In July 2026, the Institute of Internal Auditors (IIA) issued a revised Statement of Position, Assurance and Advice in Support of Effective Governance: Three Lines Model, updating its guidance on the Three Lines Model. The revised Statement retains the model’s core structure while expanding its discussion of accountability, independence, coordination, and implementation. As a principles-based framework, the model is intended to apply across organizations of different sizes, structures, risk profiles, and regulatory environments.

The model describes how boards and senior management receive reliable, balanced information about organizational performance, risks, and controls. It also distinguishes the responsibilities of management, specialized risk functions, and internal audit within an organization’s broader assurance structure.

The Three Lines at a Glance

The updated Three Lines Model distinguishes the responsibilities of management, specialized risk functions, and internal audit within an organization’s assurance structure. Each line has a distinct role within the organization’s governance and assurance structure.

• First Line: Management and operational roles own and manage risk through day-to-day activities and controls.
• Second Line: Specialized risk functions provide expertise, guidance, monitoring, and challenge in support of management.
• Third Line: Internal audit provides independent and objective assurance and advisory insights without assuming management responsibility or decision-making authority.

First Line: Management and Operational Roles

The first line consists of management and operational roles responsible for day-to-day risk ownership. These roles design and operate processes and controls while monitoring performance and providing insight related to execution.

Second Line: Risk and Specialist Functions

The second line includes support and specialist roles focused on risk-related matters. These functions may provide expertise, monitoring, challenge, and targeted reviews within their areas of responsibility. They support the first line while maintaining sufficient organizational separation to identify patterns or emerging risks.

Third Line: Internal Audit

Internal audit provides independent and objective assurance regarding the effectiveness of governance, risk management, compliance, and control processes. It may also provide advisory insights from an organization-wide perspective, provided it does not assume management responsibility or decision-making authority.

Functional reporting to the board supports internal audit’s independence and its ability to communicate issues without undue influence.

Assurance, Advice, and Independence

The updated model distinguishes assurance from advice while recognizing that both support governance and decision-making. Assurance evaluates the adequacy and effectiveness of governance, risk management, compliance, and control processes, while advice identifies emerging issues and opportunities for improvement. The model also reinforces independence as a foundational element of credible assurance.

Coordination Across the Organization

The updated model emphasizes coordination among management, second-line functions, internal audit, and external assurance providers. Shared planning, risk information, and reporting can help identify gaps, reduce duplication, and provide the board with a clearer view of assurance coverage.

Internal audit may help coordinate these efforts because of its organization-wide perspective and access to the board. The model also addresses overlapping responsibilities, outsourcing, and safeguards intended to preserve accountability and objectivity.

Understanding the Updated Three Lines Model

The revised model provides additional context on how assurance and advisory responsibilities are structured and coordinated across an organization. The full guidance is available in the IIA’s Assurance and Advice in Support of Effective Governance: Three Lines Model Statement of Position.

For questions about the 2026 Three Lines Model or how the updated guidance relates to your organization’s governance, risk management, and internal audit structure, contact CRI’s Internal Audit team or email [email protected]. Our professionals can help organizations evaluate their assurance and risk management structures, including how assurance is mapped, safeguards are designed, and internal audit functions are assessed.