From “Lines of Defense” to “Three Lines” For years, there was talk of the three lines of defense model, popularized by the Institute of Internal Auditors (IIA) in its 2013 position paper. Its logic was clear: to separate who manages risk, who oversees it, and who provides independent assurance. In July 2020, the IIA updated it and renamed it the Three Lines Model. The change was not merely cosmetic: • The word “defense” was removed. Risk management not only protects value; it also creates it. A purely defensive model encouraged viewing internal audit as a hindrance. • The governing body was placed at the center. The board of directors is accountable to stakeholders and delegates authority to management; internal audit reports to the board. • The lines are no longer silos. Collaboration and alignment among roles are encouraged, without compromising the independence of the third line. • The focus is on roles, not rigid structures. A single person or department may hold first- and second-line roles; however, they cannot audit themselves. The model is based on six principles: governance, the role of the governing body, the roles of management (first and second lines), the role of the third line, the independence of the third line, and the creation and protection of value. The Three Lines and the Governing Body Three Lines Model · IIA 2020 Management comprises the first and second lines: both manage risk, one through day-to-day operations and the other through specialized expertise. Internal audit remains outside this chain and reports directly to the governing body. External assurance providers, such as external auditors and regulators, complement this perspective from outside the organization. The Third Line: What Internal Audit Does The third line provides independent and objective assurance and advice on the adequacy and effectiveness of governance, risk management, and control. Its primary client is not management; it is the governing body. Three attributes define it: 1. Independence. Internal audit reports functionally to the board of directors or the audit committee, and only administratively to senior management. The board of directors approves its charter, plan, and budget, and participates in the appointment and removal of the head of internal audit. 2. Objectivity. The auditor does not design or operate the controls that he or she later evaluates. If he or she does, he or she loses the necessary distance to form an opinion. 3. Risk-based approach. The annual plan is not organized by rotating through departments, but rather based on where the risks that could most significantly affect the organization’s objectives lie. Two types of services: • Assurance: assessments that provide an opinion or conclusion regarding processes, controls, compliance, or information. For example, the effectiveness of cash collection controls at branch offices. • Advisory (consulting): support for management, such as providing input on the design of controls for a new system prior to its implementation. Here, the auditor advises but does not assume management responsibilities. The IIA’s Global Standards for Internal Auditing have been in effect since January 2025, replacing the previous International Professional Practice Framework (IPPF). They reinforce the mandate of the function, the board’s role in supporting it, and the requirement that internal audit provide strategic value, not just compliance. Common Mistakes and Red Flags In practice, the third line is almost always weakened for the same reasons: Warning sign Why it’s a problem The internal auditor reports to the CFO Ends up auditing their own boss; independence exists only on paper Internal audit approves payments, reconciles accounts, or develops procedures It takes on first-line functions and is then unable to evaluate them objectively The plan is repeated exactly the same way every year It fails to address new risks: systems, digital fraud, money laundering Findings remain in the report and no one follows up The board of directors does not know if the risks were addressed The audit committee meets only to approve financial statements The third line of defense loses its primary point of contact Internal audit is a “one-auditor department” with no resources Actual risk coverage is minimal A very common misconception is to assume that the external audit replaces the internal audit. This is not the case: the external auditor provides an opinion on the financial statements for third parties; the internal auditor continuously evaluates processes, risks, and controls for the board of directors. Fraud and money laundering: the contribution of the third line When it comes to fraud, internal audit is not responsible for preventing it; that responsibility lies with management. Its role is to assess whether anti-fraud controls are well-designed and functioning, and to be on the lookout for indicators of fraud in every engagement. When there is reasonable suspicion, the case is typically referred to a specialized forensic investigation. Regarding the prevention of money laundering and terrorist financing, the framework in Paraguay is as follows: • First line: the commercial and operational departments that know the customer and record transactions. • Second line: the compliance officer, who designs the due diligence policy, monitors transactions, and reports to SEPRELAD. • Third line: internal audit, which independently verifies that the compliance program is functioning, without replacing the compliance officer. In the public sector, the Standard Model for Internal Control (MECIP) follows the same logic: management oversight by each institution and independent evaluation by its internal audit units. A compliance program that has never been independently audited is, in effect, an unverified program. Conclusion A strong third line is not measured by the number of reports it issues, but by the confidence it instills in the board of directors to make decisions. To achieve this, it needs three things: true independence, a risk-based plan, and a governing body that listens to it and follows up on its recommendations.