V I E W P O I N T: 0 1 . 2 0 2 2

AV O I D I N G S U R P R I S E S —A CASE FOR
N E X T- G E N E R AT I O NRISK ASSURANCE
Implementing next-generation
risk assurance under enhanced
Three Lines Model

AUTHORSTom Teixeira
Marcus Beard
Thomas BlackIn today’s complex and ever-increasing regulatoryenvironment, organizations face the risk ofsignificant incidents that can disrupt business andlead to financial and reputational losses. All toooften, it is only after the event when boards askquestions like, “Why wasn’t this on our radar?”“Why were the controls not in place, or not working?”and “How can we prevent similar events again?”

Kerri McGowan

ARTHUR D. LITTLEV I E W P O I N T: 0 1 . 2 0 2 2

A more proactive approach is to systematicallyconsider how assurance arrangements can- Static approaches and complacency.

Controls can become ineffectual in a complex

be upgraded to minimize the chance ofand fluid operating environment, wheresuch events materializing. In recent years,

threats are in a constant state of change.

the Three Lines Model from the Institute of- Lack of a risk-based approach. Stress tests

Internal Auditors (IIA) has evolved to becomea potentially valuable, overarching guidefor assurance and governance, althoughmany organizations struggle to practicallyintegrate its key principles into their business
operations and decision-making processes.
One challenge is balancing the extent ofseparation and collaboration between
the three lines. More broadly, it can bedifficult to tailor the principles to specificcompany control frameworks, cultures, andrequirements, leading to a false comfort
level of protection. Consequently, someorganizations are failing to fully embed
effective assurance at all levels, leaving
themselves potentially exposed to significant
risk and governance failures.

PRE VENTING A FAL SESENSE OF SECURIT Y

of assurance frameworks often reveal thatsignificant failures were not seen beforehand
as areas of high risk. A true risk-based
approach can better identify potentiallymaterial risk events before they occur,
allowing for better-targeted risk controls
and assurance.

- Poor coordination. This arises from a lackof a single source of truth, unclear assurance
plans, and overlapping or poorly defined roles
and responsibilities, resulting in confusion,
gaps in assurance coverage, duplicatedactivities, and poorly deployed resources.

- Unsupportive culture. A common barrier toeffective assurance is poor collaboration/
sharing of information among staff andmanagers between business units andcorporate. This can amount to hiding
information, which can have detrimental
effects on the organization’s knowledge of

In our experience, companies frequently

where controls may not be working effectively,

overestimate their existing risk management

where new risks are emerging, or whereeffectiveness and coverage of assurance and areexisting risks are increasing.

surprised when incidents occur. In fact, there isoften a sense of shock after serious incidents,
and then a creeping realization that in hindsightarrangements for risk controls were not as robust
as previously assumed.

We describe risk assurance as the practice ofproviding an evidence-based assessment of
the effectiveness of risk management andrelated control activities. Structuring theassessment to identify, map, and coordinate

We often see the following weaknesses when

the sources of assurance forms the basis of anit comes to risk assurance:

assurance framework — an integral component of- Assurance fails to provide foresight.

safeguarding the organization from unexpectedCompanies tend to focus solely on reactive

events that can cause significant harm.

processes that examine trends in historicalIn this Viewpoint, we address various ways

incidents.

to combat risk failures using a more robust,- Significant knowledge gaps in assurance.

proactive, and dynamic approach.

Supervisors/managers often fixate on areas
they know, leaving other areas exposed andless well understood.

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

2ARTHUR D. LITTLEV I E W P O I N T: 0 1 . 2 0 2 2

THE THREE LINES MODEL

Simply adopting the Three Lines Model is

IIA’s Three Lines Model (see Figure 1) provides aeffective assurance, but merely a starting

set of principles for risk assurance by defining

point for developing fit-for-purpose assurance

responsibility for risk management across threearrangements. It is necessary to decide on thelines, enabling an environment of improved

scope of assurance activities as well as specific“checks and balances.” By outlining the roles

ownership and accountabilities across the threethat different lines play in managing risk, andlines — and then strike the right balance between

the interplay between them, everyone in theindependence and collaboration. The principles

organization potentially has a role in strategic

must be adopted in a way that aligns with thesuccess. Indeed, the goal of each of the threeorganization’s risk profile, strategic businesslines is the same — to ensure the organization’sobjectives, and culture such that people cansuccess. Specifically, the roles of the three lines,

work together to develop a more proactive,

according to IIA, are as follows:

dynamic approach. In our experience, the model- First line – responsible for identifying andmanaging risk for the delivery of products andservices. These parties provide control selfassessment as part of their regular activities.

- Second line – oversees or specializes incompliance or risk management. This groupprovides the policies, frameworks, tools,techniques, and support to enable risk
management and compliance in the first line
– and monitors the effectiveness of theseelements at the first line.

- Third line – the internal audit function that

not, in itself, a silver bullet for deliveringcannot be forced upon an organization but must
fit within the ways of working, culture, leadership,and behavior.

