4 MIN READ
Picture the three lines of defense model. Three clean columns on the slide deck, three roles on the org chart, three functions the regulator says a bank has to have. The model is not the problem. The execution is.
For fifteen years the banks and the consultancies have been selling the board the same shape, and the shape is fine. What is not fine is how often the org chart quietly omits the third line, underfunds the second, and leaves the first so buried in operational fire that the risk register gets punted to next quarter. The model the regulator expects, and the model the firm has been pretending to operate, are not the same model. The honest framing matters here, because the postmortem lands either way.
What the model is supposed to be
The first line runs the controls. The business owner of the cyber risk is whoever builds and runs the system, the CIO, the CTO, the head of product, the engineering lead. They own the day to day. The second line oversees them. The risk officer, the CISO, the compliance team, the function that sets policy and has the authority to challenge the first line when the first line cuts corners. The third line audits both. Internal audit, reporting to the audit committee, functionally independent from the CFO, the function the regulator expects to have a clear line to the board. Each of the three lines is supposed to be a real function with real authority, and the model works as long as the three of them stay separate.
What it usually looks like
The first gap is the missing third line. Internal audit does not exist, or it sits two layers under the CFO who also oversees the operational side. The model requires independence, and most firms quietly omit it.
The second gap is the underpowered second line. The risk and compliance function gets staffed at a tenth of the size the operational side demands. The team that should be able to block the launch cannot block the launch because they do not have the headcount, the budget, or the standing in the room.
The third gap is the time poor first line. The engineering lead is consumed by the operational fire, three incidents and a release and a retro before lunch, and the risk register is the thing that gets punted to next quarter. The control that should sit with the operational owner ends up treated as a compliance checkbox, and the checkbox is what survives.
How to make it actually work
Fund the second line properly. Headcount, budget, and the political cover to say no when the operational side wants to ship. A CISO who cannot block a release is a CISO who will not block a release, and the regulator will name them in the postmortem.
Make the third line independent. Internal audit reports to the audit committee, not the CFO. The cost of that is a fight with finance the risk leader has to pick, and the fight is the price of admission.
Give the first line back its time. The engineering lead with calendar blocked for the risk work, who is not in four retrospectives and three incident bridges at the same time, that is the person who actually owns the control.
The bottom line
Three lines on the org chart, three lines that actually work. The model has been right for fifteen years. The funding, the independence, the time are the levers, and the risk leader who pulls them is the one whose model survives the next incident.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
