Is the three lines of defense model actually working for anyone?

Genuine question — does the three lines of defense model actually work in practice, or has it become one of those things we all put in our policy documents but nobody really follows?

I've worked at three different financial institutions and at every single one the framework breaks down because:

• First line business owners treat compliance as "not my job"
• Second line compliance teams are too small to actually challenge the first line
• Third line internal audit just produces reports that nobody reads

The IIA updated their model a few years back (dropping "defense" in favor of just "three lines model") which I thought was interesting but didn't really change anything practical.

Has anyone actually made this governance approach work well? What did it take?

Amit nailed the cultural piece. A few structural things that help too:

Clear escalation paths — The model works when each line knows exactly what to escalate and to whom. Most failures happen in the gaps between lines, not within them.

Right-sized second line — The second line can't be three people overseeing 500 first-line staff. If your compliance team is chronically understaffed, the framework will fail regardless of how good it looks on paper.

Board reporting that connects the lines — When board risk reports show first-line metrics alongside second-line assessments and third-line findings, the whole structure becomes visible and accountable.

The IIA's updated "three lines model" mostly rebranded the same concepts but it did make one useful point: the lines should be collaborative, not adversarial. If your first line sees compliance as the enemy, you've already lost.

Honestly I think smaller organizations struggle with it most because people wear multiple hats. I've literally been the first AND second line at a previous job which makes the whole segregation of responsibilities kind of meaningless.

For mid-size firms where perfect separation isn't realistic, I've found a "1.5 lines" approach works better — embed compliance champions in the business teams and have a lean central compliance function that sets standards and does quality assurance. It's not textbook but it's better than pretending you have a model you can't actually staff.