[OR] [3LoD] Three Lines of Defence for Operational Resilience

Three Lines of Defence: Strengthening Operational Resilience Through Clear Accountability

Operational resilience is not a single department's responsibility. It requires coordinated action across business operations, risk management, technology, business continuity, cybersecurity, third-party management, crisis management, and internal audit.

One useful way of establishing clear responsibilities is through the Three Lines of Defence model.

Although the Institute of Internal Auditors (IIA) now refers to the framework as the Three Lines Model, the traditional term “Three Lines of Defence” remains widely recognised.

In an Operational Resilience context, the model provides a practical way of distinguishing between those who own and manage resilience, those who oversee and challenge resilience, and those who provide independent assurance.

Why the Three Lines Matter to Operational Resilience

Operational Resilience focuses on an organisation's ability to continue delivering its Critical Business Services (CBS) when disruption occurs.

Achieving this requires more than having Business Continuity Plans or IT Disaster Recovery arrangements.

The organisation must understand its critical services, map the resources and dependencies that support them, set acceptable disruption thresholds (impact tolerances), test severe but plausible scenarios, identify vulnerabilities, and implement improvements.

These responsibilities cannot sit entirely with the Operational Resilience or Business Continuity function.

The Three Lines of Defence provide a governance structure for allocating these responsibilities.

• First Line → Own and Manage Resilience

• Second Line → Establish, Oversee, Monitor and Challenge

• Third Line → Independently Assure

Together, the three lines provide management and the governing body with greater confidence that Operational Resilience is being implemented effectively.

First Line: Own and Manage Operational Resilience

The First Line consists primarily of business and operational management responsible for delivering products and services.

In Operational Resilience, this means owners of Critical Business Services should also own those services' resilience.

Their responsibilities typically include:

• Identifying and validating Critical Business Services;
• Understanding the processes supporting each service;
• Identifying people, technology, information, facilities and third parties required to deliver the service;
• Mapping interconnections and interdependencies;
• Understanding vulnerabilities and concentration risks;
• Participating in the establishment of impact tolerances;
• Maintaining appropriate continuity and recovery capabilities;
• Participating in scenario testing;
• Addressing weaknesses identified through exercises, incidents and reviews; and
• Escalating resilience risks that exceed agreed risk appetite or tolerance.

A fundamental principle is therefore:

The business owns resilience

The Operational Resilience function can provide the methodology, tools, and expertise, but it should not own every Critical Business Service.

Second Line: Establish the Framework, Monitor and Challenge

The Second Line provides specialist expertise, oversight, monitoring and challenge.

Depending on the organisation's governance structure, this may involve Operational Resilience, Enterprise Risk Management, Operational Risk, Business Continuity Management, Compliance, Technology Risk, Cyber Security and Third-Party Risk Management functions.

For Operational Resilience, second-line responsibilities may include:

• Developing the Operational Resilience policy and framework;
• Establishing the implementation methodology;
• Defining criteria for identifying Critical Business Services;
• Providing guidance on mapping interconnections and interdependencies;
• Establishing approaches for determining impact tolerance;
• Developing scenario-testing requirements;
• Monitoring implementation across Critical Business Services;
• Reviewing the quality and completeness of resilience assessments;
• Challenging assumptions made by Critical Business Service owners;
• Identifying common vulnerabilities and concentration risks;
• Monitoring remediation programmes;
• Consolidating resilience information for senior management and governing-body oversight; and
• Monitoring changes in regulatory and supervisory expectations.

The Second Line should therefore provide

oversight and constructive challenge without taking ownership away from the First Line.

This distinction is important. If the Operational Resilience function performs all the analysis, completes all the documentation and conducts all the testing on behalf of the business, operational management may regard resilience as somebody else's responsibility.

Effective Operational Resilience requires the opposite: business ownership supported by specialist oversight.

Third Line: Provide Independent Assurance

The Third Line is typically Internal Audit.

Its role is not to design or operate the Operational Resilience programme.

Instead, it provides independent assurance that the organisation's governance, risk management, and control arrangements are appropriately designed and operating effectively.

An Operational Resilience audit may consider whether:

• Critical Business Services have been appropriately identified;
• Accountabilities and governance arrangements are clearly defined;
• Mapping adequately captures important interdependencies;
• Impact tolerances have been appropriately established and approved;
• Severe but plausible scenarios are being tested;
• Testing provides credible evidence of resilience capability;
• Identified vulnerabilities are tracked and remediated;
• Technology, cyber and third-party dependencies are adequately considered;
• Lessons from disruptions and exercises result in improvements; and
• Senior management and the governing body receive appropriate information to exercise oversight.

The Third Line therefore answers an important question:

Can management and the governing body rely on the organisation's assessment of its own Operational Resilience?

How the Three Lines Work Together

The Three Lines should not operate as three isolated organisational layers.

Operational Resilience requires information to move across all three.

For example, scenario testing may identify that a Critical Business Service cannot remain within its impact tolerance during a prolonged technology outage.

The First Line should understand the operational consequences and develop corrective actions.

The Second Line should challenge whether those actions sufficiently address the vulnerability and monitor remediation.

The Third Line may subsequently assess whether the vulnerability was appropriately identified, governed and remediated.

This creates an important resilience cycle:

Ownership → Oversight → Assurance → Improvement

Applying the Three Lines Across the Operational Resilience Lifecycle

The model becomes particularly useful when applied throughout an Operational Resilience implementation programme.

The precise allocation of responsibilities will differ between organisations. What matters is that ownership, oversight and independent assurance are clearly distinguished.

Avoiding Common Implementation Problems

A Three Lines structure can exist on an organisation chart without working effectively in practice.

One common problem occurs when the Second Line becomes the de facto owner of Operational Resilience.

The Operational Resilience or BCM team identifies the services, maps them, sets tolerances, writes the plans, and runs the exercises, while business owners merely approve the documents.

Another problem arises when the First and Second Lines become blurred.

If the same function both designs the framework and independently assesses whether it has been implemented effectively, the strength of challenge can be reduced.

A third problem occurs when the Third Line becomes involved too late.

Internal Audit should retain its independence, but understanding the organisation's Operational Resilience framework allows it to develop an appropriate assurance programme as the capability matures.

The objective is therefore not simply to establish three organisational layers. It is to create clear accountability, effective challenge and credible assurance.

From Three Lines of Defence to Three Lines of Resilience

Operational Resilience changes the conversation from protecting individual processes and systems to maintaining the delivery of Critical Business Services during disruption.

The Three Lines model supports this shift.

• The First Line builds and operates resilience.

• The Second Line establishes expectations, monitors resilience and challenges weaknesses.

• The Third Line provides independent assurance that the resilience framework and capabilities are effective.

Above all three sits the governing body and senior management, which remain responsible for establishing appropriate governance, setting direction and overseeing the organisation's resilience.

When these responsibilities are clearly understood, Operational Resilience becomes more than a specialist programme owned by BCM, Risk or Technology.

It becomes an organisation-wide management capability.

That is ultimately the value of applying the Three Lines of Defence to Operational Resilience: ensuring that resilience is owned where services are delivered, challenged where risks are overseen, and independently assured where confidence is required.

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.