What is Three Lines of Defense (3LoD)? Why is it important in operational risk management?
The Three Lines of Defense (3LoD) is a governance framework used by banks to manage operational risk. It establishes three distinct layers of responsibility — ensuring that risks are identified and controlled at the source, independently overseen, and independently verified.
First Line of Defense — Business Line Management
Business line management is the first line of defense against operational risk. Business line managers are responsible for identifying and managing risks in the products, activities, processes, and systems under their accountability.
- All employees must have a clearly documented and regularly updated operating manual.
- Appropriate segregation of duties and proper delegation of authority must be maintained.
- Operational staff must have the necessary skills and training to fulfill their duties.
- The first line owns the risk — they create it, and they are responsible for managing it day to day.
Second Line of Defense — Independent Operational Risk Function
A separate and independent operational risk management function forms the second line. This function assists management in understanding and managing operational risk.
- It initiates policies, procedures, and standards for operational risk management.
- It assesses, monitors, and reports operational risks across the entire institution.
- It ensures that operational risk management in the bank is carried out as per approved strategies and policies.
- It coordinates with various business units and risk management activities.
Third Line of Defense — Independent Review
Independent validation and verification form the third line of defense. It serves as a challenge function to the first two lines.
- Internal audit — or an independent group of qualified staff — conducts these reviews.
- Those performing reviews must be competent, appropriately trained, and not involved in the development or operation of the framework being reviewed.
- The audit function provides assurance to the Board on the effectiveness of the operational risk management framework.
- Senior management must seriously investigate audit findings to build a strong risk culture.
Why 3LoD is Important in Operational Risk Management
Operational risk originates from people, processes, systems, and external events — it can arise anywhere in the bank at any time.
- The 3LoD framework ensures that no single layer has complete control over risk — creating checks and balances at every level.
- It prevents the accumulation of undetected operational risk by ensuring that the first line is accountable, the second line is watchful, and the third line is independently verifying that both are working effectively.
