Three Lines, One Blind Spot
A payments firm operates a three-lines model. The first line (business) owns a fraud-detection rule engine. The second line (risk) sets the rule-change policy and reviews changes monthly, after the fact. The third line (internal audit) last audited the engine 26 months ago; its charter says 'high-risk systems audited at least every 24 months.' In the past year, the first line made 340 rule changes, 41 of them emergency changes made without the required second-line pre-approval. The second line's monthly review sampled 12 changes per month and happened to miss all 41 emergencies because emergencies were logged in a separate ticket queue. The CRO says the model 'works because each line does its job.' Internal audit's plan for next year does not include the engine because 'it was covered recently.'
1. Diagnose where the three-lines model is failing. Be specific about which line's assurance is illusory and why.
Read the worked answer
The model is failing at the seams between lines, not inside any single line.
First line: made 41 emergency changes bypassing pre-approval. Some emergency changes are legitimate; 41 in a year with no visible post-hoc scrutiny suggests the 'emergency' label has become a routine bypass.
Second line: its assurance is illusory. It samples 12 changes a month from a queue that structurally excludes the highest-risk population (emergencies). A sample that cannot contain the riskiest items provides comfort that is mathematically guaranteed regardless of what is happening. This is the core failure: the second line believes it is monitoring, but its population is wrong. The policy it set (pre-approval required) is also unenforced - a policy with a 41-breach year and no consequence is documentation, not control.
Third line: missed its own 24-month charter commitment (26 months) and then used 'covered recently' to justify skipping it again - a self-referential error. The charter obligation was already breached; the correct response is to prioritise it, not defer it.
The CRO's claim that 'each line does its job' is the tell: the lines are individually defensible and collectively blind. Assurance depends on coverage of the risk population, not on activity volume.
2. Recommend a remediation sequence. What must change first, and what would you tell the board in one page?
Read the worked answer
Sequence (order matters):
- Fix the population before the sampling. Merge the emergency queue into the monitored population and make emergency changes a 100%-reviewed stratum. Until the second line can see all changes, no sampling result is meaningful. This is first because every other assurance claim rests on it.
- Enforce the pre-approval policy or change it. Either emergencies require documented justification and CRO sign-off within 24 hours, or the policy is amended to reflect reality. A 41-breach year with no escalation is the real control gap.
- Restore third-line coverage. Internal audit re-plans the engine for the current cycle, acknowledges the charter breach, and reports it. 'Covered recently' should be struck from the rationale.
- Redefine assurance metrics. Replace 'changes reviewed' with 'percentage of risk population covered' and 'emergency changes with post-hoc sign-off'.
One-page board message: the three-lines model is sound in design but its assurance was not covering the riskiest changes for at least a year; the second line's sample could not have detected the bypasses, and internal audit is overdue against its own charter. No evidence of loss is presented, but the control environment gave false comfort. Remediation is sequenced to fix coverage first, then enforcement, then independent audit, with the board receiving coverage metrics rather than activity counts next quarter.