Trust in the reliability of the banking system is crucial for its proper functioning. Consequently, effective and relevant internal governance and control arrangements are fundamental if banks and the banking system are to operate well and become trustworthy.
The three-lines-of-defence concept has been a well-known and well-used notion in the financial industry for many years and has over the years been promoted by the regulators. Despite this, the story of its emergence is opaque and there is no consensus on how the three-lines-of-defence concept entered the risk area. Some claims that the three-lines-of-defence model was developed around 2010 by the Federation of European Risk Management Associations (FERMA) together with the European Confederation of Institutes of Internal Auditing (ECIIA). But it is a fact that it was referred to by UK FSA already in 2003. There are also signs indicating that three-lines-of-defence model evolved as early as late 1990s. It is however a fact that the analysis made by regulators and various experts as an aftermath of the latest recession in 2008-2010 concluded that many bank failures were caused or at least aggravated by unclear risk governance and poor risk management. As a result the three-lines-of defence were “reintroduced” and promoted as the magic wand, supposedly solving the identified deficiencies in corporate governance and risk management practices.
In autumn 2011, EBA launched their first Guidelines on internal governance (GL44). EBA claimed that the guideline was consistent with the three-lines-of-defence model, but they didn’t define the model or the concept as such. EBA guidelines on internal governance has been reviewed and altered, first in 2017 (GL11) and secondly in 2021 (GL05), but there isn’t any concrete definition inserted. The guidelines focus mainly on the responsibilities of the management body and the second line of defence and set out detailed elements for these control functions. EBA is also declaring that the internal control functions must be independent of the business they control in line with the CRD.
The concept was initially developed and designed to help organisations clearly identify and define roles and responsibilities, provide best practice regarding prudent risk management and proper risk activities. A huge number of banks and other financial institutions have adopted a three-lines-of-defence approach, but it seems that many of them has executed such organisational change without a sufficient level of analysis and reflection and without the authorities actually requiring such an operational model. The expectations and demands from the FSAs have rather been for the banks to secure robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent division of responsibility, effective processes to manage risks it is or might be exposed to. But unfortunately the perception of the three-line-of-defence concept has developed into a compulsory organisational model rather than an idea or example of a prudent governance model.
So the provocative question to be asked is if the three lines of defence model has become an overrated metaphor and only provide a false sense of security?