The Three Lines of Defence – An Introduction

The Governance, Risk & Compliance (GRC) system in a company or organization indisputably represents an essential component of corporate governance. Various management functions such as Risk and Compliance Management, Internal Control System, Security Management, Data Protection or Emergency and Crisis Management serve to protect the company from dangers and risks and to ensure its continued existence.

The technical and organizational design of these functions plays a decisive role in terms of how effectively and efficiently these tasks can be performed.

When setting up a GRC system, there are basically two strategies, the isolated systems approach, known as management islands, and the integrated approach, which creates synergies between the individual functions.

In the case of the first, isolated approach, each GRC function defines a management system for itself, without considering dependencies with other GRC functions and the impact on the operational units. In comparison, it is often more promising to set up a GRC system integrated with the various management functions.

This comparison makes it clear that following an integrated approach when setting up your company’s GRC system is the best choice. This approach requires greater coordination between the individual topics, however, the advantages of an integrated GRC system speak for themselves. The Three Lines of Defence (TLoD) model of the European Confederation of Institutes of Internal Auditing (ECIIA) and the Federation of European Risk Management Associations (FERMA) has proven its worth as a basis for setting up and operating a GRC system.

The Three Lines of Defence model is a recognized and proven model for organizing and explaining the various efforts and issues involved in managing an organization’s risk. The model divides an organization into three lines of defence, which define the tasks for the operational units, GRC functions and monitoring respectively.

Operational Management as 1st Line of Defence

The first Line of Defence is identified as Operational Management. From the organizational structure point of view of the, this typically consists of department heads or division heads who have the functional responsibility over all processes in this area. The tasks within the organizational unit are structured and defined via these processes. Process responsibility goes along, particularly with responsibility for key figures, risks, controls and adherence to compliance requirements.

GRC Functions or Assurance Services as 2nd Line of Defence

The “system guardians” of various disciplines are part of the second Line of Defence and define the procedure and method to perform and fulfill the various tasks or duties within the respective function. These include functions such as:

• Process Management
• Risk Management
• Internal Control System
• Compliance Management
• Corporate Security Management
• Data Protection (DPR)
• as well as Quality Management, Environmental Protection and Occupational Safety

Internal Audit as 3rd Line of Defence

In the third Line of Defence, the internal or external auditors assume the tasks of monitoring and supervising the GRC or governance system, as well as auditing its effectiveness and efficiency.

The definition of the governance structure includes all tasks that need to be completed in order to define the system for the task in question. For this purpose, basic definitions must be made for each system with regards to roles, methods used, tool support, knowledge management, maturity measurement and support for the operational units, among other things. These definitions are typically recorded in manuals or guidelines that serve as instructions for operational management.

In the context of integrated GRC, this task is of particular importance, since the coordination of essential topics (role definition, methods, tools, etc.) takes place on a cross-functional basis.

Operational management is of particular importance in the context of the Three Lines of Defence model. After all, all tasks within this GRC function must be completed conscientiously and on time in addition to day-to-day business. Usually this leads to a juggling act in which balance between the various tasks needs to be found.

It is therefore very important for the GRC functions to coordinate as well as possible at the second line of defence level in order to enable the operational area to perform its tasks efficiently. In any case, duplicate or multiple data collection should be avoided to prevent tying up unnecessary resources at the operational level.

In general, operational management must perform various tasks for a GRC function. The primary goal should be to perform the same tasks for different systems only once.

The Three Lines of Defence model is ideally suited for dividing up the individual topics and tasks of enterprise-wide risk management among the different levels of corporate management. Using this model purely to define the terms or determine the responsibilities would leave some unused potential on the side.

The full benefit of this approach is realized once those responsible for the system along the 2nd Line of Defence recognize the potential of working together to resolve cross-cutting issues and give operational management the opportunity to complete the required tasks efficiently, comprehensively and on time. Mapping the Three Lines of Defence also enables cross-line collaboration, especially between the 1st and 2nd Lines of Defence.

In addition, the resulting integrated and centralized database spares the internal and external auditors time-consuming data collection. The immediately available, clear and historically traceable data reduces the effort required for data analysis. These aspects provide the audit department with additional resources that can be used for the development of improvement potentials as well as for consulting activities.

The success factors of an integrated GRC based on the Three Lines of Defence model are:

• Collaboration of management functions along the 2nd line of defence in the course of defining the governance structure and in the area of strategic management
• Definition of common methodologies and the use of unified technical support
• Use of a common language for the same topics within the organization

BOC Group has many years of experience in consulting and implementation of an integrated GRC system and offers not only expert advice, but also comprehensive tool support as well as training for successful implementation and continued operation.

We would be pleased to master your change towards a process-oriented, integrated GRC system together with you!