THE IMP OR TANCE OF
A ROBUS T SECOND LINE
An effective second line can be extremely
valuable in providing independent assurance asto how effectively risks are being managed at thefirst line. The second line’s people, capabilities,activities, and reporting and escalation channels
must be tailored to the organization, itssits outside the risk management processes

leadership style, and its culture. Moreover, theof the first two lines. This group’s main roles

second line needs to understand that its role isare to ensure that the first two lines areabout helping to protect the organization fromoperating effectively and to advise on allmaterial risks (not the day-to-day).

matters relating to the achievementof objectives.

Organizations should consider the following
key principles:- Putting in place a highly skilled, agile, andFigure 1. IIA’s Three Lines Model

efficient team that balances excellent

technical and interpersonal capabilities.

GOVERNING BODY

- Avoiding unnecessary overlap with theMANAGEMENT

Actions (including managing risk) toachieve organizational objectives
First line roles:
provision of products/services to clients;
managing risk

Second line roles:
expertise, support,monitoring, andchallenge on riskrelated matters

INTERNAL
AUDIT

Independent assurance
Third line roles:
independent andobjective assurance andadvice on all mattersrelated to achievementof objectives

first line and not acting as a shadoworganization – center on issues of substancethat could have material impact on theorganization, not just “business as usual”
areas.

Source: Adapted from “The IIA’S Three Lines Model: An Update of the Three Lines of Defense,” July 2020.

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

3

ARTHUR D. LITTLEV I E W P O I N T: 0 1 . 2 0 2 2- Understanding that assurance is a main roleof the second line – risk-based approach thatexamines issue complexity, extent of change,novelty, knowledge, etc.

- Knowing that a secondary role is tosupport and advise the first line – sharelessons learned, review and amend corporate
standards, and help address areas of weakness(e.g., identified in audits).

- Having authority to escalate when deemednecessary – aim to resolve concerns with thefirst line but also define an escalation path for
issues of significant concern (e.g., to the CEO,executive committee [EC], or board).

-RISK- BASED AS SUR ANCEAT THE SECOND LINE
It is neither practical nor efficient to apply thesame level of assurance to all risk controls.
Particularly at the second line, there is a need toconcentrate on controls for which a failure could
have a material effect on the company.
Overall, it is sensible to focus assurance planson (1) where knowledge over the adequacy ofrisk controls is weakest, (2) where controls are
known to be ineffective, or (3) where trends
and indicators suggest that risk is moving in
the wrong direction. In our experience, many
companies have large volumes of very low-value

Helping maintain current areas ofstrength while advising on developmentof next-generation practices and datatransparency.

- Acting as hub for advanced risk and data

assurance activities, simply because they are
reluctant to remove these in fear that doing sowill expose them to risk. In reality, dynamic andregularly reviewed assurance plans would benefit
organizations in ensuring that activities areanalytics capability – increasingly looking

refocused according to the changing risk profile.

to provide true foresight of emerging risks,We have identified three critical parameters toexploiting accessible high-quality data andanalytics.

help facilitate the assessment of the first line:
1. Knowledge
2. Control effectiveness3. Threat
The Arthur D. Little Second Line Assurance Mapof these three parameters can help companies

Figure 2. ADL Second Line Assurance Map
High

CONTROL EFFECTIVENESSPRIORITY 2

Data or assurance activities
indicate controls may be effective,
but understanding is incomplete.
Further assurance needed toenhance knowledge

map risk areas and assist them in assurance
prioritization when assessing the first line (seePRIORITY 3 BUSINESSAS USUAL

Figure 2). It also provides a platform for theConfidence in control
effectiveness and knowledge –less assurance required

EC/board to dynamically track emerging risks.

EMERGED

EMERGING

PRIORITY 1 EXEC FOCUS
Lack knowledge; lack clarity asto controls required; assurance
needed to gain knowledge

Low

PRIORITY 2

We understand risk, but assurance
activity shows controls are either notin place or not working – stronger
controls required

HighKNOWLEDGE
ThreatLowHigh

Source: Arthur D. Little analysis

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

4

ARTHUR D. LITTLEV I E W P O I N T: 0 1 . 2 0 2 2Figure 3 presents simplified, illustrative examples

With the advent of automated controls andon the rationale behind the placement of risk

improved technology, there is potential forareas on the Assurance Map — in practice it ismachine learning (ML)–assisted assurance andcritical to have robust evidence behind mapping

moving from manual detection to automatedfor traceability and to answer stakeholder

prevention. Risk dashboards operating

questions.

dynamically can eliminate the need for manual
detective controls by providing data analytics in

DYNAMIC AND
DATA- DRIVEN INSIGHT S
Various organizations suffer from a lack ofactionable insights and the escalation of badnews. It’s effective to use data analytics toovercome these issues. For example, if the firstline fails to consistently document assurance
findings, the second line cannot visualize outputs
and make judgments. Static risk registers canneither enable second lines to become risk
intelligent nor help focus activity in an agile way.

real time and alerting organizations when there
are deficiencies in internal controls.
We have identified some key characteristics tofacilitate the shift to a data-driven environment:- Implementing artificial intelligence (AI) andML tools to find insights that are hard forhumans to detect.

