Q. The IIA recently unveiled a modernized version of its widely adopted Three Lines Model. What’s your take on the final product?
A. This was a labor of love on the part of the IIA. The original Three Lines of Defense Model was developed a couple of decades ago. I’m not sure anyone can really pinpoint precisely when and where the first version of it was published, but, regardless, over time it took on an iconic status as a reference model for people trying to understand roles and responsibilities in risk management and controls and governance. Over the years, the IIA began to recognize how useful it was in illustrating the importance of internal audit’s role in these areas. So, we ended up putting our own endorsement on it in the early 2000s. It was not the IIA’s model, but we wanted to make sure people understood the model better, and we wanted to provide some perspective on it.
I’m very proud of the work that the task force did. This was the work of a group of very talented and dedicated IIA leaders, volunteers, and staff.
Q. What was the impetus behind changing the old model? Were there particular criticisms? If so, how does the new model reconcile those…
