The Three Lines of Defence, Explained for Finance Teams
A newly appointed financial controller at an authorised firm is told in their first week that finance is “first line”. Nobody explains what that means, and asking feels like admitting to a gap that ought to have been filled years ago. Six months later the same person is cc’d on an internal audit report that criticises second-line coverage of a process they own, and still is not entirely sure which line anybody is talking about.
This is extremely common and not a sign of weakness. The three lines model is a governance framework from the risk and internal audit world; it is taught to compliance officers and auditors as a matter of course and to accountants almost never. Yet in a regulated firm it determines who tests your work, who you supply data to, and who answers for a control failure.
This is the explanation finance teams generally do not get.
The model in one paragraph
The three lines model separates the people who own and manage risk from the people who oversee it and the people who provide independent assurance. The first line runs the business and owns its controls. The second line sets the framework, advises and monitors whether the first line is doing what it should. The third line — internal audit — independently assures the governing body that the whole arrangement works, including the second line. The Institute of Internal Auditors updated the model in 2020, softening the original “lines of defence” language in favour of describing roles rather than a defensive wall, but the three-way separation is unchanged and remains how regulated firms are structured.
Where finance actually sits: all three, in different capacities
The reason “finance is first line” confuses people is that it is only a third of the answer. The finance function appears in all three lines in different roles, and conflating them is what causes the awkward conversations.
| Line | Finance’s role | Concrete example |
|---|---|---|
| First | Owner of its own processes and controls | Finance performs the client money reconciliation, prepares the regulatory return, operates the payment approval control. It owns whether these work. |
| Supporting the second | Data source and counterparty to monitoring | Compliance monitoring queries finance data to test customer outcomes, fees and redress; finance supplies the extracts and explains the figures. |
| Subject of the third | Auditee | Internal audit reviews the finance control framework and reports to the audit committee, independently of both finance and compliance. |
A fourth capacity is worth naming because it causes genuine confusion in smaller firms: in some firms finance also performs second-line-style oversight of parts of the business, for example reviewing commercial pricing against policy or challenging a business unit’s forecast. That is legitimate, but it should be documented as such, because a function that both operates a control and oversees it has no independence in respect of that control.
Quality assurance, monitoring and audit are not the same thing
Three activities look similar from the finance side and mean completely different things to the people doing them. Getting this wrong is the most common cause of friction between an FC and a compliance officer.
- Quality assurance is first line checking itself. Your finance manager reviewing a reconciliation before sign-off is QA. It is part of the control, not evidence that the control was independently tested. Offering it as proof of monitoring is a frequent and avoidable misunderstanding.
- Compliance monitoring is second line testing the first. Independent of the process owner, planned and risk-based, with findings that are rated, tracked and re-tested. SMF Capital’s guide to compliance monitoring sets out how the programme is designed and run.
- Internal audit is third line assuring the governing body. Independent of both, reporting to the audit committee rather than to management, and assessing whether the control framework as a whole — including compliance monitoring — is adequate.
The practical test is independence and reporting line. If the person doing the checking reports to the person who owns the process, it is first line. If they report to the compliance officer, it is second. If they report to the audit committee, it is third.
Why the distinction has teeth
It would be possible to treat all this as organisational theory. In a regulated firm it is not, for three reasons.
Accountability attaches to lines
Under the Senior Managers regime, named individuals are accountable for specific areas, and the model determines who. A control failure in a finance-owned process is a first-line failure, which lands with the senior manager responsible for that area — not with the compliance officer who failed to detect it, although inadequate monitoring is a separate finding. Our guide to the SMCR for finance teams covers how that accountability is allocated.
It determines who can sign off what
A reconciliation reviewed by the person who prepared it provides no assurance regardless of how carefully it was done. In small finance teams this is a genuine structural problem rather than a lapse, and the right answer is often to source the independent review from outside the function rather than to pretend the segregation exists. It is one of the practical arguments for fractional and interim finance support in regulated firms, where an experienced external controller can provide the review layer a three-person team cannot generate internally.
It decides what gets tested, and how often
The monitoring plan is risk-based, so areas where first-line controls are weak or unevidenced attract more frequent and deeper second-line testing. A finance function that evidences its own controls well is tested less, which is a direct and underappreciated incentive.
