Understanding The IIA’s Three Lines Model:
The Three Lines Model defines responsibilities for risk management and control across different organizational functions:
First Line: Operational management (owns and manages risks).
Second Line: Risk and compliance functions (monitors and facilitates risk management).
Third Line: Internal audit (provides independent assurance).
Why Third-Party and Supplier Assessments Are Shared Across All Three Lines:
First Line (Operational Teams & IT Security): Ensures that vendors comply with security standards.
Second Line (Risk & Compliance Teams): Conducts due diligence and ensures compliance with cybersecurity regulations.
Third Line (Internal Audit): Independently evaluates supplier risk management processes.
Why Other Options Are Less Relevant:
B. Recruitment and retention of certified IT talent – Primarily a first-line management responsibility (HR and IT departments).
C. Classification of data and design of access privileges – Typically a first-line IT security function, with oversight from the second line.
D. Creation and maintenance of secure network configurations – Falls under first-line IT operations with oversight but not shared by all three lines.
IIA’s Three Lines Model (2020 Update): Emphasizes shared responsibilities in areas like third-party risk.
IIA Practice Guide on Third-Party Risk Management: Internal audit must assess supplier security and compliance.
COSO ERM Framework: Highlights vendor risk management as a cross-functional responsibility.
Relevant IIA References:✅ Final Answer: Assessments of third parties and suppliers (Option A).
