{"id":70453,"date":"2026-09-03T18:38:38","date_gmt":"2026-09-03T16:38:38","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/"},"modified":"2026-09-17T14:47:36","modified_gmt":"2026-09-17T12:47:36","slug":"three-lines-one-picture-three-lines-model-iia-guidance","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/","title":{"rendered":"Three Lines, One Picture: What the New Three Lines Model Changes"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">On 8 July 2026, the IIA published two revised statements of position: one on the Three Lines Model, one on the role of internal audit in enterprise risk management. Both replace the previous position papers and shift the emphasis from rigid separation to coordination between the lines. For governance, risk and compliance leaders, the question is where the day to day boundary between management, the second line and internal audit actually changes.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>The revised IIA statements of 2026 do not shift responsibility away from the first line, which continues to own and manage risk. They do, however, require closer coordination and documented safeguards wherever internal audit takes on second line tasks or contributes to the five ERM activities of identifying, assessing, managing, monitoring and reporting, without making risk decisions itself.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-exactly-changes-on-8-july-2026\">What exactly changes on 8 July 2026?<\/a><\/li>\n<li><a href=\"#a2-where-does-the-new-boundary-between-mana\">Where does the new boundary between management and the second line run?<\/a><\/li>\n<li><a href=\"#a3-what-can-internal-audit-do-and-not-do-wi\">What can internal audit do, and not do, within the ERM cycle?<\/a><\/li>\n<li><a href=\"#a4-why-does-internal-audit-remain-the-integ\">Why does internal audit remain the integrator rather than one line among many?<\/a><\/li>\n<li><a href=\"#a5-is-the-new-erm-statement-binding\">Is the new ERM statement binding?<\/a><\/li>\n<li><a href=\"#a6-how-should-grc-leaders-proceed-now\">How should GRC leaders proceed now?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-what-exactly-changes-on-8-july-2026\">What exactly changes on 8 July 2026?<\/h2>\n<p>On that date, the IIA published two new statements of position that replace the previous position papers on the Three Lines Model and on the role of internal audit in enterprise risk management.<\/p>\n<p>The revised Three Lines Model is addressed primarily to the board and emphasises the accountability of every organisational role for its own distinct contribution to governance and risk management. As a modernised framework, it is meant to remain flexible enough to apply to organisations with different structures, risk environments and levels of maturity, as the IIA sets out in its statements of position.<\/p>\n<p>At the same time, the statement reaffirms that appropriate safeguards must be in place for the Chief Audit Executive whenever that role takes on second line tasks. These safeguards are meant to protect the independence of internal audit and the objectivity of auditors.<\/p>\n<h2 id=\"a2-where-does-the-new-boundary-between-mana\">Where does the new boundary between management and the second line run?<\/h2>\n<p>The first line remains the owner of risk: management owns and manages risk and is accountable for it, as stated in the official PDF of the statement.<\/p>\n<p>The body text itself does not give a final definition of the second line, but the published section headings on implementation scenarios point to more flexibility than earlier versions allowed. The statement acknowledges that roles across the three lines can overlap in practice, and it offers guidance on managing such arrangements rather than ruling them out on principle.<\/p>\n<p>Organisations that allow such overlaps should document the allocation of responsibilities in a way that makes gaps between assigned and actually exercised responsibility visible, an idea that aligns with using governance lag as a metric for the risk register.<\/p>\n<ul>\n<li>Transparent and documented allocation of responsibilities<\/li>\n<li>Independent review of activities that carry self-review or oversight risk<\/li>\n<li>Explicit board approval of expanded mandates<\/li>\n<li>Timely communication of actual or perceived threats to objectivity<\/li>\n<\/ul>\n<figure class=\"rc-shot\"><img src=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Kontrollbeurteilung-1024x647-1.png\" alt=\"Dashboard for Assessing the Adequacy and Effectiveness of Controls\" loading=\"lazy\" decoding=\"async\"><figcaption>Dashboard for Assessing the Adequacy and Effectiveness of Controls<\/figcaption><\/figure>\n<h2 id=\"a3-what-can-internal-audit-do-and-not-do-wi\">What can internal audit do, and not do, within the ERM cycle?<\/h2>\n<p>The ERM statement describes enterprise risk management as a coordinated set of five activities, identifying, assessing, managing, monitoring and reporting, to which internal audit contributes through assurance and advice without taking on responsibility itself.