1 Introduction
The Three Lines of Defence model (TLD, 3LoD, etc) is
a model that sets out to (i) provide a framework for the provision of assurance
within a company, (ii) provide regulators with a model they can recommend
companies implement, and (iii) that they can assess when reviewing regulated
companies. It is the simplicity of the model and the risk of the introduction
of silo mentalities that seems to draw much concern from the Risk Management
profession. Yet it is also the simplicity of the model that enables companies
to implement it.
This article is focused on the relationship between
two elements of the Three Lines; Risk Management (in theory 2nd line) and
Internal Audit (the 3rd line). These two lines of defence provide Directors,
the Board, shareholders and stakeholders with confidence that the system of
internal controls is functioning effectively, that risks are being identified
and managed, and where appropriate, accepted or assumed deliberately.
As a reminder, operational management is considered
the 1st line of defence, in that it is operational management that runs the
business, including the internal controls that manage risk and opportunity in
the business.
However, a more accurate and measured interpretation
of the TLD model shows all three lines (Operational Management; Risk Management
(and Compliance); and Internal Audit) all provide elements of assurance, with
each supporting the other two to ensure that the assurance provided can be
relied upon. Where any of the three lines fail to perform their specific
responsibilities, the overall level of assurance that can be provided is
reduced, regardless of the quality of the other two lines.
We call it the TLD, but a more appropriate model may
be the Three Elements of Assurance, which doesn't sound nearly as interesting.
2 Three Lines of Defence
The first thing to remember about the Three Lines of
Defence (TLD) model is that it is not a model for a complete Governance
structure. It is a model for the management of risk and provision of assurance
and comfort to the Executive, Board and shareholders (and appropriate stakeholders).
As such, the TLD fits within an overall set of governance functions and structures,
and has the specific purpose of ensuring appropriate focus on, and management
of risks and controls.
The three lines are generally considered to be
Operational Management (1st line), Risk Management and Compliance (2nd
line) and Internal Audit (3rd line). Without operational management,
the company, any company, would not accomplish its basic functions, and
therefore may assume unacceptable risks when providing services and products to
customers. Operational management, through operating the business in line with
the objectives and constraints of the Board, provides the returns to the
shareholders, within the regulatory and legal constraints on the business.
Operational Management also ensures controls function effectively and
efficiently, and demonstrates that processes are functioning in a manner
consistent with achievement of objectives.
The implementation and operation of the TLD is not
"the" governance system, but is an element within an overall
governance framework. Some organisations explicitly limit the number of functions
considered part of "2nd line" to Risk Management and Compliance,
while others include a range of operational support functions such as HR,
Finance, IT, etc. Personally I consider these functions to be part of
"first line" as they are operational functions supporting the direct
activities of the enterprise.
The Bank of International Settlements (BIS), in their
2012 guidance on Internal Audit (http://www.bis.org/publ/bcbs223.pdf), includes
Risk Management, Compliance, Legal, HR, Finance, Operations and Technology in
the 2nd line. Equally, the IIA (Institute of Internal Auditors) not
surprisingly included a wide range of business activities in the 2nd line,
while reserving the third line for Internal Audit only.
The BIS, in their 2015 guidance on Corporate
Governance (http://www.bis.org/bcbs/publ/d328.pdf), has a slightly updated
discussion of the TLD model:
"The increased focus on risk and the supporting governance
framework includes identifying the responsibilities of different parts of the
organisation for addressing and managing risk. Often referred to as the “three
lines of defence”, each of the three lines has an important role to play. The
business line – the first line of defence – has “ownership” of risk, whereby it
acknowledges and manages the risk that it incurs in conducting its
activities. The risk
management function is
responsible for further
identifying, measuring,
monitoring and reporting
risk on an
enterprise-wide basis as
part of the second
line of defence,
independently from the
first line of
defence. The compliance
function is also
deemed part of the
2nd line of defence.
The internal audit
function is charged
with the 3rd line
of defence, conducting risk-based
and general audits and reviews to provide assurance to the board that the
overall governance framework,
including the risk
governance framework,
is effective and that policies
and processes are in place and consistently applied."
This latest BIS guidance is clear in setting out the
three lines. Like any model, if inflexibly adhered to, TLD can oversimplify and
result in silos, in which there is an assumption that only IA is able to
provide assurance to the Board and Audit Committee; this in a time when
regulators and professional associations are increasingly calling for separate
Risk Committees or, failing that, a joint Audit and Risk Committee. In the
evolving models and expectations of regulators, Risk Management has a critical
role in providing assurance at the Board level.
In summary, the TLD model provides an effective
mechanism for the allocation of responsibility for the operation of controls,
the assessment of the overall risk and control environment, and allocation of responsibility
for the detailed review of specific high risk areas of the control environment.
While there is a risk of silos reducing the ability of the first and second to provide
assurance, the model is "simple" enough to allow for easy
communication and allocation of responsibilities and ownership of operation and
assurance over the system of internal controls. Regular communication of the
concept also ensures that operational management is aware of and able to
enunciate the TLD principles.
