Three Lines of Defense

A common model for governance of an organization’s ERM framework. The “first line” refers to business and process owners within the organization. The “second line” identifies where there is separate oversight of risk-taking activities, with some independence from the first line. The “third line” is the role undertaken by auditors, which includes reviewing the effectiveness of the second line and the ERM framework.