The three lines model applied to an Australian SMB

What the three lines model says

The three lines model separates the people who own and manage risk day to day from the people who oversee it and from the people who provide independent assurance about both. First line owns and operates the controls. Second line sets the framework, advises and challenges. Third line gives the governing body independent assurance.

The separation exists to solve one problem: a person cannot credibly assure their own work. Every design decision in the model follows from that.

The model was published by the Institute of Internal Auditors and updated in 2020 as the IIA's Three Lines Model, replacing the earlier "three lines of defence" framing. Australian usage still commonly says "three lines of defence", and the two phrases refer to the same structure.

Why the 2020 update matters

The 2020 update changed three things that matter for a small business.

It reframed the lines as roles, not departments. The earlier framing invited organisations to conclude they could not apply the model without three separate teams. The updated model describes roles that can be held by different people in a small entity, and the roles are what the structure requires.

It put the governing body inside the model. The board is not an audience sitting outside three boxes. It is accountable for oversight, for establishing structures, and for ensuring assurance is independent. That is the point at which the model connects to directors' duties.

It emphasised alignment over defensiveness. "Defence" framed compliance as protection against management. The update frames the lines as collaborating toward objectives while preserving independence where it counts.

Mapping the lines onto a forty-person business

In a business of forty people there is no compliance department, and building one is not the answer. The roles map like this:

The practical constraint is that in a small business one person often holds two roles. That is workable. What is not workable is the same person operating a control, monitoring it, and assuring it. When roles must be combined, combine governing body with second line, or first line with second line in *different* domains — the payroll manager can hold second-line oversight of safety, and the operations manager can hold second-line oversight of payroll.

Keeping second line independent without hiring one

Independence in an SMB is achieved through reporting lines and mechanics rather than headcount:

• Reporting line. Whoever holds the second-line role reports compliance matters directly to the board or to the owner-directors, not through the executive whose area is being monitored.
• Domain swap. As above, assign second-line oversight of a domain to someone who does not operate in it.
• Documented challenge. Record the challenge, not just the conclusion. A monitoring result reading "tested, satisfactory" is weaker than one recording the sample tested, the exception found, the management response and the follow-up date.
• No self-assessment as the only evidence. First-line self-assessment is a legitimate input. It is not assurance.
• Escalation right. The second-line role must be able to put an item on the board agenda without executive filtering. Write that into the policy and record it in the board charter.

The director duties tool sets out the general duties directors carry when receiving that reporting, and directors' duties under section 180 and the business judgment rule covers the standard of care applied.

Third line options with no internal audit function

Independent assurance does not require an internal audit department. In order of cost:

1. Regime-mandated independent evaluation. Some regimes require it and pay for itself in coverage. Reporting entities under the anti-money laundering regime must have their program independently evaluated at least once every three years under the reformed rules, with staggered first-evaluation deadlines set by the Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 (checked August 2026); see AUSTRAC's guidance on independent evaluation and the AML/CTF program Part A and Part B explainer.
2. Certification and surveillance audits. Where the business already holds a certification — quality, information security, sector accreditation — the surveillance audit provides independent assurance over the certified scope. The ISO 27001 gap assessment scopes that pathway for information security.
3. Targeted external review. A scoped engagement over one or two high-residual-risk domains each year, rotating coverage. Cheaper than a standing function and adequate for most SMBs.
4. Peer review across group entities. Where a group has multiple operating entities, staff from one review the controls of another.
5. External audit observations. Management letter points from the statutory audit are assurance output and should be tracked in the issues log, not filed.

Whatever the source, the defining feature is that the report goes to the governing body, not to the manager of the area reviewed.

Where Australian regulators expect the lines to show

The model is not itself law in Australia, but several regimes assume its architecture:

• Prudential standards. APRA's framework distinguishes business-line risk ownership, an independent risk management function, and internal audit. CPS 230 operational risk management commenced 1 July 2025 and requires clearly defined roles and responsibilities for operational risk, plus independent review — see APRA's CPS 230 standard page.
• Accountability regimes. The Financial Accountability Regime allocates accountability to named individuals, which forces an explicit statement of who owns which line.
• Financial services licensing. The section 912A general obligations require adequate risk management systems and adequate resources, which regulators read as including oversight distinct from the business line.
• Anti-money laundering. The compliance officer role and the independent evaluation requirement create second and third lines by statute; see the AML/CTF compliance officer role.
• Work health and safety. Officers carry a due diligence duty that cannot be discharged solely by management assurances, which is a third-line argument in substance.

Evidence that the model is real, not a diagram

An auditor testing whether the model operates looks for artefacts, not organisation charts:

The single strongest piece of evidence is a documented disagreement — second line raising an issue that first line initially disputed, resolved and recorded. It demonstrates the challenge function operates. A program with no recorded disagreements in two years is usually a program where challenge is not happening.