<\/p>\n<p>A technical analysis by Symbiant notes that internal audit can provide advice or assurance on each of the five activities, but must not determine management&#8217;s approach, prioritise responses, implement controls, or take ownership of risk reporting. In practice, this dividing line decides whether an audit activity still counts as assurance or has effectively become management.<\/p>\n<p>According to the statement, other functions and roles also support the organisation&#8217;s assurance and advisory efforts. This is consistent with the principle that risk management serves the achievement of objectives rather than existing for its own sake, which is why responsibility for risk decisions must stay with those accountable for the objective.<\/p>\n<h2 id=\"a4-why-does-internal-audit-remain-the-integ\">Why does internal audit remain the integrator rather than one line among many?<\/h2>\n<p>The model reaffirms internal audit&#8217;s role as the integrator of assurance, providing the board with a comprehensive, organisation-wide view, regardless of how many functions contribute to assurance.<\/p>\n<p>A technical article on Tandfonline notes that the core accountabilities are preserved in the 2026 statements, but coordination, reliance and integrated assurance receive markedly more weight than in the 2020 version. The renaming from Three Lines of Defense to Three Lines Model back in 2020 had already, according to Accounting Today, softened the purely defensive orientation and given more emphasis to seizing opportunity as part of risk-based decision making.<\/p>\n<h2 id=\"a5-is-the-new-erm-statement-binding\">Is the new ERM statement binding?<\/h2>\n<p>No: one commentator, writing on 16 July 2026, classifies the document as a position paper that reflects the IIA&#8217;s view but does not constitute a binding requirement.<\/p>\n<p>For governance, risk and compliance functions, this means the statements offer orientation for clarifying their own roles but do not trigger any certification obligation. Organisations revising the boundaries between the three lines should nonetheless measure their own governance model against the safeguards described, because doing so makes independence easier to verify.<\/p>\n<h2 id=\"a6-how-should-grc-leaders-proceed-now\">How should GRC leaders proceed now?<\/h2>\n<p>The first step is to take stock of which second line tasks internal audit already performs in practice today, and whether the safeguards named in the statement are documented for them.<\/p>\n<p>This stocktaking should be carried out by the head of internal audit together with the Chief Risk Officer or the compliance officer, and reported to the board before any new mandates are assigned. Where roles already overlap, it is worth examining new interfaces, for instance where additional audit and advisory tasks arise, a question that also comes up when considering whether AI governance is merging with GRC or remaining a separate silo.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Document role clarification in a traceable way<\/h3>\n<p>The Internal Audit solution maps the audit plan and findings. It records responsibilities and safeguards between the lines in a way that stays traceable.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/internal-audit-software\/\">Internal Audit <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Check which second line tasks internal audit currently performs, and document the safeguards required for them.<\/li>\n<li>Keep internal audit&#8217;s contributions to the five ERM activities clearly separated from management responsibility.<\/li>\n<li>Obtain explicit board approval for any expanded mandate of the Chief Audit Executive.<\/li>\n<li>Use the new statements as orientation, not as a binding requirement, when clarifying your own roles.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Who remains responsible for risk under the revised Three Lines Model?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The first line, meaning management, remains the owner of risk and stays accountable for it. The revised Three Lines Model does not change this, but it does require closer coordination and documented safeguards whenever internal audit takes on second line tasks.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What safeguards does the IIA require when internal audit takes on second line tasks?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The statement names four safeguards: transparent and documented allocation of responsibilities, independent review of activities that carry self-review or oversight risk, explicit board approval of expanded mandates, and timely communication of actual or perceived threats to objectivity, so that independence and auditor objectivity are preserved.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Can internal audit make risk decisions within the ERM cycle?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>No. Internal audit can contribute assurance and advice to all five ERM activities, identifying, assessing, managing, monitoring and reporting. It must not determine management&#039;s approach, prioritise responses, implement controls, or take ownership of risk reporting.