Modern business is dynamic and rapidly changing. In our current environment, it has become necessary for organizations to manage risk from an integrated, organizational lens – as opposed to being siphoned off to specialized departments that view each emerging risk as an isolated issue. Implementing an integrated and versatile approach to risk management, compliance, internal controls and other related processes is becoming increasingly essential in this dynamic and fast-paced world of business.
Each subsequent risk manager, auditor, compliance officer etc. has their own specific set of skills and experience to bring to the table and an integrated approach allows the organization to break apart siloed processes within departments and divisions of the organization to gain a better understanding of emerging risks and its full impact on the business. This integrated approach also assists in reducing gaps in internal controls and increasing efficiency within these processes.
The ThreeLines of Defense
The three lines of defense is a simple and straightforward model that is designed to assist in defining roles and the distribution of responsibility throughout the organization. It provides a streamlined task and responsibility flow that helps in ensuring the success of GRC initiatives throughout the organization.
The “three lines of defense”model highlights three different groups within the organization:
- Owners and managers of emerging risks
- Those that oversee emerging risks
- Internal audit in providing independent assurance
The three lines of defense refers to a model demonstrating the distribution of different functions of internal processes throughout the organization. From business operations to the back office of GRC professionals to audit and assurance, the three lines of defense demonstrates that each part of the business is divided into smaller functions.
FrontlineDefense
The first line of defense is designated to those who own emerging risks. This consists of operational managers that are responsible for the implementation and maintenance of internal controls and processes. These operational managers execute risk procedures on a daily basis and are tasked with finding and controlling deficiencies throughout the organization. These managers are also tasked with ensuring that performance is in alignment with the broader goals and objectives of the business.
A well-integrated GRC(governance, risk, & compliance) architecture will give the first line of defense an ability to keep its processes and procedures current and allows them the opportunity to better manage emerging threats, pinpoint vulnerabilities, monitor the performance of controls, and ensure consistency throughout the organization.
A well-established, integrated, and mature GRC architecture will also help streamline communication and consistency throughout all lines of defense in the organization and allow greater visibility throughout the entirety of the organization.
The first line of defense directs how processes and systems are developed and implemented to ensure that policies are in alignment with the organizations broader business objectives and goals. Controls are transformed into systems and policies under the guidance and direction of these operational managers, making it a natural fit as the first line of defense. This natural fit is also made more apparent when considering that a large portion of their role is assigning responsibility to the second-line defense i.e. back office GRC professionals within the organization.
