Three Lines and Resilience Assurance

The three lines model describes three kinds of work that together support governance. The first line operates controls and manages risk in day to day work. The second line challenges, oversees and supports risk management, often through a risk function. The third line provides independent assurance, often through internal audit, checking whether the first two lines are working as intended. Under DORA, that structure helps the management body trust, but also verify, what it is told about resilience.

No single line is sufficient on its own. Operations without challenge can become optimistic about their own controls. Challenge without independent assurance can become entangled in the work it oversees. Assurance without operational detail can become abstract. Governance works when the three lines are distinct, communicate clearly, and each produce material the board can use to judge whether resilience arrangements are real.

The first line owns the risks that arise from its work and the controls that manage them. In resilience terms, that includes operating systems securely, managing changes carefully, handling incidents, maintaining recovery arrangements, and managing provider relationships day to day. Business and technology teams in the first line are closest to the services, and they hold the practical knowledge about dependencies, failure modes and recovery steps.

That closeness is a strength and a limitation. First line teams know how a service actually behaves, which makes their risk assessments and test results valuable. At the same time, they have an interest in presenting their work positively, and they may underestimate risks in areas they manage. Governance should therefore treat first line reporting as essential evidence, not as final judgement. The board needs that evidence, and it also needs other lines to test it.

The second line adds challenge and oversight. A risk function in the second line reviews risk assessments, tests whether controls match the risks identified, monitors provider risk, and tracks whether findings are remediated. It should be close enough to understand the work, but separate enough to question it. That separation is the point: a second line that merely repeats first line conclusions adds paperwork without adding assurance.

Challenge from the second line can take many forms. It might question whether a risk assessment understated the impact of a provider failure, whether a test scenario was severe enough, or whether a remediation plan addresses the root cause rather than the symptom. Good challenge is specific and evidence based, and it is recorded so that the board can see where challenge changed a decision. Challenge that is only verbal, and never recorded, is difficult for the board to rely on later.

The third line, often internal audit, provides independent assurance to the management body. Independence means that assurance work is planned and performed without responsibility for the controls being checked, and that findings are reported without being softened by the teams whose work is reviewed. That independence allows the third line to ask uncomfortable questions, including whether the first and second lines are working together effectively.

Assurance work on resilience might examine the ICT risk management framework itself, the testing programme, incident handling, or provider oversight. Its value lies partly in its scope: assurance can follow a service across team boundaries and test whether the whole arrangement works, rather than whether each part looks sound alone. An assurance finding that a recovery plan had never been tested end to end, for example, can reveal a gap that component level checks had missed.

The three lines should share information while keeping their roles distinct. First line teams should provide honest, complete information to the second and third lines. Second line functions should share their challenge and monitoring results with the board and with assurance. Third line functions should share their plans and findings so that the board can see where assurance has been focused and where it has not.

The board uses three lines material to form a judgement, not to collect reassurance. First line reports show what was done. Second line challenge shows what was questioned. Third line assurance shows what was independently checked and what was found. Together they let the board see where views agree, where they differ, and where evidence is thin. Disagreement between lines is not a problem to hide. It is often the most useful governance signal, because it shows where further work or a decision is needed.