14. Are 3 lines of defense useful? - Alex Sidorenko

The concept of the three lines of defense in risk management is a familiar one in the financial services industry, but it is not clear whether it is useful in non-financial companies. The three lines of defense are: the first line of defense, which is the business units, the second line of defense, which is finance, legal, security, health and safety, and risk management, and the third line of defense, which is oversight structures, committees, board of directors, and internal and external audit. Alex Sidorenko argues that this concept is not useful because it ignores the nature of how decisions are made in the organization and the tools that risk management personnel have at their disposal. He also argues that risk management should be independent from business units and that it should act as a facilitator, methodology expert, and not get involved directly in making decisions. He suggests that the line between the first and second lines of defense is blended and that risk managers should sit closer to the first line of defense while still having the ethical and professional competencies.

[alejandrodanielgarciabravo]

In my opinion, this model was adapted by auditors to Risk management, but the role of Risk managers is completly different to role of Internal Auditor.

Risk management has to be fully integrated into business and participate in the decisión making at al level of the company. Risk manager must participate in cliente negotiation, partner negotiation and must have a deep knowledge of the business.

The viene and decision made by Risk manager must be indepdendent, but He must work integrated in the business, really close to first line

[congdothanh]

Thanks for very practical approach! To more clear for debate, it should be clearly define for two roles or position of concept 3th lines of defenses:
1. It is concept not practical guide for an organization with outside stakeholder involved such as minority shareholder or government supervisor
2. This concept is for risk governance model not management model

[vickyjoe]

I think what you have shared is more often seen in medium and small size companies where each dollar is under the microscope. The business needs an Independent and accurate view of risk which will enable them to make an informed decision. As long as that need is met, I think lines of defence is more of a desired model. That said, since big banks are highly regulated and are required to demonstrate a solid model (defence in depth) plus they have the money, they don't mind the big compliance costs. As to your second challenge, exchange of information between the internal audit and risk management teams is critical and I agree with you. I wonder what reason an auditor would have to not share their observations and reports with risk management teams? In fact I have never seen an audit meeting (especially the de-brief meeting where they discuss the final findings) where risk manager for the auditee was not invited. To summarise, I find the three lines of defence to be useful as long as the teams understand the spirit behind this model. Open to alternate thoughts. Thanks.