The new three lines model for structuring corporate governance – A critical discussion of similarities and differences

Abstract

The efficient and effective organization and coordination of corporate governance activities is still one of the major challenges of modern corporate management. For many years, it was precisely the so-called three lines of defense model that was used to structure governance functions. However, as more and more open points of discussion regarding practical implementation have emerged over the past years, the three lines model was published in 2020 as a fundamental update by the Institute of Internal Auditors (IIA). This article presents the new model and critically discusses the similarities and differences to the existing model. Thus, this article contributes to the current discussion of best practices regarding corporate governance structure and the fundamental issues of efficient and effective oversight. Both practitioners and researchers should benefit from the critical analysis of this paper.

Internal Auditor's Role in ESG Disclosure and Assurance: An Analysis of Practical Insights

“…Auditors' abilities to review and evaluate processes and controls used to generate, gather, and disclose information can provide them with a competitive advantage in ESG assurance 3 . Within the complex ESG endeavor, internal auditors might in fact serve as valuable actors given their comprehensive understanding of company-specific processes and risks along with controls to achieve a goal-oriented alignment of ESG-related activities (Morley et al, 2010;Eulerich, 2021). The starting point for a value-adding IAF is commonly offered by the three lines model (Bantleon et al, 2021;Eulerich, 2021) pointing out that internal auditing supports governance actors along with monitoring and oversight activities through independent and objective assurance and advice.…”

“…Within the complex ESG endeavor, internal auditors might in fact serve as valuable actors given their comprehensive understanding of company-specific processes and risks along with controls to achieve a goal-oriented alignment of ESG-related activities (Morley et al, 2010;Eulerich, 2021). The starting point for a value-adding IAF is commonly offered by the three lines model (Bantleon et al, 2021;Eulerich, 2021) pointing out that internal auditing supports governance actors along with monitoring and oversight activities through independent and objective assurance and advice. Thus, internal auditing has gained considerable acceptance as a crucial element of good corporate governance (Carcello et al, 2020;Eulerich & Lohmann, 2022).…”

What can controllers and internal auditors do to support risk ownership?

“…From Table 1 it follows that the presence of risk ownership in the first line is not mentioned explicitly in the scientific literature. However, signals for lacking first line risk ownership do emerge, such as fuzziness between first line and second line roles (Eulerich 2021;Davies and Zhivitskaya 2018;Mabwe et al 2017). Furthermore, the importance of first line risk ownership arises from several points of view.…”

“…By only one sentence, Davies and Zhivitskaya (2018 p. 41) seem to summarise Table 1: "While the [Three Lines] concept has theoretical attractions, it also has the potential to diffuse responsibilities for risk in a way which could reduce accountability rather than enhance it." This fuzziness in responsibilities will not be reduced by the fact that the recent Three Lines model allows combining first and second line roles (Eulerich 2021). Perhaps, this will even move more organisations to add a centralized risk function to the three lines, as indicated by Mabwe et al (2017), which demonstrates a lack of confidence in three lines approaches for coordinating and controlling risk management.…”

“…Main literature research findings on first line risk ownership and second and third line support. 1 Generic Author:Eulerich (2021). Not explicitly stated.…”