Definition:Three lines of defence model
🏛️ Three lines of defence model is a governance and risk management framework that organizes an insurance organization's control activities into three distinct layers: operational management (first line), risk management and compliance functions (second line), and internal audit (third line). Adopted widely across the global insurance industry — and embedded into regulatory expectations under Solvency II, the UK's SM&CR, and supervisory guidance from bodies like the IAIS — the model provides a structured way to ensure that risk-taking, risk oversight, and independent assurance remain separate and effective. The Institute of Internal Auditors updated the framework in 2020 (rebranding it as the "Three Lines Model"), but the original terminology remains dominant in insurance regulatory discourse.
🔄 Each line carries a distinct mandate. The first line — which includes underwriters, claims teams, distribution managers, and operational staff — owns the risks inherent in daily business activities and is responsible for implementing controls. The second line comprises specialist functions such as the chief risk officer's team, actuarial function, and compliance department; these functions design frameworks, set risk appetite parameters, monitor the first line's adherence, and challenge decisions where necessary. The third line — internal audit — operates independently of both, providing the board and audit committee with objective assurance that the other two lines are functioning as intended. In practice, the boundaries require careful calibration: an MGA operating under delegated authority effectively extends an insurer's first line beyond its own walls, demanding that the insurer's second and third lines extend their reach accordingly.
📊 The model's strength lies in creating accountability without duplication — when it works well, each line understands its role and does not encroach on or neglect the others. Regulators frequently assess the effectiveness of the three lines during supervisory visits and ORSA reviews, and weaknesses in any single line can trigger enhanced supervision or capital add-ons. Criticism of the model typically centers on the risk that it becomes a checkbox exercise, with the three lines operating in silos rather than engaging in dynamic, two-way communication. For smaller insurers and insurtech startups, strict separation can be challenging to resource, leading to proportionate approaches where, for example, the compliance and risk management functions may share personnel but maintain distinct reporting lines. Despite these tensions, the three lines of defence model remains the dominant structural paradigm for insurance governance worldwide.
Related concepts: