Skip to content
Dictionary by pitch.dog
Enterprise risk & controls · Core

Three lines model

Also called: three lines of defence, three lines of defense

ELI5

A governance model distinguishing management, risk oversight and independent assurance roles.

Used in conversation

“Add three lines model to the risk register with an owner and mitigation.”

Pitch context

You will see “Three lines model” in board papers, contracts, policies, risk registers and compliance reports when the discussion reaches enterprise risk & controls.

Why it matters: In enterprise risk & controls, a loose definition can change rights, obligations, approval, disclosure or enforceability.

Caution

Meaning, enforceability and required process vary by jurisdiction and agreement; this definition is not legal advice.

When the words have to travel

Need an investor or company deck?

Bring the business, the evidence or the half-formed ask. We help it travel beyond the spreadsheet.

See how pitch.dog can help
Sources & evidence · 3

Direct term-level sources and supporting source families.