Using three lines of defense to manage internal controls

By Ken Tysiac

Establishing just who is responsible for specific internal controls can be a challenge at many organizations.

Effective internal controls help organizations manage risks in a systematic, effective way. The internal control framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) helps many organizations manage risks. But the framework does little to establish who is responsible for the specific duties it describes.

A new COSO white paper released Tuesday, Leveraging COSO Across the Three Lines of Defense, describes how organizations can better establish and coordinate duties related to risk and control. The AICPA is a member of COSO.

Coordination under this model can help minimize gaps in controls and eliminate unnecessary duplication of assigned duties. The model proposes that senior management and the board oversee and direct three separate groups (or lines of defense) that contribute to effective management of risk and control. These separate groups:

  • Own and manage risk and control (operating management).
  • Monitor risk and control in support of management (risk, control, and compliance functions put in place by management).
  • Provide independent assurance about effectiveness of risk management and control to the board and senior management (internal audit).

A recent global survey of internal auditors found that 56% of organizations use this model and consider internal audit to be the third line of defense. But 20% of global respondents, including 43% in South Asia, were not familiar with the three-lines-of-defense model.

Under the model, each group has a distinct role within the organization’s governance framework:

  • Senior management and the board of directors have ultimate responsibility for making sure governance, risk management, and control processes are effective.
  • All three lines of defense should exist in some form at every organization.
  • Each group within the three lines of defense should have clearly defined roles and responsibilities.
  • Sharing information and coordinating activities among the lines of defense is necessary to improve efficiency, avoid duplication of work, and ensure that risks are addressed effectively.
  • Lines of defense should not be combined or coordinated in a manner that compromises their effectiveness.

Ken Tysiac ( is a JofA editorial director.


Year-end tax planning and what’s new for 2016

Practitioners need to consider several tax planning opportunities to review with their clients before the end of the year. This report offers strategies for individuals and businesses, as well as recent federal tax law changes affecting this year’s tax returns.


News quiz: Retirement planning, tax practice, and fraud risk

Recent reports focused on a survey that gauges the worries about retirement among CPA financial planners’ clients, a suit that affects tax practitioners, and a guide that offers advice on fraud risk. See how much you know with this short quiz.


Bolster your data defenses

As you weather the dog days of summer, it’s a good time to make sure your cybersecurity structure can stand up to the heat of external and internal threats. Here are six steps to help shore up your systems.