The Institute of Internal Auditors (IIA) published “the Three Lines of Defense in Effective Risk Management and Control” in 2013. The “3LOD” model was successful – likely beyond the IIA’s wildest dreams – and has been adopted by countless organizations worldwide. It attracted its share of commentary and detractors as well. The IIA is working to refresh the position paper, as evidenced by publication of an exposure draft in June 2019. Unfortunately, the exposure draft missed the mark in several areas. Here are five suggestions to improve the 3LOD position paper, as well as to improve risk management and governance at organizations that adopt this model.

Read More