CAE Club: Reflections on the Revised Three Lines Model

At our fifth CAE Club meeting of the year, we explored The Institute of Internal Auditors’ (IIA) new Statement of Position on the revised Three Lines Model. The discussion brought together audit leaders to consider how the model can support effective governance in an increasingly complex environmen

We were pleased to welcome Nicolas Denewet, Deputy Head of Audit at the National Bank of Belgium (NBB) and a member of the IIA Global Guidance Council. Nicolas was joined for the panel discussion by Birgit Ceulemans, CAE at Argenta, and Sarah Van Peperstraete, CAE at SD Worx.

Nicolas outlined the evolution of the IIA’s thinking on the Three Lines Model and the role of Statements of Position in communicating the IIA’s perspective on matters of importance to organisations and the internal audit profession. The revised Three Lines Model retains its core, principles-based structure while providing greater clarity on how assurance and advisory activities collectively support governance, risk management, compliance, and control.

A central message was that independence remains fundamental to credible assurance. This requires appropriate structures and safeguards to protect objectivity. However, independence must not become isolation. Effective governance also depends on constructive collaboration, coordination, and transparent communication across the three lines.

The revised Three Lines Model is underpinned by five principles:

1. Boards set organisational purpose, risk appetite, and expectations, and oversee the pursuit of strategic objectives.
2. Effective oversight relies on reliable and balanced information on performance, risks, and controls.
3. The board and senior management establish accountability by defining clear roles and responsibilities.
4. Distinct assurance sources, including an independent source, provide confidence that governance, risk management, compliance, and control processes are operating as intended and support timely corrective action.
5. Advisory services complement assurance by offering insights, perspectives, and options that enable improvement and informed decision-making.

The panel discussion reinforced that the revised Three Lines Model succeeds through collaboration, coordination, and appropriate reliance among its participants. Clear roles and responsibilities are equally essential: each party must understand both its own contribution and the boundaries that preserve the objectivity of independent assurance.

Finally, the discussion emphasised that the revised Three Lines Model is not a theoretical blueprint to be applied uniformly. It is an adaptable framework that should be tailored to an organisation’s governance arrangements, industry, legal and regulatory context, risk profile, and maturity. The principles are broadly applicable; their practical implementation will necessarily differ from one organisation to another.

The session offered a valuable opportunity to exchange views with peers. As boards and audit committees consider the implications of the IIA’s new Statement of Position, the revised Three Lines Model is likely to feature prominently in governance discussions in the months ahead.