Template · Governance
Three Lines of Defence template
For separating the people who run the risks from the people who check them, and both from the people who assure the board. Leave it alone when the organisation is small enough that all three lines would be the same two people; keep the principle, drop the structure. Instead RACI, to keep doing and checking in separate hands when the three lines would be the same two people.
Download it
Nothing here asks for an email. The files are static and you can link straight to them.
What you may do with it
This sheet, meaning our drawing and layout of it, is released under Creative Commons Attribution 4.0 International. Use it commercially, put it in a client deck, print it for a workshop, adapt it. Keep the attribution line that is printed on the sheet and you have met the licence.
Originator: No single author; codified by the Institute of Internal Auditors. The framework itself is not ours to license, and the written entry behind this page, its worked example, critiques and sources, stays all rights reserved. The full licence position is set out in plain English.
Before you fill it in
A blank template is the easy part. The entry behind it covers how to run Three Lines of Defence properly, a worked example, the pitfalls real teams hit, and the situations where it is the wrong tool and something else would serve better.