The obsession of three lines of defence

The three-lines-of-defence concept has been a well-known and well-used notion in the financial industry for many years and was initially designed to help organisations clearly identify and define roles and responsibilities and provide proper practice regarding prudent risk management and risk activities.

Unfortunately the perception of the three-lines-of-defence concept has developed into a view as a compulsory organisational model rather than an idea or example of a prudent governance model.

Instead of enabling an efficient and prudent risk management model, this perception has many times led to the creation of layers with strict formalistic borders, literal application and communicative bureaucracy that makes the risk processes complex and inefficient.

Risk control functions should not be strictly separated from the business and reactive, instead use opportunities to collaborate, interact and coordinate and become more advising towards the business organisation.

Does this mean that the underlying principles from three-lines-of-defence concept is wrong? No, but too often it is applied in a way that is not logic or appropriate.

Read the full article at my website, www.prudentbanking.se?

Also available in Swedish. ??