In the Three Lines of Defense model, what is the role of the external auditor?

• A. First line; implements controls
• B. Second line; provides risk management oversight
• C. Third line; provides independent assurance to stakeholders about governance, risk, and controls
• D. Fourth line; external certification body

Answer: (C)

Independent, objective assurance comes from outside the organization. In the Three Lines of Defense framework, the line closest to day-to-day risk is the first line, where management and operations implement and own controls. The second line comprises risk management and compliance functions that oversee risk and ensure policies are followed. The third line is internal audit, which provides independent assurance to governance about how effectively the first two lines are functioning. The external auditor fits this idea of independent assurance too, because they operate outside the organization and report to external stakeholders, offering assurance about governance, risk management, and the control environment. The other descriptions describe the internal roles or external certification in ways that don’t fit the standard third-line assurance function.