Four lines of defence
The four-lines framework distinguishes routine controls, separate management review, internal audit and external audit. It helps assess complementary scrutiny and remaining gaps. Each contribution has different independence and scope; financial-statement audit does not automatically cover every operational risk.
Worked example
Purchasing staff operate approvals, management reviews exceptions, internal audit tests the process and external audit examines relevant financial-reporting risks.
Common mistake
Do not confuse this framework with the IIA Three Lines Model or assume more reviewers guarantee complete coverage.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | SBL | Direct | September 2026–June 2027 |