Regulators and professional bodies agree; Internal
Audit and Risk Management need to be separate, and only in exceptional cases,
or where the business is too small to afford both, should they be combined. In
cases where they are combined, additional oversight by the Board is important.
Both functions are and need to be independent of management, yet as highlighted
above, they fulfil very different aspects of provision of assurance.
3 Should Risk be pan-enterprise
There is an old adage: Risk Managers do not manage
risk, Risk Managers create the environment that enables the identification,
assessment, management and reporting on risks across the enterprise. One of the
key elements of that statement is "across the enterprise". Risk
Management must, like Internal Audit, have free and unrestricted access across
the enterprise in order to form and maintain a consolidated picture of the risk
environment, and to ensure that management is aware of their responsibilities
for implementation and operation of that control environment. (Of course Risk
Management has many other responsibilities, and I recommend you dig deeper into
the BIS governance guidance document).
Yet here the difference between RM and IA comes to
the fore; RM works with management to identify, assess, respond and monitor the
risk environment. RM does not perform deep-dive reviews of individual controls
or events (unless specifically requested or if part of the management of a
specific transactions and activities, in which case RM, for these activities,
becomes an element of operational management).
The identification and recording / assessment of
risks then assumes the identification of controls associated with that risk. Of
course, there may be no controls in place to manage the risk, in which case
there should be a record of the gap in the system of controls, and the control
gaps should be documented, with responsibility allocated for implementing
controls, based on and in agreement with the own or the associated risk.
Controls do not exist in a void. Without a business
objective and risks to the achievement of that objective, there is no need for
a control. Such "controls" are actually a drag on the effective and
efficient performance of business operations to achieve objectives. Therefore,
if there is a control, then there is a risk, and the risk only exists in
relation to the ability of the business to achieve objectives.
Logically then, identification of a risk universe
begins with the objectives of the business or function being controlled, at
whatever level of granularity, and from those objectives, risks to the
achievement of the objective can be identified. Of course, people will identify
risks without a specific linkage in mind. It is part of the role of Risk
Management to assist in the assessment of the risk, including how that risk may
impact of achievement of objectives.
The role of Risk Management in relation to individual
controls and the control environment is to ensure that management performs
periodic assessments of the effectiveness of the controls they are responsible
for, and provides attestation that the controls are functioning effectively.
Where the controls are not functioning, or there are gaps in the system of
controls, management must identify these missing controls, and through the Risk
Management process, confirm the status of implementing such controls.
Risk Management challenges management's assertions on
the effectiveness of the controls over risks. Management operates the controls,
and attests to the effectiveness of the controls. Internal Audit tests
management’s assertions at a detailed level.
4 The Scope of Internal Audit
To be effective, Internal Audit must have
unrestricted access across the enterprise, yet should work to a risk-based
programme of internal audits and reviews. There is a natural tension between
the desire to provide Internal Audit coverage across all business processes,
systems and departments, and the recognition that Internal Audit is a cost
overhead that must be carefully applied. The nature of Internal Audit activity
is to confirm through investigation that the stated control environment is in
place, and that controls are functioning to the level of effectiveness attested
by management. This means that Internal Audit by nature must dig deeper in to
the strategic and operational functioning of the specific areas subject to
individual audits.
This can be expensive, and therefore IA resources
need to be carefully targeted and used to best effect. Equally, as the audience
for Internal Audit's reports and ultimately for the level of assurance provided
is the Board and Audit Committee, Internal Audit activity should be focused
only on those areas (process, system or department) whose controls or the
failure of the controls may have a material impact on the ability of the
business to achieve strategic objectives.
What this means in practice is that Internal Audit
must be cognisant of, and monitor risk and control status across the
enterprise, but that actual Internal Audit activity should be focused on areas
of greatest risk. In addition, specialist resources to perform internal audits
of technical areas are expensive to retain on staff, and therefore tend to be
brought in for the specific audit.
In summary this means that where Internal Audit is
performing a controls based audit (as opposed to an E&E, Strategic or
Operational audit), they tend to perform deep yet narrow reviews of higher risk
areas. Where controls have previously been identified and management has
attested to the effectiveness of the functioning of the controls, Internal
Audit can use the Risk Register and associated controls reporting to inform
audit planning and performance.
5 The Relationship between Internal Audit and Risk Management
planning
The objective of IA planning is to ensure that the
highest risk areas within the enterprise and within any individual auditable
area are covered by audit review and testing. To accomplish this, frequently IA
will review the Risk Register for the area(s) that will be reviewed. The Risk
Register should inform audit planning, but should not be the primary resource.
This means that IA needs to interact with Risk
Management and the Risk Register three times in the audit cycle: (i) at
development of the IA Strategic and Annual Plan, (ii) at the planning stage of
each audit, and (iii) post audit confirming that the auditee has updated the
Risk Register to reflect findings (risks) and control recommendations. The
following chart provides an overview of the IA planning processes, and the key
interactions with Risk and the Risk Register.
In planning an audit, Internal Audit needs to consider
the range of business processes, systems and departments that are included in
the specific review. These should be risk assessed and ranked, with the primary
focus of audit testing and review being focused on the higher risk areas. At
this point it is important to note that risk assessment is not only "likelihood
& impact" but extend well beyond, to include factors such as
sensitivity of data, value at risk or exposure, as well as other factors.
