Risk management is not the responsibility of one department. The Three Lines Model helps leaders distinguish who manages risk in daily work, who provides oversight and challenge, and who gives independent assurance.
The governing body remains accountable for oversight
A bank’s board oversees strategy, risk and governance, while senior management translates that direction into responsibilities, resources and operating decisions. The three lines support this structure; they do not replace board or management accountability.
Clear reporting allows the board to understand whether risks are being managed within the bank’s objectives and approved tolerances.
The first line owns and manages risk
Business and operational management deliver products, serve customers and run processes. Because they make the daily decisions that create or change risk, they are responsible for identifying that risk and operating the controls built into their work.
A first-line leader cannot transfer ownership simply by referring an issue to compliance, risk management or internal audit.
The second line provides expertise and challenge
Risk management, compliance and similar functions help establish frameworks, advise the business, monitor exposure and challenge whether risks and controls are being assessed appropriately.
They need enough independence and authority to raise concerns, but they still work with management. If they begin operating the business’s controls, the distinction between ownership and oversight can become unclear.
The third line provides independent assurance
Internal audit independently evaluates governance, risk management and internal controls and reports its conclusions to the board or audit committee. Its role is not to own the process it later audits.
Independence gives the board a perspective separate from both the business and the functions that oversee it.
Coordination matters, but responsibilities must remain clear
The lines should share relevant information and avoid unnecessary duplication. Coordination becomes weak governance, however, when everyone participates but no one is clearly accountable for a decision, control or remediation action.
Leaders strengthen the model by naming owners, defining escalation paths and making sure independent reviewers have the access and authority needed to challenge the work.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.