IIA Three Lines Model
The IIA Three Lines Model distinguishes operational management, specialist risk-related support and challenge, and independent internal-audit assurance and advice. The governing body oversees direction and accountability. The 2026 model emphasises coordination while preserving responsibilities and objectivity; internal audit does not assume management decisions. External financial-statement audit and regulatory inspections sit outside the three lines in this framework. Organisational arrangements should reflect the roles being performed rather than job titles alone.
Worked example
Operations manages a process, a risk specialist challenges its exposure and internal audit independently evaluates effectiveness. The board receives coordinated information while each role retains its responsibility.
Common mistake
Do not automatically classify every back-office function as second line or rename external audit as a third-line function. Keep the IIA model distinct from the separate four-lines framework.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | SBL | Supporting | September 2026–June 2027 |