Is the Three Lines of Defense Paradigm Dead?
By Clifford Rossi, Professor University of Maryland
The three lines of defense (3LoD) doctrine has been one of the major pillars of enterprise risk management at banks and regulators for more than a decade. But has it outlived its usefulness? If so, should it be revised or replaced?
Serious risk events of various types continue to occur with some regularity, so the effectiveness of 3LoD is highly questionable. Last year’s bank failures grabbed headlines, but, over the past decade, we’ve also seen risk fiascoes at Wells Fargo, Credit Suisse, Citigroup and even JP Morgan, among other high-profile banks.
Given the recurrence of risk failures in the banking system, it is logical to revisit the efficacy of the 3LoD model and ask if there are better ways to strengthen the way banks manage risk.
What’s Wrong with Three Lines of Defense?
The concept of 3LoD in banking surfaced as far back as 2003, when it was mentioned by the Financial Services Authority. But it really took off after the Institute of Internal Auditors fleshed out the idea more broadly in 2013. The IIA itself recommended an update to 3LoD as recently as 2019, but, at its core, it hasn't changed much.
[….]
