Skip to content
The Tell
← Internal audit

Position paper · The IIA

The IIA's Three Lines Model

The IIA's update of the Three Lines of Defense — how management, risk and compliance functions, and internal audit work together under the board.

Go to the official source ↗

Our summary

The Three Lines Model is The IIA’s refresh of the well-known Three Lines of Defense. It explains how the governing body, management (first and second line roles) and internal audit (third line) each contribute to governance and risk management.

The update puts less weight on “defense” and more on collaboration, independence of internal audit, and creating value — not only protecting it.

How auditors use it: to explain internal audit’s role to boards and audit committees, to map who owns which risks and controls, and to design an assurance map that avoids gaps and overlaps.

More in Internal audit

Global Internal Audit Standards

The IIA's worldwide standards for the professional practice of internal auditing, organised into five domains and fifteen principles.

Third-Party Topical Requirement

Since 15 September 2026, IIA conformance means auditing third-party risk against a mandatory minimum baseline whenever it falls within an assurance engagement.

Topical Requirements

Topical Requirements are mandatory IIA rules that set a minimum baseline for auditing specific risks such as cybersecurity and third parties, so every audit function must know which ones apply and when.