What is the difference between internal audit and an internal controls function under the three lines model?

Question

AcadiFi · Accepted Answer

Under the three lines model, management in the first line owns risks and controls, second-line functions such as compliance or risk management help set frameworks and monitor adherence, and internal audit in the third line provides independent assurance to the board and senior leadership. Titles vary in practice, but the core question is still role, not label.

Consider Larkstone Manufacturing, which has $68 million in annual sales. Its operations team approves vendors, runs inventory counts, and performs supervisor reviews. That is first-line control ownership. A small compliance team designs policy templates, tracks SOX testing calendars, and monitors overdue remediation. That is second-line support and monitoring. Internal audit then evaluates whether the process design and monitoring are adequate and reports independent conclusions to the audit committee. That is third-line assurance.

```mermaid
flowchart LR
  A[First line
Management owns controls] --> B[Second line
Risk and compliance oversight]
  B --> C[Third line
Internal audit assurance]
```

The exam trap is assuming internal audit performs or owns the controls because auditors know them well. Knowledge is not ownership. If a role is operating the process, it is not independent assurance. Focus on who executes, who supports, and who evaluates. That separation usually gets you to the right answer. Practice more in our CIA question bank.

What is the difference between internal audit and an internal controls function under the three lines model?

Master Part 1 with our CIA Course

Related Questions

Practice Questions