Glossary
Three lines of defence
The three lines of defence is a governance model that separates risk-taking business units, risk and compliance oversight, and independent internal audit.
Three lines of defence explained
The model assigns roles. The first line is management and staff who own and manage risk as part of running the business. The second line is the risk management and compliance functions that set frameworks, monitor and challenge the first line. The third line is internal audit, which gives the board independent assurance that the first two lines work.
The Institute of Internal Auditors updated the model in 2020 as the Three Lines Model, placing more emphasis on the governing body and on collaboration between the lines rather than rigid separation, but the underlying idea is unchanged.
For example, a branch manager approving a customer's risk rating is first line; the compliance officer sampling those ratings is second line; the internal auditor testing the whole process is third line.
Why it matters in life insurance
Regulators in Zambia look for clear separation between those who take risk, those who oversee it and those who provide assurance, especially in AML, where the compliance officer's independence matters. A shared platform with role-based access supports that separation without three separate systems. ERMAML, the Ontech Risk & Compliance Suite, scopes roles and branch access so each line sees and does what its role requires, with an audit trail across all three.
Related terms
RCSA (risk and control self-assessment) · Maker-checker (four-eyes principle) · Risk appetite