Where small firms struggle
The model was designed for organisations large enough to staff three separate functions. Most FCA-authorised firms are not. A payments firm with forty staff may have one compliance officer, no internal audit function, and a finance team of three.
The regulator’s expectation is proportionality rather than exemption: the firm must achieve the outcomes the model is designed to produce, not necessarily the headcount. In practice that means a few recognisable patterns.
| Constraint | Common workaround | What the regulator will look for |
|---|---|---|
| No internal audit function | Outsourced internal audit, or periodic external review commissioned by the audit committee | Genuine independence from management and a direct line to the committee |
| Compliance officer writes and tests the procedure | Separation of advisory and monitoring work within the role, documented | Evidence the two activities are distinguishable and the testing is objective |
| Finance too small for segregation | Review performed by a director outside finance, or an external fractional controller | Someone competent, independent of the preparer, with authority to challenge |
| One person owns a critical control | Documented process, cross-training, named deputy | That the control survives that person’s absence or resignation |
The last row is the one that recurs in monitoring findings. A control that works only because a particular individual is present is a single point of failure, and it is usually finance’s. Our note on the signs an FCA-regulated business needs a specialist FC covers the point at which that stops being manageable.
Four questions worth asking in your own firm
- For each control finance owns, who performs it and who reviews it? If the answer is the same person anywhere, that is a gap you can describe before somebody else does.
- Which finance processes are on the compliance monitoring plan this year? If you do not know, ask. Appearing on the plan is normal; being surprised by it is not.
- Who provides the third line here, and when did they last look at finance? In firms with no internal audit function the honest answer is sometimes nobody, which is itself worth raising.
- Where is finance acting as second line over the business? If finance challenges pricing, forecasts or commercial decisions, that oversight role should be documented rather than informal.
None of these questions is adversarial, and all four are the kind of thing a new controller is entitled to ask in their first month. Asking them later is harder, because by then the assumption is that you already knew.
The short version
Finance is first line for the controls it owns, a data source for the second line that tests them, and a subject of the third line that assures the board. Quality assurance, compliance monitoring and internal audit are three different activities distinguished by independence and reporting line, not by how thorough they are.
Understanding the distinction is not administrative knowledge. It determines who is accountable when a control fails, whether your sign-off counts as assurance, and how heavily your function gets tested. For controllers moving into regulated firms from unregulated industry, it is the single piece of context most often missing — and the easiest to acquire.
The second line is the one finance interacts with most. SMF Capital’s compliance monitoring guide explains in full what that function does, how it plans its testing and what it reports to the board.
Related services and guides
Every search is led personally by Adrian Lawrence FCA.
PRACTICE AREA
FC recruitment for FCA-regulated firms
Controllers who already understand where finance sits in a regulated structure.
PRACTICE AREA
Fractional Financial Controller
Senior review capacity for finance teams too small to segregate internally.
PRACTICE AREA
Interim Financial Controller
Cover and remediation capacity in authorised firms, shortlisted in 48–72 hours.
GUIDE
Understanding the FCA
A plain-English introduction for finance staff new to regulation.
A Note from Our Founder — Adrian Lawrence FCA
I qualified and spent years in industry before I ever worked anywhere that used the phrase “three lines”, and I remember how odd it sounded. It is worth learning properly, because in a regulated firm it is not jargon — it is the map of who answers for what. The controllers who struggle after moving into authorised firms are rarely the ones with technical gaps. They are the ones who assumed that doing the work well was the whole job, and had not realised that someone independent is going to test it, that their own review does not count, and that the board will be told the result.
Adrian Lawrence FCA
Founder, Accountancy Capital — qualified finance recruitment at £50,000 and above. Adrian is a Chartered Accountant and holds an ICAEW practising certificate in his own name — view Adrian’s ICAEW profile.
Moving into regulated finance, or hiring into it?
We place qualified finance across FCA-authorised firms — permanent, interim and fractional.
Adrian Lawrence FCA is the founder of Accountancy Capital and a Fellow of the Institute of Chartered Accountants in England and Wales (ICAEW). He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience as a Chartered Accountant and finance leader working with private, PE-backed and owner-managed businesses across the UK
He helps his clients achieve their growth and success goals by delivering value and results in areas such as Financial Modelling, Finance Raising, M&A, Due Diligence, cash flow management, and reporting. He is passionate about supporting SMEs and entrepreneurs with reliable and professional Chief Financial Officer or Finance Director services.