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What role does internal audit keep relative to other assurance functions?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Internal audit remains the integrator of assurance and provides the board with a comprehensive, organisation-wide view, regardless of how many other functions contribute to assurance. This role sets it apart from the other lines, even though coordination and reliance carry markedly more weight in the revised model than before.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Are organisations required to implement the revised IIA statements?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>No, the statements are position papers that reflect the IIA&#039;s view but are not binding and do not trigger any certification obligation. GRC leaders can use them as orientation for clarifying their own roles and measure their governance model against the safeguards described, without this creating any compliance obligation.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.theiia.org\/en\/resources\/statements-of-position\/\" target=\"_blank\" rel=\"noopener nofollow\">Statements of Position for Internal Auditing<\/a><span class=\"rc-source-pub\">IIA<\/span><\/li>\n<li><a href=\"https:\/\/normanmarks.wordpress.com\/2026\/07\/16\/internal-audit-and-risk-management-3\/\" target=\"_blank\" rel=\"noopener nofollow\">Internal audit and risk management<\/a><span class=\"rc-source-pub\">Norman Marks on Governance, Risk Management, and Internal Audit<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The revised IIA statements of 2026 do not shift responsibility away from the first line, which continues to own and manage risk. They do, however, require closer coordination and documented safeguards wherever internal audit takes on second line tasks or contributes to the five ERM activities of identifying, assessing, managing, monitoring and reporting, without making risk decisions itself.<\/p>\n","protected":false},"author":5,"featured_media":70469,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Rajeev Dutt","real_author_title":"Managing Director MEA & APAC","real_author_bio":"Builds the presence of Swiss GRC in Dubai and across the markets of the Middle East, Africa and Asia, seeing first-hand how differently local regulators interpret governance and compliance. This cross-jurisdictional perspective shapes his view of international markets.","real_author_photo":54679,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[177,178,179,180,181],"class_list":["post-70453","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-iia-statements-of-position","tag-enterprise-risk-management","tag-chief-audit-executive","tag-second-line-internal-audit","tag-governance-risk-compliance"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"The IIA statements of 2026 shift the Three Lines Model&#039;s focus from separation to coordination between management, the second line and internal audit.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Three Lines Model 2026: What Actually Changes for GRC\" \/>\n\t\t<meta property=\"og:description\" content=\"The IIA statements of 2026 shift the Three Lines Model&#039;s focus from separation to coordination between management, the second line and internal audit.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1450\" \/>\n\t\t<meta property=\"og:image:height\" content=\"776\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-03T16:38:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T12:47:36+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Three Lines Model 2026: What Actually Changes for GRC\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The IIA statements of 2026 shift the Three Lines Model&#039;s focus from separation to coordination between management, the second line and internal audit.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#blogposting\",\"name\":\"Three Lines Model 2026: What Actually Changes for GRC\",\"headline\":\"Three Lines, One Picture: What the New Three Lines Model Changes\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/three-lines-one-picture_2.png\",\"width\":1450,\"height\":776,\"caption\":\"Three Lines. One View. How GRC comes together in one platform.\"},\"datePublished\":\"2026-09-03T18:38:38+02:00\",\"dateModified\":\"2026-09-17T14:47:36+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, IIA Statements of Position, Enterprise Risk Management, Chief Audit Executive, second line internal audit, Governance Risk Compliance\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#listItem\",\"name\":\"Three Lines, One Picture: What the New Three Lines Model Changes\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#listItem\",\"position\":3,\"name\":\"Three Lines, One Picture: What the New Three Lines Model Changes\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/\",\"name\":\"Three Lines Model 2026: What Actually Changes for GRC\",\"description\":\"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/three-lines-one-picture_2.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#mainImage\",\"width\":1450,\"height\":776,\"caption\":\"Three Lines. One View. How GRC comes together in one platform.