Part 1: The Three Lines of Defense are a’changing
Recently, on June 20th this year, the Institute of Internal Auditors (IIA) opened up a request for public comments on its proposed changes to their Three Lines of Defense (3LOD) risk management and control model. The IIA’s request for comments closed around September 19th, and have just posted the results of their survey here:
Why are they proposing changes? Despite its widespread acceptance and use, the current 3LOD has been criticized for being too restrictive, not effective in some smaller organizations or perhaps creating ineffective organizational silos in larger ones. Perhaps most important, it focuses attention on defensive approaches rather than stressing the importance of a more proactive approach to managing risk. Given the maturing and changing governance, risk, and compliance approaches to become a more integrated one, IIA decided it was time to propose updating the model.
In part 2, we will get a little more background on this model.
About GuidePoint
GuidePoint Security LLC provides customized, innovative and valuable information security solutions and proven cybersecurity expertise that enable commercial and federal organizations to successfully achieve their security and business goals. By embracing new technologies, GuidePoint Security helps clients recognize the threats, understand the solutions, and mitigate the risks present in their evolving IT environments. Headquartered in Herndon, Virginia, GuidePoint Security is a small business, and classification can be found with the System for Award Management (SAM). Learn more at www.guidepointsecurity.com.
Contributing Authors
Brian Betterton, Practice Director, Governance and Risk, GuidePoint Security