Note the continual use of the word "risk"
in planning and execution of the audit. The question could be asked, why aren't
all the risks that IA will be considering already included in the Risk
Register? The simple answer is that audit planning is considering a far more
granular level of risks at the detailed business process level, while the Risk
Register may have a risk or risks that encompass a wider range of detailed
business processes within a single risk.
Certainly the major controls should be included in
the Risk Register and be associated with individual risks. Again, a Risk to a
business objective may have a number of Controls in place to manage that Risk
within the Risk Appetite of the enterprise, as set by the Board. Yet the
development and evolution of the specific Risk within the Risk Register may
omit or fail to include all controls applicable to the Risk. In such a case, if
IA places too much reliance on the Risk Register, there is the danger that the
full control environment will not be understood, and that key processes and
controls will be missed or discounted. This could undermine the value of the audit,
and open the results to dispute by not taking into account compensating or
other existing controls.
6 IA findings in a Risk world
There should be a link between IA findings and
recommendations, and the overall risk environment of the enterprise, and
therefore Risk Management. Working backwards, there cannot be an IA
recommendation if there is not an associated risk. The failure of a control to
function, or a lack of evidence of the functioning of the control does not in
itself mean that there is a risk. It could simply mean that the control is
redundant, or the evidence previously provided or assumed to be required is not
adequate to demonstrate that the control is effective or even required. It can
be difficult for an enterprise to get the right balance of under-controlled
(and thereby exposed to greater risk than is the Risk Appetite of the
enterprise) or over-controlled (and thereby incurring excessive costs of
control for limited economic benefit through reduced exposure).
Therefore, when auditing internal controls, generally
IA findings should not exist if there is no associated risk. This means that
the structure and content of the IA finding needs to clearly enunciate the risk
or risks associated with that finding, and the potential impact if the required
or recommended controls are not functioning, or not put in place. It is also
critical that the auditee recognises and agrees with the description of the description
and the resulting situation of risk. Without this agreement, there can be no
agreement to the required controls. Failure to gain buy-in to the underlying
enunciation of the situation and the risk undermines IA, the auditor, and can result
in unnecessary conflict between IA and business units.
Having buy-in to the description of the situation and
associated risk(s) does not automatically presuppose that the IA recommendation
is the most appropriate response to the risk(s) highlighted by the auditor.
Management understands, or should understand, their business objectives and
constraints. Therefore management should in theory be best positioned to
confirm what controls will be most effective, and to agree to apply the
resources required to implement an effective control. IA can and should use
best judgement to consider if management's response is appropriate, and if so
should be willing to alter the recommendations to meet what management
suggests.
The recommendation that is almost always missing from
audit reports is one that should be common to all Audits; that the risks,
controls and remediation actions identified in the audit should be cross
referenced to the Risk Register and the Risk Register updated to reflect the
findings of the audit. Where the Risk and Controls are included in the Risk
Register, these should be updated based on the audit findings. Where the Risk
does not exist, it should be added. Where the Control is not included against a
Risk, it should be added.
By taking this final step, IA ensures that the
overall risk environment and system of internal controls is updated to reflect
the actual current situation.
7 Linkages, and a model
Through the Risk Management and Internal Audit
processes, we can build a consolidated picture of the risk environment and
system of internal controls. Assurance is provided to Senior Management, the
Board, shareholders and key stakeholders. Risk Management ensure a holistic
view of the risk and control environment, while Internal Audit provides
comfort, through detailed testing, that management's assertions of the
effectiveness of the control environment are accurate, and provides guidance on
where remediation activity is required.
The TLD model, if narrowly applied as per the IIA's
interpretation, assumes all assurance is provided by Internal Audit. This is a
narrow view that does not adequately consider the assurance roles that are
provided by 2nd and 1st lines in their daily activities.
A more accurate and measured interpretation of the TLD
model shows all three lines (Operational Management, Risk Management (and
Compliance), Internal Audit) providing assurance, with each supporting the
other two to ensure that the assurance provided can be relied upon. Where any
of the three lines fail to perform their specific responsibilities, the overall
level of assurance that can be provided is reduced, regardless of the quality
of the other two lines.
Management's responsibility is to operate controls
that exist to manage identified and recorded risks, efficiently and
effectively. Risk Management's responsibility is to ensure that risks are
identified and assessed, that the risk environment and system of internal
controls is defined, that risks and their associated controls are recorded and
monitored, and that management provides attestation or assertions on the
effectiveness of those controls. Internal Audit provides a ‘final line of
defence’ by performing detailed reviews to confirm the effective functioning of
control. None is responsible for catching the others out, or "owning"
the provision of assurance.
Internal Audit cannot be everywhere or see the entire
risk environment - internal and external. Risk Management cannot retain a
systemic view of risk if it engages in detailed controls testing, and managers
can provide assurance only over those controls for which they are individually
responsibility for ensuring are functioning.
We call it the TLD even through a more appropriate
model may be the Three Elements of Assurance, but that doesn't sound nearly as
interesting.
