Three Lines of Defense
Also called: three lines model, 3 lines of defence
The three lines of defense assigns risk ownership to the business that takes it, independent oversight to risk and compliance functions, and assurance to internal audit. The model's value is that it forbids the two failure modes it was designed against: a business marking its own homework, and a risk function so involved in decisions that it can no longer challenge them. Its critique is that the second line rarely has the authority its role assumes.