The three lines of defence model still leaves analysts answering alone

Most writing on the three lines of defence treats the model as a board and CISO problem: who reports to whom, where the security function sits, how the governance committee is structured. That framing skips the moment the model actually gets tested, which is not in a governance meeting but at the point where a single analyst, under time pressure, has to decide whether something is a real threat or noise.

The question that matters is not whether a gap existed after the fact. It is whether the decision made in that moment was defensible given what the analyst actually knew at the time. The three lines of defence, properly applied, exist to answer that question systematically. Too often, it does not get asked at all, and the analyst who made the original call ends up being the only person who ever reviews it.

What are the three lines of defence?

The three lines of defence is a risk governance model that assigns accountability for managing risk across three distinct functions, each with a different relationship to the decision being examined. It gives organisations a clear way to separate those who take and manage risk, those who oversee it and those who independently assure it.

The first line is whoever makes the operational call under pressure, typically a security analyst or SOC team member deciding in real time whether an alert warrants escalation. The second line is risk and security governance, whose job is to review whether that call was reasonable given the information available at the time, not to relitigate it with the benefit of hindsight. The third line is internal audit, which checks independently, after the fact, whether the first and second lines did what they were supposed to do.

The distinction that gets lost in board-level framing is this: a gap and a bad decision are not the same finding. A gap means something was missed. A defensible decision that turned out badly means the analyst weighed the available evidence reasonably and the outcome was still wrong, which is a different problem with a different fix. A three lines structure that only hunts for gaps will keep finding process fixes for what is actually a judgment problem, and it will keep leaving the person who made the original call to carry that judgment alone.

What happens when the first line carries the decision alone

When second line review does not genuinely test the reasonableness of a first-line call, and only checks that a process was followed, the analyst who made the original judgment becomes the only person who ever assessed it. That gap shows up whenever a first-line decision is made under time pressure with incomplete information and no meaningful second or third line check follows.

A vulnerability disclosed this month across seven AI coding agents is a useful live illustration of this pattern, even though it sits outside a traditional SOC context. The flaw let a malicious repository hijack an AI coding agent's git operations, and the practical exposure depended entirely on split-second judgment calls: whether to trust an agent's autonomous actions inside a live repository, made by whoever was running that agent at the time, with no independent second line checking whether that trust was warranted before or immediately after the fact. The technology is different from a SOC alert queue, but the accountability structure is identical: a single person's in-the-moment judgment stood in for a review process that, on paper, existed to test it.

This is the pattern the three lines model is designed to prevent. It does not do so by adding another approval step before the first-line decision, since that would defeat the purpose of having a first line at all, but by making sure the second and third lines genuinely interrogate the reasonableness of the call afterwards, rather than confirming a checklist was followed.

What a functioning three lines structure looks like in practice

A three lines model that works does not just have three functions named. It has a second line that can reconstruct what the first line actually knew at decision time, and a third line that can verify, independently, that the second line's review was substantive rather than procedural.

How one audit firm unified its three lines of defence shows what that looks like when the structure is built around a single, traceable line of evidence connecting a first-line decision to the second-line review of it and the third-line check on that review, often described as a golden thread running through all three lines. Rather than three functions each keeping separate records that a decision was reviewed, the evidence itself connects the original judgment call to the review of its reasonableness, which is what makes the second-line check verifiable rather than assumed.

That connective structure is the practical difference between a three lines model that exists on an org chart and one that changes what happens after a difficult call is made. Without it, second line review tends to default to checking that a process step occurred, because there is no accessible record of what the first line actually knew with which to test the reasonableness of the decision itself. Ideagen Internal Audit helps internal audit teams keep that evidence connected and verifiable.

The reframe that matters

Three lines of defence software and process design is usually sold on coverage: does every risk have an assigned owner across all three lines? Coverage is necessary, but it is not the test that matters. The test that matters is whether the second line can answer, for any first-line call under scrutiny, whether it was defensible given what was known at the time, and whether the third line can verify that this review genuinely happened rather than being recorded as complete.

An organisation that can only ask "was there a gap?" after an incident is still leaving its analysts to carry every real-time judgment call alone. An organisation whose three lines can ask "was this defensible?" has built a structure that does what the model is supposed to do.