Three Lines of Defence Explained
Wayne's first line is the CTO's inbox, its second line is one person, and its third line doesn't exist.
@18xBan · GRC Series · Chapter 08
3 lines, drawn honestly.2 of them are the same person, and one is empty.
Friday, 9:10 AM: "Who reviews you?"
Gotham Mutual's analyst sends the 3 questionnaire items she couldn't close on Thursday. 2 are easy. The third isn't:
Is your information security programme reviewed independently of the people who operate it? Please describe the function, its reporting line, and the date of the most recent review.
You start typing an answer about the leaver test you ran and signed. Then you stop, because you can see what it says. You wrote the rule. You ran the test. You wrote up the result. The only person who checked any of it is you.
Dan reads the question over your shoulder.
"So the answer is 'me'," you say.
"Which means the answer is 'nobody'," he says.
Forty minutes later it gets worse, in the most useful way possible.
The one question on the questionnaire you can't answer with a document.
9:50 AM: the number that was wrong
On Wednesday you sent Dan an MFA coverage figure for the board pack: 62%, up from 30% at the start of the year.
On Friday morning Priya is building an alert for accounts without MFA, and she reruns the count herself. She gets 54%.
Her message: are we counting the same people?
You weren't. Your query counted enabled users in the Staff OU. Hers counted every enabled human account in the domain.
# Wednesday's number
$enrolled = (Get-ADGroupMember "MFA-Enrolled").Count
$staff = (Get-ADUser -SearchBase "OU=Staff,DC=wayne,DC=example" -Filter 'Enabled -eq $true').Count
"{0} / {1} = {2:P0}" -f $enrolled, $staff, ($enrolled / $staff)
118 / 190 = 62%
Sample output (illustrative). Wayne Industries is fictional.
# Friday's number: every enabled account that belongs to a person
$people = Get-ADUser -Filter 'Enabled -eq $true' |
Where-Object { $_.DistinguishedName -notlike "*OU=ServiceAccounts*" }
"{0} / {1} = {2:P0}" -f $enrolled, $people.Count, ($enrolled / $people.Count)
$people | Group-Object { ($_.DistinguishedName -split ',')[1] } |
Select-Object Count, Name | Sort-Object Count -Descending
118 / 219 = 54%
Count Name
----- ----
190 OU=Staff
14 CN=Users
12 OU=Contractors
3 OU=Admins
Sample output (illustrative). Wayne Industries is fictional.
The gap isn't a rounding error. It's 29 people: contractors, 3 admin accounts, and 14 accounts still sitting in the default Users container because nobody ever moved them into an OU.
Those 29 are exactly the accounts an attacker would want. Your number excluded them because the query was written by the person whose number it was.
Nobody did anything dishonest. That's the point. The error survived because there was no second pair of eyes between the query and the board pack.
Same control, two people, two answers.
What the number counts, and what it quietly left out.
The unpopular truth: self-review failures almost never look like fraud. They look like a query written in a hurry by someone who already knows what the answer should be.
What the three lines actually are
The model most people half-remember is the Three Lines of Defence. The Institute of Internal Auditors published it in 2013 and replaced it in July 2020 with the Three Lines Model. The IIA dropped the word "defence" on purpose, because the model is about creating and protecting value, not about holding a wall.
Here's the shape of it, in plain terms:
The governing body. The board, or whoever plays that role. Accountable to stakeholders for oversight. Sets the tone, provides resources, and establishes an independent internal audit function.
Management: first line roles. The people who deliver the product and run the systems, and who own and operate the controls that go with them.
Management: second line roles. People who provide expertise, set the rules, monitor, and challenge the first line. Security, risk, compliance, privacy.
Internal audit: third line roles. Independent, objective assurance and advice on whether governance and risk management actually work, reporting to the governing body.
External assurance providers. Certification bodies, SOC 2 auditors, penetration testers, regulators. They sit outside the model and can supplement it, not replace it.
The first and second lines both sit inside management, and the IIA expects them to blur in places. What must not blur is the third line's independence from management, because that's where its objectivity, authority and credibility come from.
Think of a restaurant. The kitchen cooks (first line). The head chef sets the recipes, checks the fridge temperatures and refuses dishes that aren't right (second line). The health inspector doesn't work for the chef (third line, roughly). If the chef inspects the chef, the sticker in the window means nothing.
