# Three Lines, One Picture: What the New Three Lines Model Changes > Der Beitrag erklärt, was die am 8. Juli 2026 veröffentlichten IIA-Positionspapiere zum Three Lines Model und zur Rolle der Internen Revision im ERM ändern. Er richtet sich an GRC-Verantwortliche und zeigt, wo sich die Grenzen zwischen Management, zweiter Linie und Interner Revision verschieben. Anbieter ist Swiss GRC. - URL: https://swissgrc.com/en/three-lines-one-picture-three-lines-model-iia-guidance/ - Publisher: SwissGRC® - Published: 2026-09-03 - Last updated: 2026-09-17 ## Key facts - Das IIA veröffentlichte am 8. Juli 2026 zwei überarbeitete Statements of Position, eines zum Three Lines Model und eines zur Rolle der Internen Revision im Enterprise Risk Management. - Beide Papiere ersetzen die bisherigen Positionspapiere und verschieben den Schwerpunkt von strikter Trennung hin zu Koordination zwischen den Linien. - Die erste Linie bleibt Eigentümerin der Risiken: Das Management besitzt und steuert Risiken und ist dafür rechenschaftspflichtig. - Übernimmt der Chief Audit Executive Aufgaben der zweiten Linie, nennt das Papier vier Schutzmassnahmen: dokumentierte Zuordnung der Verantwortlichkeiten, unabhängige Prüfung von Tätigkeiten mit Selbstprüfungs- oder Aufsichtsrisiko, ausdrückliche Genehmigung durch das Aufsichtsgremium und zeitnahe Meldung tatsächlicher oder vermuteter Gefährdungen der Objektivität. - Die Interne Revision kann zu den fünf ERM-Aktivitäten Identifizieren, Bewerten, Steuern, Überwachen und Berichten Prüfung und Beratung beitragen, darf aber weder das Vorgehen des Managements bestimmen noch Massnahmen priorisieren oder Kontrollen umsetzen. - Die Statements sind laut einem Kommentator vom 16. Juli 2026 nicht verbindlich und lösen keine Zertifizierungspflicht aus. On 8 July 2026, the IIA published two revised statements of position: one on the Three Lines Model, one on the role of internal audit in enterprise risk management. Both replace the previous position papers and shift the emphasis from rigid separation to coordination between the lines. For governance, risk and compliance leaders, the question is where the day to day boundary between management, the second line and internal audit actually changes. In short The revised IIA statements of 2026 do not shift responsibility away from the first line, which continues to own and manage risk. They do, however, require closer coordination and documented safeguards wherever internal audit takes on second line tasks or contributes to the five ERM activities of identifying, assessing, managing, monitoring and reporting, without making risk decisions itself. ## What exactly changes on 8 July 2026? On that date, the IIA published two new statements of position that replace the previous position papers on the Three Lines Model and on the role of internal audit in enterprise risk management. The revised Three Lines Model is addressed primarily to the board and emphasises the accountability of every organisational role for its own distinct contribution to governance and risk management. As a modernised framework, it is meant to remain flexible enough to apply to organisations with different structures, risk environments and levels of maturity, as the IIA sets out in its statements of position. At the same time, the statement reaffirms that appropriate safeguards must be in place for the Chief Audit Executive whenever that role takes on second line tasks. These safeguards are meant to protect the independence of internal audit and the objectivity of auditors. ## Where does the new boundary between management and the second line run? The first line remains the owner of risk: management owns and manages risk and is accountable for it, as stated in the official PDF of the statement. The body text itself does not give a final definition of the second line, but the published section headings on implementation scenarios point to more flexibility than earlier versions allowed. The statement acknowledges that roles across the three lines can overlap in practice, and it offers guidance on managing such arrangements rather than ruling them out on principle. Organisations that allow such overlaps should document the allocation of responsibilities in a way that makes gaps between assigned and actually exercised responsibility visible, an idea that aligns with using governance lag as a metric for the risk register. - Transparent and documented allocation of responsibilities - Independent review of activities that carry self-review or oversight risk - Explicit board approval of expanded mandates - Timely communication of actual or perceived threats to objectivity ![Dashboard for Assessing the Adequacy and Effectiveness of Controls](https://swissgrc.com/en/wp-content/uploads/sites/2/2026/09/Kontrollbeurteilung-1024x647-1.png) Dashboard for Assessing the Adequacy and Effectiveness of Controls ## What can internal audit do, and not do, within the ERM cycle? The ERM statement describes enterprise risk management as a coordinated set of five activities, identifying, assessing, managing, monitoring and reporting, to which internal audit contributes through assurance and advice without taking on responsibility itself. A technical analysis by Symbiant notes that internal audit can provide advice or assurance on each of the five activities, but must not determine management’s approach, prioritise responses, implement controls, or take ownership of risk reporting. In practice, this dividing line decides whether an audit activity still counts as assurance or has effectively become management. According to the statement, other functions and roles also support the organisation’s assurance and advisory efforts. This is consistent with the principle that risk management serves the achievement of objectives rather than existing for its own sake, which is why responsibility for risk decisions must stay with those accountable for the objective. ## Why does internal audit remain the integrator rather than one line among many? The model reaffirms internal audit’s role as the integrator of assurance, providing the board with a comprehensive, organisation-wide view, regardless of how many functions contribute to assurance. A technical article on Tandfonline notes that