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/three-lines-one-picture-three-lines-model-iia-guidance\\\/#mainImage\"},\"datePublished\":\"2026-09-03T18:38:38+02:00\",\"dateModified\":\"2026-09-17T14:47:36+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Three Lines Model 2026: What Actually Changes for GRC<\/title>\n\n","aioseo_head_json":{"title":"Three Lines Model 2026: What Actually Changes for GRC","description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","canonical_url":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#blogposting","name":"Three Lines Model 2026: What Actually Changes for GRC","headline":"Three Lines, One Picture: What the New Three Lines Model Changes","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png","width":1450,"height":776,"caption":"Three Lines. One View. How GRC comes together in one platform."},"datePublished":"2026-09-03T18:38:38+02:00","dateModified":"2026-09-17T14:47:36+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#webpage"},"articleSection":"Regulation &amp; Supervision, IIA Statements of Position, Enterprise Risk Management, Chief Audit Executive, second line internal audit, Governance Risk Compliance"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#listItem","name":"Three Lines, One Picture: What the New Three Lines Model Changes"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#listItem","position":3,"name":"Three Lines, One Picture: What the New Three Lines Model Changes","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#webpage","url":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/","name":"Three Lines Model 2026: What Actually Changes for GRC","description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png","@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#mainImage","width":1450,"height":776,"caption":"Three Lines. One View. How GRC comes together in one platform."},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/#mainImage"},"datePublished":"2026-09-03T18:38:38+02:00","dateModified":"2026-09-17T14:47:36+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Three Lines Model 2026: What Actually Changes for GRC","og:description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","og:url":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png","og:image:width":1450,"og:image:height":776,"article:published_time":"2026-09-03T16:38:38+00:00","article:modified_time":"2026-09-17T12:47:36+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Three Lines Model 2026: What Actually Changes for GRC","twitter:description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/three-lines-one-picture_2.png","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70453","title":"Three Lines Model 2026: What Actually Changes for GRC","description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Three Lines Model 2026","score":0,"analysis":[]},"additional":[{"keyphrase":"IIA Statements of Position","score":0,"analysis":[]},{"keyphrase":"Enterprise Risk Management","score":0,"analysis":[]},{"keyphrase":"Chief Audit Executive","score":0,"analysis":[]},{"keyphrase":"second line internal audit","score":0,"analysis":[]},{"keyphrase":"Governance Risk Compliance","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Three Lines Model 2026: What Actually Changes for GRC","og_description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Three Lines Model 2026: What Actually Changes for GRC","twitter_description":"The IIA statements of 2026 shift the Three Lines Model's focus from separation to coordination between management, the second line and internal audit.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 12:48:13","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-03 18:38:38","updated":"2026-09-17 13:13:11","focus_keyword":"Three Lines Model 2026","additional_keywords":[{"word":"IIA Statements of Position","score":85,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Enterprise Risk Management","score":85,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Chief Audit Executive","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"second line internal audit","score":94,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Governance Risk Compliance","score":85,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tThree Lines, One Picture: What the New Three Lines Model Changes\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"Three Lines, One Picture: What the New Three Lines Model Changes","link":"https:\/\/swissgrc.com\/ar\/three-lines-one-picture-three-lines-model-iia-guidance\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70453","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70453"}],"version-history":[{"count":3,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70453\/revisions"}],"predecessor-version":[{"id":70459,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70453\/revisions\/70459"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70469"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70453"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70453"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}