Skip to content
  • There are no suggestions because the search field is empty.

Roles and responsibilities: the Three Lines Model

An optional way to organize who does the work, who oversees it and who audits it, and how to recognize that split in ISOPlanner.

Some organizations describe their governance using the Three Lines Model, published by the Institute of Internal Auditors in 2020 as a successor to the older Three Lines of Defence. It is a way to make clear who does the work, who oversees it, and who provides independent assurance.

Using the model is a choice. ISO 27001 asks you to assign roles and responsibilities, but it does not prescribe how you structure them, and plenty of organizations run a sound ISMS without ever naming a first or second line. This article is for the organizations that have adopted the model and want to recognize it in ISOPlanner. If that is not you, you can skip it.

ISOPlanner has no field called "line". You express the model through ownership, roles and dashboards, which is enough to make the separation visible in daily use.

The three lines

The first line does the work and owns the risk. These are the process owners, control owners, risk owners and asset owners, the people who carry out a control and who answer for the outcome.

The second line supports and oversees the first line. Think of a CISO, a privacy officer or a quality manager. They maintain the framework, challenge the risk assessments, monitor whether controls actually work, and report to management.

The third line provides independent assurance through internal audit. Independent means reporting outside the management chain that owns the controls.

Governing body and management sit above the three lines. External auditors, including your certification body, sit outside the model entirely.

The first line in ISOPlanner

Assign an owner to every process, control, risk and asset. The owner gets read access to that item and receives the recurring tasks that come from your annual plan templates. Forms and KPI evidence are filled in here as well, so the first line is where most of the day to day registration happens.

If you want first line owners to see their own work and nothing else, give them a personal dashboard with task widgets filtered on their name. See How to set up your dashboards.

The second line in ISOPlanner

Give the second line a Manager licence, or a custom role if you want to limit what they can change. They work mainly in the overviews rather than in single items: the requirements overview to see coverage, the risk overview and risk matrix to review assessments, and the KPI's to see whether controls perform.

A themed dashboard works well here, with widgets on standard coverage, open risks above tolerance, overdue tasks and KPI trends. That dashboard is the second line's monitoring view, and it is also what you show during a management review.

The third line in ISOPlanner

Plan and record internal audits in the audit module. You create an audit series, set the frameworks and the scope, assign the preparation to the auditors, and record findings that turn into tasks for the first line owner. See How to use the Audit Module for the full cycle. The module is in preview, so if you do not see it, ask ISOPlanner support to enable it for your tenant.

Independence is an organizational matter, not a setting in the software. What ISOPlanner does is keep the audit record separate from the people who own the controls, so a finding stays visible as a finding instead of disappearing into an edit on the control itself.

When the lines overlap

In a small organization the same person is often the CISO and the owner of half the controls. That is normal, and the model allows for it, as long as you are open about where the separation is missing. Two practical ways to handle it:

  • Let someone outside the team perform the internal audit. A consultant can be added with the Consultant role, which keeps the third line independent without hiring anyone.
  • Have the board or director review the second line's dashboard rather than the CISO reviewing their own work.

An auditor will accept a combined first and second line in a small team. What they will question is a third line that audits its own controls.

Making the lines visible

If you want to see at a glance which line an item belongs to, two options work:

  • Use labels on tasks and controls, for example Line 1, Line 2 and Line 3. Task widgets can filter on labels, so you can build one dashboard per line.
  • Use organizational units if your lines follow your departments.

Labels are the lighter option and easier to change later.

Related articles