the core accountabilities are preserved in the 2026 statements, but coordination, reliance and integrated assurance receive markedly more weight than in the 2020 version. The renaming from Three Lines of Defense to Three Lines Model back in 2020 had already, according to Accounting Today, softened the purely defensive orientation and given more emphasis to seizing opportunity as part of risk-based decision making. ## Is the new ERM statement binding? No: one commentator, writing on 16 July 2026, classifies the document as a position paper that reflects the IIA’s view but does not constitute a binding requirement. For governance, risk and compliance functions, this means the statements offer orientation for clarifying their own roles but do not trigger any certification obligation. Organisations revising the boundaries between the three lines should nonetheless measure their own governance model against the safeguards described, because doing so makes independence easier to verify. ## How should GRC leaders proceed now? The first step is to take stock of which second line tasks internal audit already performs in practice today, and whether the safeguards named in the statement are documented for them. This stocktaking should be carried out by the head of internal audit together with the Chief Risk Officer or the compliance officer, and reported to the board before any new mandates are assigned. Where roles already overlap, it is worth examining new interfaces, for instance where additional audit and advisory tasks arise, a question that also comes up when considering whether AI governance is merging with GRC or remaining a separate silo. Related ### Document role clarification in a traceable way The Internal Audit solution maps the audit plan and findings. It records responsibilities and safeguards between the lines in a way that stays traceable. [Internal Audit](https://swissgrc.com/en/internal-audit-software/) For practice ## Key points - Check which second line tasks internal audit currently performs, and document the safeguards required for them. - Keep internal audit’s contributions to the five ERM activities clearly separated from management responsibility. - Obtain explicit board approval for any expanded mandate of the Chief Audit Executive. - Use the new statements as orientation, not as a binding requirement, when clarifying your own roles. FAQ ## Frequently asked questions Who remains responsible for risk under the revised Three Lines Model? The first line, meaning management, remains the owner of risk and stays accountable for it. The revised Three Lines Model does not change this, but it does require closer coordination and documented safeguards whenever internal audit takes on second line tasks. What safeguards does the IIA require when internal audit takes on second line tasks? The statement names four safeguards: transparent and documented allocation of responsibilities, independent review of activities that carry self-review or oversight risk, explicit board approval of expanded mandates, and timely communication of actual or perceived threats to objectivity, so that independence and auditor objectivity are preserved. Can internal audit make risk decisions within the ERM cycle? No. Internal audit can contribute assurance and advice to all five ERM activities, identifying, assessing, managing, monitoring and reporting. It must not determine management's approach, prioritise responses, implement controls, or take ownership of risk reporting. What role does internal audit keep relative to other assurance functions? Internal audit remains the integrator of assurance and provides the board with a comprehensive, organisation-wide view, regardless of how many other functions contribute to assurance. This role sets it apart from the other lines, even though coordination and reliance carry markedly more weight in the revised model than before. Are organisations required to implement the revised IIA statements? No, the statements are position papers that reflect the IIA's view but are not binding and do not trigger any certification obligation. GRC leaders can use them as orientation for clarifying their own roles and measure their governance model against the safeguards described, without this creating any compliance obligation. Sources 1. [Statements of Position for Internal Auditing](https://www.theiia.org/en/resources/statements-of-position/)IIA 2. [Internal audit and risk management](https://normanmarks.wordpress.com/2026/07/16/internal-audit-and-risk-management-3/)Norman Marks on Governance, Risk Management, and Internal Audit ## Frequently asked questions ### Wer trägt im überarbeiteten Three Lines Model die Verantwortung für Risiken? Die erste Linie, also das Management, besitzt und steuert die Risiken und bleibt dafür rechenschaftspflichtig. Das überarbeitete Modell verlangt aber engere Koordination und dokumentierte Schutzmassnahmen, wenn die Interne Revision Aufgaben der zweiten Linie übernimmt. ### Welche Schutzmassnahmen gelten, wenn die Interne Revision Aufgaben der zweiten Linie übernimmt? Genannt werden eine transparente und dokumentierte Zuordnung der Verantwortlichkeiten, eine unabhängige Prüfung von Tätigkeiten mit Selbstprüfungs- oder Aufsichtsrisiko, die ausdrückliche Genehmigung erweiterter Mandate durch das Aufsichtsgremium und die zeitnahe Meldung tatsächlicher oder vermuteter Gefährdungen der Objektivität. ### Darf die Interne Revision im ERM-Zyklus Risikoentscheide treffen? Nein. Sie kann zu allen fünf ERM-Aktivitäten Prüfung und Beratung beitragen. Sie darf aber weder das Vorgehen des Managements festlegen noch Massnahmen priorisieren, Kontrollen umsetzen oder die Verantwortung für die Risikoberichterstattung übernehmen. ### Welche Rolle behält die Interne Revision gegenüber anderen Assurance-Funktionen? Sie bleibt die Integratorin der Assurance und liefert dem Aufsichtsgremium eine umfassende, organisationsweite Sicht, unabhängig davon, wie viele Funktionen zur Assurance beitragen. ### Sind die neuen IIA-Statements verbindlich? Nein. Laut einem Kommentator geben sie die Sicht des IIA wieder, sind aber keine verbindliche Vorgabe und lösen keine Zertifizierungspflicht aus. Sie dienen als Orientierung, um die eigenen Rollen zu klären.