Univerzitet Vitez , Travnik , Bosnia and Herzegovina
University of Sarajevo , Sarajevo , Bosnia and Herzegovina
The Three Lines of Defense Model represents one of the most important contemporary frameworks for risk management, internal controls and corporate governance. Developed by the Institute of Internal Auditors (IIA), the model was first formalized in 2013 and then significantly improved in 2020 to respond to the growing complexity of the business environment and the need for an integrated approach to value management (IIA, 2020).
The fundamental purpose of the model is to clearly define responsibilities and relationships between key functions within an organization. The model distinguishes three basic lines: the first line (operational management), the second line (supervision and support functions) and the third line (internal audit). Each of these lines has a specific role, but their effectiveness depends on mutual cooperation, communication and coordination. The first line is responsible for risk management and the implementation of controls in everyday business operations. The second line supports, monitors and oversees the effectiveness of controls, while the third line – internal audit – provides independent and objective assurance on the functioning of the entire system. The updated 2020 model emphasizes the transition from a “defensive” approach to the concept of creating and preserving value.
In conclusion, the three lines of defense model represents an integrated framework that connects management, control and audit into a single system. Its value lies in its clear accountability structure, but also in its ability to adapt to different organizational and institutional contexts.
Authors retain copyright. This work is licensed under a Creative Commons Attribution 4.0 International License. 
The statements, opinions and data contained in the journal are solely those of the individual authors and contributors and not of the publisher and the editor(s). We stay neutral with regard to jurisdictional claims in published maps and institutional affiliations.