Who does what, and who they answer to.
Wayne's lines, drawn honestly
| Line | Who at Wayne | What they actually do |
|---|---|---|
| Governing body | Maya (CEO). No board committee | Approves direction; hasn't received a security report yet |
| First line | Priya and the engineers; Farah for people processes | Build, run and operate the controls |
| Second line | You | Set the rules, run tests, challenge, report |
| Third line | — | Nothing. There is no independent review |
| External assurance | The certification body, once engaged | Not engaged yet, and not a substitute for the third line |
Two problems fall out of that table.
One: for some controls, you are the first line as well as the second. MFA is the clearest case. You own it, you operate it, and you report on it. That was flagged when the ownership list was built, and this week it produced an actual wrong number.
Two: there is no third line at all. So the honest answer to Gotham's question is: nobody reviews the security programme independently, and the last review was never.
First line, second line, and an empty chair where the third should be.
The unpopular truth: at 240 accounts and one security person, a real three-line structure is a fiction. What isn't a fiction is the rule underneath it: nobody marks their own homework on anything that leaves the building.
What the standards actually require
The frameworks don't ask for three departments. They ask for independence at specific moments.
ISO 27001 Clause 9.2 requires internal audits at planned intervals, and requires you to select auditors so the audit process is objective and impartial. Certification auditors read that as a simple test: you cannot audit your own work. The person who built the ISMS cannot audit it.
Annex A 5.35 asks for the approach to information security to be reviewed independently at planned intervals and when significant changes happen.
Two useful facts for small teams. Internal audit can be outsourced, and the standard doesn't require you to employ an auditor. But your certification body cannot perform your internal audit for you.
SOC 2 expects the board or its equivalent to exercise oversight independent of management, and expects evaluations that are separate from the operation of the controls.
PCI DSS v4.0.1 Requirement 12.4.2 is the bluntest of all. For service providers, reviews at least once every three months must be performed by personnel other than those who perform the task being reviewed.
That last one is worth copying even if PCI never applies to you. It's the whole idea in one sentence.
Buying independence when you're small
You have four options. Most small companies end up using three of them at once.
1. Swap the reviewer inside the company. The operator and the reviewer are different people, even if both sit in the same 12-person engineering group. Priya re-performs your numbers. You re-perform hers. It costs an hour a month.
2. Train someone genuinely uninvolved. Farah doesn't run any technical control, so she can review process controls offboarding, access requests, training records against a checklist, without judging the technology.
3. Outsource or co-source internal audit. A consultancy runs the ISO 27001 internal audit programme. It isn't cheap, but it's a fraction of a hire, and it produces the impartial report that Clause 9.2 wants.
4. Use external assurance as supplementary evidence. A penetration test and a certification audit are genuine independent evaluations. They are also narrow, and they work for someone other than your governing body. Count them, don't lean on them.
What all four have in common: the reviewer has to be able to say "this is wrong" without it costing them anything. That's what independence means in practice, and it's the thing an org chart can't prove.
Three ways to get a second pair of eyes when you can't hire one.
The artifact: an assurance map
The template here is the IIA's Three Lines Model paper.
The paper gives you the roles. What you build from it is an assurance map: one row per control area, showing who runs it, who challenges it, and who independently checks it. Auditors and boards use assurance maps to find two things areas nobody assures, and areas three people assure while nobody fixes anything.
Field by field
| Column | What goes in it |
|---|---|
| Control area | A group of controls that share operators, e.g. identity and access |
| First line | The person or team that operates the controls |
| Second line | Who sets the rule, monitors, and challenges |
| Third line / independent | Who checks it with no stake in the answer, and how often |
| External assurance | Any outside evaluation that covers this area, and its date |
| Independence gap | Where the same person appears in two columns, and what compensates |
Wayne before
| Control area | First line | Second line | Independent | Gap |
|---|---|---|---|---|
| Identity and access (MFA, admins) | You | You | None | Same person, both columns |
| Offboarding | You (removal) | You (test) | None | You test your own removals |
| Backups | Dev rotation | You | None | No independent check |
| Change and deploys | Priya | Nobody | None | No rule, no challenge |
| Vendors | Whoever signs | Nobody | None | Twelve vendors, no reviewer |
Wayne after
| Control area | First line | Second line | Independent | Gap |
|---|---|---|---|---|
| Identity and access | You (operate) | Dan reviews metrics | Priya re-performs the count monthly | You still operate; documented and accepted |
| Offboarding | Farah (trigger), you (removal) | You (monthly test) | Farah signs the test; outsourced audit yearly | Covered |
| Backups | Dev rotation | You | Priya picks the restore to test, not the operator | Covered |
| Change and deploys | Priya | You (merge approval rule) | Outsourced internal audit, yearly | Rule still being written |
| Vendors | Dan | You | Outsourced internal audit, yearly | Nothing reviewed yet |
One row per area. The interesting column is the one that used to be empty.
