How does the three lines model apply to a technology organisation, and where does it go wrong?

The model

First line owns and manages the risk — the engineering teams. Second line sets policy and provides oversight — security, risk, compliance functions. Third line provides independent assurance — internal audit, reporting to the board rather than to management.

The intent is that risk is owned where it is created, with independent challenge.

Where it goes wrong in technology

• Second line doing first-line work. A security team that configures the controls itself has become the owner, and there is now nobody independent to oversee it. This is the most common failure and it happens because it is faster in the short term.
• First line believing risk belongs to second line. If engineers think security is the security team's job, ownership has not moved and the model is nominal.
• Third line auditing documentation rather than systems, which produces findings about process artefacts and misses the technical risk entirely.
• Second line with no technical depth, issuing policy that does not survive contact with the architecture and is therefore ignored.

What makes it work

• Second line builds the paved road and the automated controls; first line uses them and owns the outcome. That is the division that actually holds, because it puts the expertise in the enabling function and the accountability in the delivery team.
• Risk acceptance sits with first line, at a level matching the exposure. A second line that accepts risk on the business's behalf has swapped roles with it.
• Third line with technical capability, able to test controls rather than read about them.
• Escalation paths that are used, so disagreement resolves rather than accumulating.

The framing that helps engineers

The first line owns the risk because it owns the system. The second line's job is to make the safe path the easy path; the third line's job is to check that both are true. Presented that way it is an operating model rather than a compliance ritual.