- Shifting from lagging indicators toleading indicators.

- Evolving from legacy or paper-based systems
to digital in order to capture critical data
points.

H O W D O W E S K AT E
TO WHERE THE PUCKIS GOING TO BE?
Director, Arthur D. Little client- Becoming more automated and “data rich”

via real-time monitoring and alerting basedon 360-degree range of inputs.

- Moving from a “black box” to a “glass box” byproviding transparency and traceability on
key indicators.

- Using data lakes to aggregate data frommultiple sources (internal and external) andfinding insights in that data.

Figure 3. Rationale behind assurance mapping
PROJECT MANAGEMENT FOR MAJOR PROJECT A
Knowledge

1

Control effectivenessThreatAudit conducted recently showing that controls were effective; trends
heading in right direction; program is currently on track
Project team has conducted similar projects; however, there is moderatecomplexity in terms of interfaces; it is quite politically sensitive

PROJECT MANAGEMENT FOR MAJOR PROJECT C2Knowledge

Data is basic; minimal insights on trends; project team is not very openand transparent; reports are not clear

Control effectiveness

Audit conducted showing several moderate nonconformances; signs
that project will be lateThreatSCORE

Advanced data analytics; trends heading in right direction; first line ofdefense (1LoD) assurance reports are high quality and detailed; 1LoDvery transparent

SCORE

High political sensitivity around project; novel processes with suppliers
we have not worked with before; variety of complex interfaces

Source: Arthur D. Little analysis

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

5

V I E W P O I N T: 0 1 . 2 0 2 2

SINGLE SOURCE OF TRUTH
Managing risk assurance in any organization
should not be regarded as a dogmatic model thatcan be bolted on; rather, it should be recognized
as an ingrained and intrinsic part of running ade-risked and successful business.
To optimize the management of risk assurance
across an organization, companies should
implement an integrated assurance

ARTHUR D. LITTLE

TO OPTIMIZE THE
MANAGEMENT OF RISKASSUR ANCE ACROSSA N O R G A N I Z AT I O N ,C O M PA N I E S S H O U L D
IMPLEMENT AN
I N T E G R AT E D A S S U R A N C E
MANAGEMENT SYSTEM

management system to support a disciplined
assurance process; manage the results ofplanning, execution, and tracking across thethree lines of assurance activities; and ensurethat information can be effectively analyzed,presented, shared, and communicated. The
most essential part of procuring an integrated
assurance management system is designing thespecifications of the system to ensure integration
across all three lines, as well as alignment withthe organization’s key principles, terminology,
and so forth.
In combination with an assurance system,companies should establish assurance
review boards across all three line in order

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

to coordinate an effective approach acrossactivities and key processes. The terms ofreference (ToR) should include the following:- Monitor and report the completeness andeffectiveness of risk assurance to EC/board.

- Seek continual improvement in carrying out

effective assurance by sharing good practices
from inside and outside the organization.

- Share insights from analysis of data onperformance and assurance activity toassist in targeting assurance activity.

6

V I E W P O I N T: 0 1 . 2 0 2 2

ARTHUR D. LITTLE

CONCLUSIONINSIGHT FOR THE
EXECUTIVE“ I D O N OT WA N T TO B E C AU G H T
OUT BY ANY SURPRISES .”CEO, Arthur D. Little client

It is critical for executives to have the peace of mind thatrisks are being managed effectively, or where they are not,refocus efforts to strengthen controls. In summary, theimplementation of a robust Three Lines Model enhanced
by next-generation assurance can provide the following:1	A preventative and rigorous capability to identify
material risks well before they are realized.
2

A proper escalation mechanism that will ensure nosurprises and early and effective decision making.

3Advanced data and analytics–backedassurance insights.

4

A hub of excellence that will provide best practicerisk management capabilities and assurance, whileremoving redundant and fatigued controls.

5	Comfort that emerging risks will be properly
scoped and managed.
6

Full transparency and data sharing acrossthe organization.

7

Removal of duplicated assurance, optimizingorganizational resources and driving businessperformance.

AVOIDING SURPRISES — A CASE FOR NEXT-GENERATION RISK ASSURANCE

7

Arthur D. Little has been at the forefront of innovation since1886. We are an acknowledged thought leader in linking
strategy, innovation and transformation in technologyintensive and converging industries. We navigate our clients
through changing business ecosystems to uncover new growth
opportunities. We enable our clients to build innovation
capabilities and transform their organizations.
Our consultants have strong practical industry experience
combined with excellent knowledge of key trends and dynamics.
ADL is present in the most important business centers around theworld. We are proud to serve most of the Fortune 1000 companies, inaddition to other leading firms and public sector organizations.
For further information please visit www.adlittle.com
Copyright © Arthur D. Little Luxembourg S.A. 2022. All rights reserved.