk management and internal controls; the failure of information flow on risks in CDOs and other financial products; and the complex and opaque nature of securitized/financial products. The conclusion of the Chapter considers factors contributing to a short-term emphasis and acceptance of increased leverage.