📖 What is Three Lines of Defense?

The Three Lines of Defense is a governance model that separates operational management, risk oversight, and independent assurance. The lines consist of business operations, the risk/compliance function, and internal audit.

🥋 Sensei Says:

"On the exam, remember that the Third Line (Audit) must remain completely independent from the first two lines."

📚 Certification: Certified Information Security Manager (CISM)

🔑 What are the Key Concepts of Three Lines of Defense?

  • The First Line consists of business operations and management who own the risks and are responsible for implementing internal controls to mitigate them.
  • The Second Line comprises risk management and compliance functions that establish policies, provide oversight, and monitor the effectiveness of first-line controls.
  • The Third Line is internal audit, providing independent and objective assurance to the board and senior management regarding the overall governance framework.
  • Independence is paramount for the Third Line; auditors must not be involved in designing or implementing the controls they are tasked with auditing.
  • Effective coordination between all three lines ensures that risks are identified, managed, and validated without gaps or redundant efforts across the organization.

🎯 How does Three Lines of Defense appear on the CISM Exam?

You may be asked to identify which group is responsible for the day-to-day execution of security controls. The correct answer will be the first line of defense.

A scenario might describe a conflict where the risk management team is performing an internal audit. You must recognize this as a violation of the third line's independence.

Expect questions regarding the reporting structure of the internal audit function, specifically their need to report to the board or audit committee to maintain objectivity.

❓ Frequently Asked Questions

Can the risk management team (Second Line) also perform internal audits?

No. While the second line monitors and oversees, the third line must remain independent. Having the second line audit itself creates a conflict of interest and undermines objective assurance.


Who is ultimately accountable for the risks identified in the first line?

The business process owners and operational managers are accountable. The second and third lines provide oversight and assurance, but they do not own the operational risk.

Related Terms from Certified Information Security Manager

📝 Related Study Guides

Study Guide 10 min read

CISM Exam Study Guide: Pass the Security Management Exam

The CISM exam consists of 150 multiple-choice questions to be completed in 4 hours, requiring a scaled score of 450/800 to pass. It focuses on four key domains: Governance, Risk Management, Program Development, and Incident Management, prioritizing a managerial perspective over technical implementation to certify security leadership expertise.

Exam Tips 8 min read

Risk Appetite vs Risk Tolerance: ISACA Concepts Explained

Risk appetite is the broad, strategic amount of risk an organization is willing to accept to achieve its goals, typically set by the board. Risk tolerance is the tactical, measurable variation around those goals. While appetite defines the general direction, tolerance sets the specific boundaries for operational deviations.

Deep Dive 8 min read

How to Conduct a Tabletop Exercise: CISM Study Guide

A tabletop exercise is a discussion-based simulation where key stakeholders walk through a hypothetical security incident to validate the Incident Response Plan (IRP). It identifies gaps in communication and processes without impacting production systems, making it a cost-effective, low-risk method for ensuring organizational readiness and meeting CISM governance requirements.

🧠

Test Your Knowledge

Think you understand Three Lines of Defense? Put it to the test with our practice exam.

Try 10 Free Questions

⭐ 1,000 expert-curated questions available with Premium

Upgrade Premium