Three Lines Under Strain at a Fast-Growing Port Operator

Internal audit must not own compliance monitoring. Under the Three Lines Model, the compliance function is a second-line function that designs and operates controls; internal audit is the third line and provides independent assurance. If the CAE owns the program, internal audit would be reviewing its own work, creating a self-review threat and eroding the board's only independent assurance channel. The resource facts make the request worse: 11 auditors for 14 entities, one vacancy, and travel cut to 60% mean internal audit cannot absorb a management program without dropping assurance work. The right response is to decline ownership, explain the impairment in writing, and offer a defined advisory role, for example helping compliance design a risk-based monitoring plan or providing assurance over it after a cooling-off period. If the board wants temporary coverage, it should be a co-sourced second-line arrangement reporting to management or the risk committee, not to the CAE. The audit committee should approve any such arrangement and record the rationale.

Two clusters stand out. First, decentralized procurement with a $250,000 no-tender authority tied to a delivery target creates incentives to split purchases and document delays after the fact. Second, the 49%-owned JV in Country X involves a politically connected majority holder and a new related-party bunkering supplier, which raises bribery, related-party, and governance risk. The hotline data, with 12 reports last year, 7 this year, and 5 closed by HR without investigation, suggests a triage weakness rather than fewer problems. A risk-based approach would use full-population analytics on purchase orders just below the threshold, duplicate bank accounts, vendor creation dates, and employee-vendor links; review tender waivers by terminal and approver; and test JV board minutes, related-party disclosures, and the bunkering contract award. Because travel is constrained, run analytics centrally and reserve site visits for the highest-risk terminals and the JV. Co-source forensic or country-risk expertise if the team lacks it. Document why each area was included so the board can see the risk linkage.

Report leading indicators that show whether each line is functioning, not just how many audits were completed. For the first line, track the percentage of purchase orders above the delegated threshold with a documented delay and the number of retroactive approvals. For the second line, track tender waivers by terminal, vendor master changes, related-party spend, and hotline reports investigated versus closed without inquiry. For the third line, track assurance coverage of high-risk entities, overdue actions, and reliance on management self-assessments. Add JV governance indicators: board meeting attendance, related-party transactions approved, and local agent or consultant payments. Trend these quarterly against risk appetite. A falling hotline volume alongside rising waivers is a warning sign, not a success. The board should see the metric definitions and limitations, because a simple count can hide triage failure.