Two decisions came out of building it. Maya approved a budget for an outsourced ISO 27001 internal audit ahead of the certification work. And every metric that leaves Wayne board pack, questionnaire, customer report now gets re-performed by someone who didn't produce it, with both names on it.
The unpopular truth: your penetration test isn't your third line. It's one narrow evaluation, bought by the people it evaluates, covering a slice of your environment on one week of the year. Useful. Not assurance over your programme.
Evidence #8
By Friday afternoon, three things go in the evidence folder:
The assurance map, approved by Dan, with the independence gaps written down rather than hidden.
The corrected MFA figure: both queries, the defined population, the 29 accounts that were missing, and Priya's re-performance note.
A one-line correction to Dan, copying Maya: Wednesday's 62% counted the Staff OU only. The real figure is 54%. Here's the population we'll use from now on.
Evidence #8: a documented independence structure, and a metric that was corrected before anyone outside Wayne saw it.
The answer to Gotham goes out the same afternoon, and it's the honest version: no internal audit function today; peer re-performance in place now; an outsourced internal audit scheduled; here's the map.
She replies with one line: this is a better answer than most of the "yes" answers we get.
Two names on every number that leaves the building.
What an auditor accepts vs rejects
| Accepted | Rejected |
|---|---|
| A reviewer with no operational role in the control | The control owner signing their own test |
| A defined population, with exclusions justified | A number with no definition of what was counted |
| An internal audit plan with impartial auditors named | "The security lead audits everything" |
| An outsourced internal audit report | Your certification body doing your internal audit |
| Documented gaps with compensating measures | An org chart that claims independence that doesn't exist |
| A report that reaches the governing body | A report that stops at the person being reviewed |
| A pen test counted as one input | A pen test presented as the whole assurance programme |
What you actually do on Monday
Draw your real lines on one page. Names, not departments. Where one name appears twice, circle it.
List every number that leaves the company. Board packs, questionnaires, customer reports. Put a second name on each one.
Define the population for your top three metrics. Write down what's counted, what's excluded and why.
Pick your independence route for the coming year: swap reviewers, train someone uninvolved, or buy it.
Schedule one report to your governing body, even if your governing body is one person and the report is a page.
Write the gaps down. An honest gap with a plan beats a claim that falls apart in an interview.
Framework mapping
Independence, as each framework asks for it.
Maturity ladder
| Stage | 20 people | 200 people | 2,000 people |
|---|---|---|---|
| Governing body | Founder reads a one-page report quarterly | CEO plus an advisor or board member owns oversight | Board risk or audit committee, with a charter |
| First line | Everyone, informally | Named owners per control | Control owners with documented procedures |
| Second line | The one security person, part-time | A small security and compliance function | Separate risk, compliance and security teams |
| Third line | Peer re-performance, written down | Outsourced or co-sourced internal audit | In-house internal audit reporting to the committee |
| External | One pen test a year | Pen test plus certification audit | Multiple audits, coordinated through an assurance map |
At 20 people the third line is one rule: the person who ran it isn't the person who checks it. Write that down and you've got something an auditor can test.
Where Wayne sits: second line real, first line named, third line bought rather than built, as of Friday. The governing body role is Maya's, and she's about to receive the first report that was ever written for her.
Cheatsheet
Three lines, one rule: nobody marks their own homework.
The takeaway
Independence isn't a department. It's whether anyone with no stake in the answer looks before the answer leaves. Draw your lines with names. Where one name appears twice, write down what compensates. Every number that goes to a board or a customer needs a second person's name on it. Small teams can buy a third line. They cannot skip it and still say "reviewed."
⚠️ This content is for educational purposes only. Wayne Industries is a fictional company. Nothing here is legal, audit, or compliance advice, validate against your own auditor and jurisdiction.