Legal and risk / Free editable template

Three lines of defence model template

The three lines model explains who owns risk, who oversees it and who gives independent assurance. This board draws the lines as three walls: operations own and manage risk, risk and compliance set policy and challenge, and internal audit checks how well the first two work. Example risks travel from the left and stop at the line that should catch them, and one fraud risk gets through all three.

This is a planning example, not legal advice. Check your own policies, advisers and the local rules that apply to you.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the three lines of defence model

View full-size preview ↗
Three lines of defence model example showing three lines with their roles and activities, risks stopping at the line that catches them, governing body, outside assurance and independence bars
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Name each line

    Write who sits in each line in your organisation. Small firms often combine roles, which is fine if it is clear.

  2. List their activities

    Add the main controls and activities for each line, such as reconciliations, compliance monitoring and audit testing.

  3. Test with real risks

    Draw a few real risks and decide which line should catch each one. Risks that get past all three need a separate plan.

Questions about this template

What do the independence bars show?

They show how independent each line is from the work it checks, rising from operations in the first line to internal audit in the third.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More Legal and risk templates →