Three lines model

The Three Lines Model, published by The Institute of Internal Auditors as an update of the earlier three lines of defence, describes how roles fit together under a governing body. First-line roles (the business and teams that build or use AI) own and manage risk. Second-line roles (risk management, compliance, privacy, information security, often an AI governance office) provide expertise, policies, monitoring and challenge. The third line, internal audit, gives independent and objective assurance to the board.

Applied to AI, the model clarifies who classifies a use case, who sets and checks controls, and who tests whether the whole system works. It prevents a common failure: data scientists marking their own homework, or an ethics committee that is expected to audit decisions it helped make. External assurance providers, such as certification bodies, sit outside the lines and report to the governing body. The model is a staple of the RAIL and AUDAI domains on enterprise risk and audit.

Example: a bank's model risk team validates a credit model built by the lending unit, and internal audit later reviews whether validations were performed as required.