By Alia Noor, FCMA, CGMA, MBA
UAE Registered Tax Agent | Associate Partner – Taxation & Compliance Advisory
Ahmad Alagbari Chartered Accountants
AUTHOR’S NOTE – AUGUST 2026
In 2020, I wrote about the transition from the traditional Three Lines of Defense to The IIA’s Three Lines Model. Six years later, the model has evolved again. This new article revisits the Spartan analogy in light of The Institute of Internal Auditors’ 2026 publication, Three Lines Model: Assurance and Advice in Support of Effective Governance.
The Spartan phalanx was powerful for a simple reason: every soldier knew where to stand.
Each warrior carried his own shield, but that shield also helped protect the soldier beside him. Strength came not from everyone performing the same role, but from discipline, coordination and an understanding that weakness in one position could expose the entire formation.
Modern organizations face a remarkably similar challenge.
The board, management, risk, compliance and internal audit may all contribute toward common organizational objectives. But when responsibilities overlap, accountability can become blurred. And when everyone assumes someone else is holding the shield, gaps appear.
That is why the evolution of the Three Lines Model matters.
From Defense to Governance
For years, organizations used the Three Lines of Defense to structure thinking around risk management and control.
In 2020, The Institute of Internal Auditors (IIA) introduced the Three Lines Model as an update to the familiar Three Lines of Defense, broadening the discussion around how organizational roles work together to support governance and risk management.
Now, the model has evolved again.
In July 2026, The IIA issued Three Lines Model: Assurance and Advice in Support of Effective Governance.
The model’s core structure remains unchanged, but the refresh clarifies how assurance and advisory capabilities across the Three Lines collectively support effective governance, risk management, compliance and control processes.
The Three Lines should therefore not be viewed simply as three fixed departments on an organizational chart.
They represent distinct but complementary roles that must coordinate without losing accountability.
The Board: Who Sets the Direction?
Effective governance starts with clarity at the top.
Boards set purpose, risk appetite and expectations, and oversee the pursuit of strategic objectives. The board and senior management establish accountability by defining roles and responsibilities.
But effective oversight requires more than dashboards filled with red, amber and green indicators.
Boards need reliable and balanced information on performance, risks and controls. They also need assurance and advice to understand whether the organization is functioning as intended.
Like a phalanx, an organization cannot maintain formation when the direction of travel is unclear.
Direction, risk appetite and accountability must move together.
First Line: Where Risk Meets Operations
The first line is management.
It owns and manages risks and is responsible for designing and operating processes and controls.
Its proximity to business activities gives the first line an important perspective. Risks, control weaknesses and performance pressures often become visible here first.
This is where accountability matters.
Establishing specialist functions does not change the fundamental responsibility of management to own and manage risk.
Second Line: Expertise, Support and Challenge
Second-line roles provide specialized expertise, support, monitoring and challenge to enhance risk management, compliance and control practices.
Depending on the organization, these roles may include risk management, compliance and other specialist functions.
Second-line roles complement the first line through specialist support, advice, challenge, monitoring and, where appropriate, targeted assurance.
That distinction matters.
Appointing a Chief Risk Officer does not remove first-line responsibility for managing risk. Specialist compliance roles likewise do not eliminate management accountability for operating effective compliance and control processes.
Without clarity, specialist functions can gradually be treated as risk owners while those actually making business decisions become spectators.
Third Line: Independence Is Its Strength
The third line is the internal audit function.
It provides independent and objective assurance on the effectiveness of governance, risk management, compliance and control processes, while also providing advisory insights without assuming management responsibility.
That distinction matters.
Internal audit should be able to ask difficult questions:
Are significant risks understood? Are controls actually working? Is management responding appropriately? Is the board receiving a reliable picture of what is really happening?
Independence is foundational to credible assurance.
“Independence should not be interpreted as isolation.”
— The Institute of Internal Auditors, Three Lines Model (2026)
Transparency, clarity of responsibilities and constructive engagement across roles remain essential.
The Phalanx Problem: Collaboration Without Confusion
This is where the Spartan analogy becomes particularly relevant.
The phalanx worked because warriors coordinated without abandoning their positions.
The same principle applies to the Three Lines.
Coordination should strengthen accountability, not dilute it.
The refreshed model recognizes assurance and advice as distinct but complementary. Both can be delivered across the Three Lines, although their nature, depth and safeguards differ depending on role, proximity to operations, expertise and independence.
Organizations also face two opposite dangers: duplication and gaps.
Several functions may repeatedly examine the same risk while another significant risk receives little attention.
Better coordination can reduce duplication, address gaps and provide the board with a more coherent and reliable view of risk and performance.
That becomes increasingly important as organizations confront interconnected risks involving artificial intelligence, cybersecurity, regulatory change, financial crime, third parties and geopolitical disruption.
The objective is not to create more lines. It is to make the existing lines work better together.
Three Questions Every Board Should Ask
Rather than simply asking whether an organization has Three Lines, boards should ask:
- Who owns and manages our most significant risks?
- Where are assurance activities overlapping—or where are important gaps emerging?
- Are we receiving reliable, balanced information and sufficiently independent assurance to challenge what we think we know?
The answers may reveal more about governance than an organizational chart ever will.
The Spartan Lesson
The evolution from the Three Lines of Defense to the Three Lines Model, and now its refreshed 2026 form, reflects a broader evolution in governance thinking.
Effective governance is not achieved simply by building more defensive walls.
It requires clear accountability, reliable assurance, well-positioned advice, independence and disciplined coordination.
The Spartan phalanx worked because every soldier understood his position. A shield out of place could expose the soldier beside him. Yet coordination never meant everyone performed the same role.
Organizations are no different.
The strongest organizations are not those with the most lines. They are those where every line understands its role, its accountability and how its contribution supports the whole.
So perhaps the question for boards is no longer:
Do we have Three Lines?
It is:
Can our Three Lines actually hold the line?
Disclaimer
This article is intended for general information and thought leadership purposes only. It reflects the author’s interpretation of The Institute of Internal Auditors’ Three Lines Model and should not be regarded as a substitute for The IIA’s official publications, professional standards, or professional advice tailored to a particular organization. Organizations should consider their governance structure, regulatory requirements, risk profile and specific circumstances when applying the model.
Leave a Reply