C0.3 Three lines and prohibitions

IIA Global Internal Audit Standards 2024 and statements of position, July 2026 [18]

The component requires that management own risks and controls, that independent functions oversee them, and that internal audit assure them; that a governing body be named as accountable for all three; and that three prohibitions be written into policy: internal audit does not set the appetite, does not choose the response to a risk and does not own a policy. It adds a safeguard of time: whoever designed a control does not assure it for twelve months (C0.3) [18]. Most organizations have the three lines on a slide; few have written down what the third line may not do, and in the gap the auditors end up writing the appetite they will later opine on.

It comes from the auditors' institute, whose Global Internal Audit Standards took effect in January 2025 and whose statements of position of July 2026 replaced the model most practitioners still draw. The Part II reading found this to be the only source in the set that says, in writing, what a risk function may not do, and found the temporal safeguard the most useful of its rules because it treats independence as a matter of time rather than of organization charts. The 2026 statement is also explicit that the three lines are roles, not a structure. What the component reconciles is the vocabulary of lines: first, second and third in the auditors' usage, owner, oversight function and assurer in the framework's, with the governing body above all three. The prohibitions become design constraints on every other layer: a response in L4 cannot be recorded with internal audit as its decider, an appetite in L1 cannot be approved by the third line, and the assurance map in L6 carries the twelve-month rule as a field on every assurance activity.