Three Lines Model
We support governance review with complaint committee records, risk owners and audit findings, while your organisation defines its roles and independent assurance.
Set by The Institute of Internal Auditors
What this is
The Three Lines Model is a governance framework from the Institute of Internal Auditors. It describes how a governing body, management and internal audit share accountability and assurance. It replaced the earlier name, three lines of defence, which this page’s address keeps so existing links work. It is guidance for organisations, not a technical certification software can confer.
What is built
- Complaints retains committee review context for serious cases.
- Risk management records owners, controls and mitigation decisions.
- Clinical audits retain findings and review evidence.
How the records support management and review roles
People who own work and risks can record decisions and actions. Those with oversight or review responsibilities can read what was assigned, which risks were recorded and what evidence informed a committee review. These records support a governance discussion. They do not establish organisational independence, board oversight or a separate internal audit function simply because several modules are available.
Role and evidence questions
- Who owns each risk, complaint or audit action, and who reviews them?
- Which role reviews the records independently of those who created them?
- Where do your governing body and internal audit receive their information?
Boundaries
Your organisation determines its roles, reporting lines and assurance arrangements. Software permissions and committee records do not by themselves implement the model. No complete Three Lines Model implementation or independent assurance service is claimed, and complaint committees are not presented as enterprise-wide committee software.
Official source: www.theiia.org
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No. Flow provides selected governance and review records. Independence, reporting relationships and the internal audit mandate are organisational arrangements that cannot be established by a module or permission setting.
-
That is for your organisation to define. People who own risks, complaints and audit actions record decisions and follow-up. People with oversight or review roles can read those records. Flow does not decide who holds which role.
-
The Institute of Internal Auditors now calls it the Three Lines Model. The address keeps the older name so existing links continue to work.
Not answered here? Contact the team
NXH Flow