---
title: "Three Lines Model"
description: "The Institute of Internal Auditors' 2020 update of the \"three lines of defense\": the governing body oversees; management holds first-line roles (delivering products and services) and second-line…"
canonical: https://aigovernanceengineer.com/glossary/three-lines-model
author: "Jorge García Aibar"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)"
doi: https://doi.org/10.5281/zenodo.22956197
version: "0.5.0"
updated: 2026-09-24
---

# Three Lines Model

The Institute of Internal Auditors' 2020 update of the "three lines of defense": the governing body oversees; management holds first-line roles (delivering products and services) and second-line roles (risk expertise, support and challenge); internal audit gives independent third-line assurance [1].

- Developed in: [ch. 12, The three lines, applied to AI](https://aigovernanceengineer.com/bok/governance-program#the-three-lines-applied-to-ai)
- Chapters: [ch. 12, Governance Program](https://aigovernanceengineer.com/bok/governance-program)
- In the glossary chapter: https://aigovernanceengineer.com/bok/glossary#t-three-lines-model

## Sources

[1] The IIA's Three Lines Model: an update of the Three Lines of Defense (governing body; management's first- and second-line roles; internal audit as third line; third-line independence). The Institute of Internal Auditors. 2020-07. https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/ (verified: primary)