The Three Lines Model's Blind Spot: Unchallenged Strategic Decisions

The Three Lines Model: Effective for Controls, Blind to Strategy

The author critically examines the IIA's Three Lines Model, asserting that despite its merits in assuring controls and processes, it possesses a significant blind spot: the lack of structured, independent challenge to strategic decisions. Drawing on a 2025 study by Hunziker and Altendorfer, which analyzed 669 DACH companies, the article reveals that 41% of severe corporate crises (defined as a 25% share-price loss within a month) stem from strategic decision failures, compared to 19% from preventable internal failures that the model is designed to address. This data suggests that the model, while performing its intended function well, is focused on the minority of risks that lead to organizational downfall.

Distinguishing Preventable vs. Strategic Risk

The article clearly differentiates between two types of risk: preventable risk and strategic risk. Preventable risks are those where controls are expected to exist and either succeed or fail (e.g., unauthorized payments, skipped reconciliations). The Three Lines Model is adept at identifying and mitigating these procedural failures. Strategic risks, however, involve judgment calls made under uncertainty, often with incomplete information and pressure. These decisions, such as market entry, acquisitions, or customer concentration, are not inherently right or wrong at the moment they are made but become so as events unfold. The author emphasizes that assurance, as a discipline, has little to say about strategic risks because there's no defined standard to test against, making adversarial challenge to the reasoning a fundamentally different activity than control testing.

Why the Gap Remains Unfilled by Existing Lines

The article explores why none of the three lines, as currently defined, can effectively fill this strategic challenge gap:

• First Line: While the first line (management) challenges decisions continuously, this challenge is not independent, as those exercising it own the strategy and have an interest in its success.
• Second Line: The second line (risk management, compliance) offers specialized expertise and monitoring, but its challenge is advisory and can be overruled by management, to whom it typically reports. Its visibility often outweighs its authority in strategic matters.
• Third Line: Internal audit (the third line) possesses independence, but if it were to become a continuous, adversarial challenger of strategy, it would risk co-owning those decisions, thereby compromising its independence and the value of its assurance.

This structural limitation means the crucial function of challenging strategic decisions falls between the lines, leaving organizations vulnerable even when all controls are deemed effective. The author concludes by posing the critical question of where this essential function should ultimately reside within an organization's governance framework.