AI Governance Engineer
GitHub

Three Lines Model

By Updated

The Institute of Internal Auditors' 2020 update of the "three lines of defense": the governing body oversees; management holds first-line roles (delivering products and services) and second-line roles (risk expertise, support and challenge); internal audit gives independent third-line assurance 1.

Developed in
ch. 12, The three lines, applied to AI
Chapters
ch. 12, Governance Program
Source
1 numbered reference, listed below

Where it is used

3 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Sources

  1. [1] The IIA's Three Lines Model: an update of the Three Lines of Defense (governing body; management's first- and second-line roles; internal audit as third line; third-line independence). The Institute of Internal Auditors. 2020-07. https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/ (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Three Lines Model. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/three-lines-model. CC BY 4.0

BibTeX

@misc{aige2026threelinesmodel,
  author  = {Jorge García Aibar},
  title   = {{Three Lines Model}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/three-lines-model}
}