Established model
The three lines model
Institute of Internal Auditors · 1999
Who owns a risk, who oversees it, and who independently checks both — kept as three distinct roles.
Its place in the frameworkBusiness Core›Compliance
What it does
The first line owns and manages risk in the work itself; the second sets policy and monitors; the third gives independent assurance to the governing body. The point is separation: assurance given by the people who would have to report their own failure is not assurance, whatever it is called.
- Reach for it when
- When setting up how compliance is organised, and when it is unclear who is actually responsible for a control.
- Where it stops
- Read as an org chart it produces bureaucracy and a first line that believes risk is someone else’s department. The 2020 revision exists largely because of that.
Institute of Internal Auditors, position papers from 1999; The IIA’s Three Lines Model, 2020.
Why it sits at Compliance
The obligations the organisation has no choice about — legal, regulatory, financial, environmental, and the ethical standards it has committed to publicly.
A model is only useful when you reach for it at the right moment. This one answers a question that arises here — so it is filed here, and nowhere else. These are the working areas it serves:
- Regulatory mappingCompliance management practice on obligation registers, which underpin everything downstream.
- ControlsInternal control frameworks such as COSO, and the preventive-detective-corrective distinction.
- MonitoringInternal audit practice on control testing, and the three-lines model separating operation, oversight and assurance.
- Incident responseIncident response practice, including statutory notification windows such as the seventy-two hours required under GDPR.
What it touches elsewhere
Nothing in a business is decided on its own. A conclusion reached with this model at Compliance lands in these other cores, whether or not anyone follows it there.
- Business CoreControls live inside operational systems; obligations often flow through partners and the supply chain.
- Data CoreData governance is where much of modern compliance actually sits.
- Brand CoreA compliance failure is a brand event before it is a legal one.
- Vision CoreStated values become obligations enforced by employees and customers rather than regulators.
Filed at the same place
These answer questions that arise at Compliance too. Where they disagree with this one, the disagreement is the useful part.
- ISO 31000 risk managementA common set of principles and a process for identifying, assessing, treating and monitoring risk.
Elsewhere in Business Core
- Tuckman’s stages of group development
- Belbin Team Roles
- Herzberg’s two-factor theory
- Jobs to be done
- The Kano model
- The value proposition canvas
- The business model canvas
- The Van Westendorp price sensitivity meter
- Value-based pricing
- Core competence
- VRIO
- The resource-based view
- The theory of constraints
- Lean thinking
- Co-opetition and the value net
- Transaction cost economics
- Stakeholder theory
- The power–interest grid
- DuPont analysis
- Break-even and cost–volume–profit analysis
- Unit economics
- The Kraljic Matrix
- The bullwhip effect
- The SCOR Model
- On-time in-full
- Overall equipment effectiveness
- Value stream mapping
- Maslow’s hierarchy of needs
- Kotter’s eight-step change model
- Situational leadership
- The Lean Startup
- Design thinking
- Porter’s value chain
- The McKinsey 7S framework
- The growth–share matrix
- Six Sigma and DMAIC
These are other people’s models, named here so you can go to the source and use them properly. The Omnigoal is not affiliated with their authors and is not endorsed by them; nothing of theirs is reproduced here — no canvas, no diagram, no wording. Each is described in our own words, with the originator credited, because the framework is a place to put thinking, not a replacement for the people who did it. Model names and trademarks belong to their respective owners and are used here only to refer to the work itself.
All 125 models