The Institute of Internal Auditors: The Three Lines of Defense in Effective Risk Management and Control. Sean Lyons, Principal at R.I.S.C. International in Ireland, offered a mix of praise and criticism for the 3 lines of defense model the paper espouses. Lyons: In many organizations there can be a certain lack of clarity in relation to the roles and responsibilities of the three lines of. defense described in the IIA paper are: operational managers, risk/compliance functions, and (i.e. audit)”]
Source: https://www.csoonline.com/article/2135947/getting-the-board-on-board.html