Statements of Position: Three Lines Model and the Role of the Internal Audit Function in ERM
The Institute of Internal Auditors has published two updated Statements of Position that provide guidance on governance, assurance and Enterprise Risk Management.
The Statements cover:
The Three Lines Model
This Statement explains how the three lines work together to support effective governance. It describes how assurance and advisory activities contribute to board oversight, management decision-making and organisational objectives, while highlighting the coordinating role of the Chief Audit Executive.
The Role of the Internal Audit Function in Enterprise Risk Management
This Statement clarifies the role of the internal audit function within Enterprise Risk Management (ERM). It explains how internal audit can contribute to ERM activities while maintaining its independence and avoiding management responsibilities. The publication also outlines the safeguards that should be in place when internal audit performs ERM-related activities.
Together, these Statements present an updated governance framework that reflects current organisational structures, changing risk environments and different levels of organisational maturity.
They replace the previous Position Papers published in 2024 and 2009 and include updated visual models illustrating their concepts.
The publications are intended for Chief Audit Executives, internal auditors, board members, audit committees and other professionals involved in governance, risk management and assurance.
Explore the updated Statements of Position on the Three Lines Model and the Role of the Internal Audit Function in Enterprise Risk Management. The publications provide guidance for Chief Audit Executives, internal auditors, boards and governance professionals.