Is the three lines of defence dead?

As someone who has spent the last 8 years in the non-financial services sector, I think one of the biggest change is to challenge the dominance of the 3LOD as a model for risk governance.

It is fine as a conceptual model but is very difficult to actually make work and I think it diverts from business ownership of risk as the distinction between Line 1 and Line 2 is artificial and arbitrary.

Part of the challenges for the profession, particularly in non-financial services, is the understanding of alternate options for risk management from Executives, Board and Audit Committee members who rely on advice from consultants or their experience as Auditors to inform how they think risk should work, rather than how it can work.

For the last few years, I have referred to myself as operating in line 1.5 (if I have to use 3LOD terminology), as I am trying to embed conscious risk-taking behaviour with risk techniques and tools as an enabler to decisions, not a ‘bolt-on’ or extra step. The role I aim to play is the objective confidant or advisor, as someone who is not so deep in the detail of the business and can bring a different perspective to the issue/challenge at hand.

Without this shift, we will remain the ‘handbrake to happiness’ or ‘business prevention unit’ as it is perceived that we are; at worst, seen as trying to stop the organisation from doing things or more likely just making it hard, leaving us as just a step in a process rather than a trusted adviser.