Skip Ribbon Commands
Skip to main content

The IIA's New Three Lines Model

The IIA's New Three Lines Model
An update of the Three Lines of Defense


Get acquainted with the latest understanding of governance and risk management

The Three Lines Model is a fresh look at the familiar Three Lines of Defense, clarifying and strengthening the underpinning principles, broadening the scope, and explaining how key organizational roles work together to facilitate strong governance and risk management.

The model can be applied to all organizations and is optimized by:

  • Adopting a principles-based approach and adapting the model to suit organizational objectives and circumstances.
  • Focusing on the contribution risk management makes to achieving objectives and creating value, as well as to matters of “defense” and protecting value.
  • Clearly understanding the roles and responsibilities represented in the model and the relationships among them.
  • Implementing measures to ensure activities and objectives are aligned with the prioritized interests of stakeholders.

Based on feedback from subject matter experts, globally recognized thought leaders, and over 2,000 individuals and organizations around the world, The IIA’s new Three Lines Model has been fully refreshed and updated to reflect current practices and help guide organizational decisions, behaviors, and actions to achieve successful outcomes.

Download your FREE copy now.

Arabic | Bulgarian | Chinese Simplified | Croatian | Dutch | French | French CanadianGermanIcelandic | Indonesian | Japanese |Korean​ |Polish | Portuguese | Serbian ​| SlovenianSpanish | Thai | Turkish

Take a Deeper Dive

Need more Three Lines? Take a deeper dive into the evolution of the Three Lines with a three-part video conversation between Harold Silverman, Managing Director of CAE Services, and Jenitha John, The IIA's Global Chairman, 2020-21. Watch the videos now.

Global Members-Only Webinar

24 September 2020    8:00–9:00 a.m. ET US | Registration Closed. Webinar at full capacity.

30 September 2020    7:00–8:00 p.m. ET US | Register

6 October 2020           8:00–9:00 a.m. ET US | Register

Eligible for 1 CPE, join us as Mark Carawan, Member of the Three Lines Working Group, Former CAE and CCO of Citigroup, and 2020–21 Global Board Director of Stakeholder Relations, and I provide a detailed overview of the new Three Lines Model and how it’s been redefined. IIA members will learn how to implement measures to ensure activities and objectives are aligned with the prioritized interests of stakeholders.

Learning Objectives

Attendees will:

  • Describe the key components and principles of the new Three Lines Model.
  • Explain how to apply the Three Lines Model within organizations.

Course Duration: 1
CPEs Available: 1
Knowledge Level: Basic
Field of Study: Management Services – Technical
Prerequisites: None
Advance Preparation: None
Delivery Method: Group Internet Based


Mark CarawanMark Carawan
Member of the Three Lines Working Group, Former CAE and CCO of Citigroup, and 2020–21 Global Board Director of Stakeholder Relations

Mark Carawan has a wealth of experience in governance, regulatory compliance and ethics, and conduct and culture matters globally, and has served as the chief audit executive for two global financial institutions. From the late 1980s to 2002, as a partner at Andersen and then Deloitte, Mark led and managed multi-disciplinary financial sector and individual institution restructuring, resolution, and privatisation programs on behalf of ministries of finance, central banks, regulatory authorities, and restructuring agencies. In developed and developing economies in Asia, Africa, Europe, and Latin America, these programs introduced new legislation, regulation, governance, and risk management requirements, often in response to financial sector crises. In many of these jurisdictions, Mark worked with the International Monetary Fund and the World Bank. Mark is currently a Senior Fellow at the New York University School of Law Program for Corporate Compliance and Enforcement (PCCE). Most recently, from 2017 to 2020, Mark served as Citigroup’s Chief Compliance Officer with responsibilities spanning Citi’s financial crime, regulatory compliance, conduct, and ethics programs. Mark was previously the Chief Internal Auditor for Citigroup from 2011 to 2017, and prior to that, the Barclays Group’s Chief Internal Auditor from 2003 to 2011.

Francis NicholsonFrancis Nicholson, CIA, QIAL, CRMA
Managing Director of Global Relations and Advocacy

Francis Nicholson is the Managing Director of Global Advocacy at The Institute of Internal Auditors (IIA) in Florida, USA. In this capacity he is responsible for promoting the value of the profession of internal auditing globally to stakeholders in an attempt to change thinking and provoke constructive actions that will foster an environment in which internal auditors can maximize the contribution they make to their organization’s success. He also works to support The IIA’s over 200,000 members and 125 global affiliates in being effective advocates on a local, national, and regional basis.

Francis joined the Chartered Institute of Internal Auditors in London, an affiliate of the global body, in 2007 as the Director of Education. He has over 25 years’ experience in vocational and academic training, education, and professional development as an instructor, curriculum designer, faculty head, assistant principal, and consultant. He moved to Florida in 2013 and has held a number of roles for The IIA in training, certifications, and advocacy.

From September 2018 Francis was the staff liaison to the working group of The IIA that led the review and update of the Three Lines of Defense, launched as the new Three Lines Model in July 2020.