# Three Lines of Defense

*Risk & Portfolio — Finicade finance glossary*

The three lines of defense assigns risk ownership to the business, oversight to risk and compliance, and independent assurance to internal audit.

The three lines of defense assigns risk ownership to the business that takes it, independent oversight to risk and compliance functions, and assurance to internal audit. The model's value is that it forbids the two failure modes it was designed against: a business marking its own homework, and a risk function so involved in decisions that it can no longer challenge them. Its critique is that the second line rarely has the authority its role assumes.

**Also known as:** three lines model, 3 lines of defence

**Related terms:** [Operational Risk](https://finicade.com/glossary/operational-risk), [Risk Appetite](https://finicade.com/glossary/risk-appetite), [Internal Controls](https://finicade.com/glossary/internal-controls), [Compliance](https://finicade.com/glossary/compliance), [Audit](https://finicade.com/glossary/audit)

Source: https://finicade.com/glossary/three-lines-of-defense